Snow Leopard could level security playing field
Share of the Mac operating system is growing, and with it the number of malware threats targeting the platform.
(Credit: Net Applications)
of the new version of the Mac OS, dubbed Snow Leopard, could include some security features that would make it secure, or at least push it closer to the level of security that Vista and Windows 7 have, experts said this week.
Contrary to popular Mac fanboy belief, Macintosh is not more secure from a software standpoint than modern Windows; it's merely safer to use because malware writers prefer to target the platform with the biggest install base, according to Charlie Miller and Dino Dai Zovi, co-authors of The Mac Hacker's Handbook, which came out this spring.
"Apple hasn't implemented all the security features that Vista has," Miller said. "They made some improvements in Leopard, but they are still behind."
If there is any truth to rumors circulating about Snow Leopard, the operating system security playing field could become more level as of this weekend and Mac users will really have something to brag about.
First off, a screen shot published on the Mac Security Blog of Intego on Tuesday appears to show a security feature supposedly in Snow Leopard that looks like it is detecting a Trojan in a disk image being downloaded via Safari. The post cites unnamed reports about an anti-malware feature being added.
"If it's true, it will mark a fundamental change in that Apple will be admitting that their operating system is as susceptible to malware as other operating systems," Miller said.
CNET's review of Snow Leopard posted late on Wednesday says that File Quarantine, first introduced in Mac OS X 10.4 Tiger, has been refined in Snow Leopard. File Quarantine checks for known malware signatures and displays an alert dialog if it finds a known offender and will be automatically updated via Mac OS X's software update as new malware signatures are found in the wild, the review says.
It's unclear whether rumors are true that Snow Leopard includes several internal features designed to prevent attacks that Vista and Windows 7 have, known as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on that platform.
By randomizing the location of key pieces of data, ASLR makes it much more difficult for attackers to predict where data is going to be in order to execute their code or the code resident in the process. For exploit code that gets past the ASLR barrier, DEP will try to block it from running, recognizing that it is data and not a legitimate code.
"If you have both, it's hard for an exploit to get around it. Leopard has some ASLR but everything is not randomized and Leopard has no DEP," Miller said. "Things could change significantly for the Mac if they do a good job...That was my main gripe with it."
In June, Dai Zovi reported on a new local privilege escalation vulnerability researchers had discovered that gives local root access on Mac OS X Tiger and Leopard. He offered up a wish list for Snow Leopard that included: real" ASLR; "full use of hardware-enforced Non-eXecutable memory (NX);" default 64-bit native execution for security-sensitive processes; sandbox policies for Safari, Mail.app, and third-party applications (akin to what Chrome has); and Mandatory code signing for kernel extensions.
Apple's Mac OS X security page makes reference to offering sandboxing, Library Randomization, and Execute Disable, but there are no details.
An Apple spokeswoman did not follow up on an e-mail request seeking an interview for this story.
The Snow Leopard Web site says it will offer protection against some common types of heap buffer overflow exploits but not new types of such memory overflow exploits, according to Dai Zovi.
The security level in Leopard falls in between Windows XP Service Pack 2 and Vista, he said. If Snow Leopard has full ASLR and DEP, it would bring its security close to the level of Vista, he added.
While adding full ASLR and DEP to Snow Leopard will boost the operating system's defenses against targeted attacks, the Mac OS software arguably has more holes that malware can slip through, Miller said. "It would be fair to say that Mac has more bugs, but it's impossible to measure," he said.
Market pressure has been missing
In this sense, Microsoft has benefited greatly from the plague of security holes in early Windows versions. Those problems led the company to embark on a quasi-religious conversion in 2002 with Bill Gates launching the Trustworthy Computing initiative and setting security as a top priority for the company. Its Security Development Lifecycle (SDL) program--designed to build security into the software--has become the model for the industry.
Microsoft puts "much more effort into auditing their code, the entire SDL process, developer training, automated source code scanners, and hiring external penetration testers," Dai Zovi said.
So far, Apple hasn't felt that kind of market pressure to improve Mac security, largely because malware writers have ignored it, so its secure software development process isn't nearly as developed or mature as Microsoft's, the security researchers said.
"Microsoft has had a head start. That's why they had ASLR and DEP first," Miller said. "It's not because they're geniuses. They just started caring about it sooner."
"These things go lock in step and it doesn't make sense for businesses to expend a ton of resources when the threat is not there," said Dai Zovi. "So far, Apple has been keeping up pretty well with the level of threats in the wild."
As far as security goes, market share is a double-edged sword. As the Mac operating system gets more popular, the amount of malware targeting it is growing.
The Mac has only about 5 percent market share worldwide (nearly half is in the U.S. alone), compared with nearly 95 percent for Windows, according to market statistics provider Net Applications. But the Mac share is rising, from 3.73 percent to 4.86 percent in less than a year, the firm says.
In the meantime, more and more Mac malware is appearing. Earlier this week, TrendMicro reported that it found a new variant of the JAHLAV family of Trojans that pose as pirated versions of legitimate applications, modify a computer's domain name system (DNS) settings and enabling successful phishing attacks and redirects to sites hosting malware. Earlier versions of the Trojan masqueraded as versions of QuickTime, but this one passes as Foxit Reader or an antivirus program.
Some malware is written for both Windows and Mac platforms and downloads the correct version depending on the browser. Last week, Symantec reported that sites purporting to show streams of new movies were actually feeding up a DNS-changing Trojan instead called OSX.RSPlug.A for Mac and Trojan.Fakeavalert for Windows. Last month, a McAfee blog post wrote about the OSX/Puper.a Trojan that is downloaded onto Mac systems when users download what they think is a video player.
ZDNet's Zero Day blog has covered a number of Mac malware threats this year alone. In January, Intego, which has been tracking Mac malware for several years, discovered a Mac OS X Trojan circulating in pirated copies of Apple's iWork '09 software found on BitTorrent trackers and other sites. Symantec researchers in April linked malware found in bogus copies of iWork '09 and Adobe Photoshop CS4 to what they said could be the first Mac OS X botnet launching denial-of-service attacks. And in May, a new e-mail worm dubbed OSX/Tored-A targeting the Mac was uncovered, although it was not found to be spreading in the wild.
"The frequency is increasing" for Mac threats in the wild, said Dai Zovi. "Still, there are only a handful of threats; no where near what Windows users face."
In addition to considering how buggy the software is, how secure the operating system code is, and whether malware writers are creating viruses and Trojans for the platform, another factor in play is how likely Mac users are to be duped into visiting a malicious site, opening a malicious e-mail attachment, and downloading a fake file.
Most Mac users seem to take pride in their supposed invulnerability, so one would think that they are less cautious in their surfing activities. But it's hard to tell.
"No computer or operating system is more or less secure when it comes to users being tricked into downloading something," Miller said.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Call me when something more dangerous than a local exploit shows up for it, then I'll be impressed.
Otherwise, it's just so much hot air.
Do the same for me when the same happens for Vista. You know, something that can install without user intervention.
Or get yourself banned again. Whatever.
You guy have a serious problem.
Did you try to make a Clean Install of your OS ?
I am quite sure your Mac has been loaded with a lot of useless bells and whistles and pseudo-utilities downloaded from nowhere which interfere with the normal use of your Mac.
I'm a Mac User for about twenty years.
Never, I mean never, it took thirty seconds to switch from an app to another.
Even on a SE30 or IIcx running in Multifinder mode under MacOS 6!
I do not say you lie. I say you are not telling us the whole truth.
I am perfectly aware of the speed domination the PC had for a long time in the past over the Mac.
But this is not the case anymore.
Since Apple uses Intel processors running Tiger 10.4.11 or Leopard, Macs are as speedy or speedier than any PC equipped with the same or equivalent processor.
All tests run by independent labs prove it.
An important topic, although it unfortunately misses the real threat, while successfully pushing peoples' hot buttons to get website hits (4 pages of comments & counting).
Historically, Windows has "better" security features, if that's today's definition of MORE.
The simple reason is that its security had been so bad for so long, plus there's extensive legacy elements that's not been made secure simply by getting rid of it. Such is the price for backwards compatibility.
Think of an analogy of a boat and keeping water out. The Windows security toolkit has an inner tube patch kit, shellac, wood glue & clamps, glass gel and a MIG welding torch ... because Windows is kept afloat by (respectfully) inner tubes, canvas, wooden planks, fiberglass and metal.
As Noah would say: "How Long Can You Tread Water?"
Since each hull material must be repaired differently, one ends up with extensive 'repair' tools. However, having more tools is only necessary because of its heterogeneous patchwork nature.
Now sure, OS X isn't immune from being perfectly secure. However, by trashing legacy garbage, a more homogeneous OS architecture exists, which means a smaller leak repair kit...and ultimately a more easily-maintained system.
By being easier to maintain, those fewer caulking gaps between different hull materials means that its more work to find small holes to exploit, etc: as the article even says, potential hackers find things by "LUCK": it is simply harder to work against OS X. This doesn't mean that OS X is perfect, but what it does mean is that it is far easier for that hacker to go over and pick the low hanging fruit of Windows to write his exploits.
Thus, the question isn't if OS X is perfectly secure or not: all that's required is for it to have an inferior Hacker ROI than targeting WIndows.
This is afforded in two ways. The first is by making it a more hardened target. The second is that market share has also had an influence on this. However, with the overall Mac marketshare demographic being more affluent than average (more money to steal, etc), plus some college campuses now being more than 60% Mac marketshare, we have to place increasingly greater weight on the significance of the "hard target" dimension, much more so than the "security through obscurity" potentiality.
(When asked why he robbed banks, Willie Sutton simply replied, "Because that's where the money is.")
However!
What this article completely misses is that the nature of the security threat has substantially changed over the past decade.
Today's pragmatic real world threat is overwhelmingly a trojan, personally authorized to install by the operator.
As the article admits, Apple began to address this security risk vector (through File Quarantine) back in 2005. Apple is now enhancing it further by having its malware definitions integrated into OS X's Software Update system.
The overlooked implication is that this means that it is increasingly seamlessly and automatically kept up to current definitions for the entire installed user base.
But because this is done with merely one tool instead of a fragmented dozen, we are expected to believe that it is somehow "worse".
"Riiiiiiight".
-hh
Also, Mac OS X has less code (and as a Unix based system is more efficient) and therefore it's harder to find holes and easier to block them.
"(and as a Unix based system is more efficient) and therefore it's harder to find holes and easier to block them."
Citation needed!
but as you all probably know, a trojan is a programm that you have to download and install (you even have to type in your password) to affect you. worms and viruses do so without your knowledge or interaction. should apple be more agressive in teaching their users that they have to be very careful to download and install programs from unknown or untrusted sources? yes, is there the same malware threat for mac os x as for windows? no.
http://macdailynews.com/index.php/weblog/comments/22221/
the windows sheeple have to be kept in the pen, no matter the cost. that is the purpose of cnet. because 99% of their advertising mrevenue comes from the windows ecosystem the erosion has to be stopped at all costs.
Wow maybe you should call ford and ask them if you need a new ford car to be safe on the roads? I'm sure they will be unbiased just like mcafee and those two writers.
Or you can talk to people who live in the real world, I am in charge of 2500 Mac OSX machines and about 400-500 windows machines and over the last 5 years i have seen 0 infected mac computers, and at least 50 windows computers infected with virus's. ad in the amount of time i spend babysitting virus updates when they don't update properly, the huge amount of ram eaten by sophos,and the time it took to switch from mcafee to sophos 2 years ago when mcafee upped the price of our renewal. I have spent more time working on 500 windows machines to keep them running than I have on 2500 mac computers. That is real world experience, and not biased as I honestly run vista at home, i look forward to getting windows 7 I don't mind spending time keeping my machine at home in running order, but for people who don't want to deal with all the crap a Mac is the way to go, THE REASON DOESN'T MATTER the fact is I have never seen a mac computer infected with a virus.
That's right, ellroy, you couldn't have said it better. Mainly because you don't have the brain power to do so.
Wake up: It's 2009 and not 2006.
WRONG.. .the VAST majority of those computers run XP and lower.. XP and lower is swiss cheese.
Given that the damage is the same once you have a security issue in a MAC or in Windows, a larger installed base comes with higher probability, since the number of virus and malware target it.
So, the risk associated with Windos OS is still higher.
The security features tend to be more advanced in that one of larger installed base. Microsfot strategy was building features before the security were good enough.
From the marketing point of view, that worked great, since they get 95% of the Desktop OS Market. But from the users security point of view it WAS a disaster in 2001,2002,2003,2004s.
Actually, that isn't the case. The two are built entirely different, so probabilities go out the window when it comes to assessing "damage"
A compromised website on Unix usually requires patching the hole in php (which is the usual route) and replacing the altered content - the OS itself sits untouched. A compromised website on IIS/Windows will require a complete rebuild/restore of the server.
The reason why translates to the user level as well - it is still too easy to get system-wide access on a Windows machine. They've managed to improve a bit, but nowhere near as well as their competition.
The reason Miller and the like crow about Windows 'improving' is more due to his outdated skillset w/ Windows than any new uber-security improvements in Windows itself. See also, oh, Conficker as a good example as to why I can say this and be confident in doing so.
And this has what to do with Windows Vista from a consumer point of view?
Oh that's right. Nothing.
It's really a function of how effective the Mac malware writers are in targeting Macs. For windows you could shotgun things and hit a lot of Windows PC's. For a Mac you (for now) need a more targeted approach. However right now having the field to yourself would be huge boon to the Mac malware writers. The windows malware guys have to compete with each other. That's rather funny when you think about it.
Yes there are a couple trojan's but they require you to click "yes I trust this software I downloaded" and than put in your administrator password. a torjan is not a virus.
Quoting myself from another news forum...
'Please list any proven mac virus in the wild that can infect a machine without explicit user interaction? and sources.'
>>>>Um, in case you didn't know, most viruses do not install without user intervention. Most viruses come through e-mail, initially targeted at people like politicians and high-profile clergymen. The very first virus was written for the Mac, before the launch of McAfee in 1987. These days, even if you're using Windows XP, you're unlikely to see a bona fide "virus" unless you open e-mails (and their attachments) from people you don't know.
The most immediate threat to XP and earlier is an online exploit, most commonly in the form of a drive-by download through a browser. And while an uneducated Mac user such as yourself will use status quo as evidence of inherent security, there have been four breaches on OS X through Safari in Pwn2Own competitions each year since its inception. You want sources? Here you go:
http://securitywatch.eweek.com/apple/mac_hacked_via_safari_browser_in_pwn2own_contest.html
http://www.darknet.org.uk/2008/03/mac-owned-on-2nd-day-of-pwn2own-hack-contest/
http://blogs.zdnet.com/security/?p=2917
http://it.toolbox.com/blogs/securitymonkey/mac-os-x-local-user-exploit-appears-12026
http://www.linuxtoday.com/news_story.php3?ltsn=2009-04-17-030-35-SC-SW
http://blogs.computerworld.com/why_windows_is_safer_than_the_mac
http://www.dasmirnov.net/blog/charlie-miller-on-the-lack-of-security-o
The closest thing we had to an ItW exploit for OS X was a PoC outside of the security conferences, on Landon Fuller's Web site. I would link you to it now - so you could see your "impenetrable" security circumvented first hand - but unfortunately, the files have since been removed from the site. That said, what's the difference between PoC and ItW? Time.
'remember "proven in the wild" isn't on a bench at a black hat conference, a windows xp machine after a clean install placed online can be infect within 1 hour with 0 user intervention.'
>>>>You seem to be choosing your words rather carefully, trying hard to avoid putting your foot in your mouth. Unless everyone in your family can only afford netbooks (unlikely, assuming you yourself use a Mac), XP is no longer on the market. And furthermore, what is this supposed to say about how bad MS' security is? XP was released in 2001; there was no such thing as a drive-by download then! Now show us an ItW exploit that circumvents DEP and ASLR. Then, you can add Safe Unlinking and XP Mode (hinders rootkits from installing their own emulators), which Windows 7 introduces in October.
There are two theories amongst security researchers on what will happen as W7 erodes XP's market share:
1) Bot herders will turn their attention to the most vulnerable platform remaining... OS X.
2) The threat landscape will revert back to social engineering tactics. And since there are Trojans for Linux and OS X already, you can bet Russian bot herders will quickly add these to their arsenals, in effort to make up for huge losses in remotely exploitable machines.
Either way, you're next. If I were you, I'd dispense with that challenging tone. There are people here who know security better than you do.
Your system can be rock solid but if the user is tricked into downloading a program and installing it (in other words, give admin access to it either by typing the admin password or giving a go on UAC), all security goes down the drain.
Now that most people have NAT routers and the firewall default is "always on" the burden of protection has moved to the user. But there are still thousands of boxes in the wild scanning for security vulnerabilities and if you turn off your firewall and get rid of your router you will definitely be infected.
Let's compare OSX to Vista or 7 or Windows Server 2003 or something remotely in the ballpark. It pales considerably. I'll note that all of the OS's were equally impervious at a hacking competition until the browser was made available as a surface area of attack. After that happened, the Mac was the first, and easiest, to crack wide open because they don't have the security checkpoints in place that Vista and 7 do.
That's not to say that Mac's are inferior, all's I and every other reasonable person am saying is get off your high horse. Mac's aren't special. They're computers, and their /security/ aspects are completely over-rated and in fact sub-par compared to it's primary competitors.
I don't like the spam generated by their computers."
Spot on! That is probably why they say that most spam originates in the USA and not taking into account that the URL in the body of the message takes you offshore.
OSX Preview is a free PDF reader. However, I am sure that our friend tetraploidies will tell us that you need an overpriced Mac to run Preview.
As to installing some off the wall CODEC in order to see a video, well don't do it.
You can write malware for any operating system.. the difference on the Mac is.. in order for it to do any real damage to the system.. it needs the user to enter an admin password.
ballmerisanape: "You can write malware for any operating system.. the difference on the Mac is.. in order for it to do any real damage to the system.. it needs the user to enter an admin password." You need to read up on User Account Control.
@ballmerisanape
I tried the apple PDF function build in and didn't like it. Adobe offered theirs for the Mac so I used that. Others don't like the bloat of the Adobe solution so I can see where a 3rd party market could exist.
OK, why is it wrong - the technologies argument seems pretty compelling. Well as tech writers so often forget technology only gets you so far, let me explain:
Firstly there is the numbers game, there are more Windows PCs, and yes they make a pretty tempting target. But there's more to it than that. A lot of infections aren't WEB to PC, a lot are PC to PC (often via thumb drives). As there are so many PCs this PC to PC interaction (that might infect a system) is a lot more common than Mac to Mac.
Next, and the one the yahoos who's views are expressed in the article have truly forgotten, is legacy. How many Vista boxes have UAC turned off? (I have seen first hand a large number) Mac's version of UAC is much easier to live with, and I'm pretty sure can't be disabled. OK, how many people have a few programs they have to run as administrator? Again I know of a reasonable number of examples of this too. Here many of Vista's security features are simply not working for the user.
Right, so maybe this doesn't describe YOUR Vista set up, but it is a common set up. Now what security features does Mac have? Well Safari (Mac's most used browser) has introduced Phishing Protection, Malware Protection (it highlights the site - currently on Leopard is doesn't look at downloaded files, though this protection is in the Windows version, and I suspect is included in Snow Leopard's version - though I have no advance knowledge), Extended Validation Certificates, Cookie Blocking, and it will query the users before running anything downloaded for the first time (this includes data about when and where the file was downloaded, Mac's default filesystem includes support for metadata). Mac OS X has always run in a "reduced privilege mode" and will prompt for a admin password before a process the user has run can modify certain parts of the system (similar to UAC, but far less chatty, AND the user must enter a password, not just click a button).
On balance even the current version of Mac OS X (without any user "hardening") is fairly secure, yes it can me improved by changing the defaults (and like on Windows some of those changes can start to make the machine a pain to use) and yes the improvements will be most welcome. But the idea that the current version of Mac OS X is highly insecure (for most users) isn't correct. Will I bee upgrading to Snow Leopard? Yes, and that is in part motivated by a desire for greater security.
Do I as a Mac user take security seriously? Yes, I have an old Mac that can't run Leopard - I wouldn't dream of actually using that system on the Internet! (It currently has Mac OS X Tiger installed, next stop for it is either out the door or a PowerPC version of Linux).
But if you're reading this and you have a Mac, if you can upgrade to Snow Leopard then that is probably a good idea, better security can't hurt, and better speed is always nice. If you can't, you can probably hold on to that Mac for a while yet (probably another two years at least).
Really, and how many people do you know that shell out for Vista 64bit and will for Windows-7 64bit? I know of one business. ONE that has done this. The rest just use whatever comes on the system...IE: 32bit.
With Mac's (and I own both Windows and Mac) you get what you get; no fuss, no deciding which of the seven 'flavors' actually works best.
Every business deploying Vista I've worked with, and they also plan to migrate to Win7 64-bit. Your anecdotal evidence is just that; anecdotal, as is mine (though clearly I have more experience with it than you do). It doesn't change the fact that Win7 64-bit is more secure than OS X 10.5.
Uh, you do know the license covers both 32 and 64 bit versions. You just can't use them concurrently.
Try again. Your post was almost as laughable as Jeremy's.
Just try getting Microsoft to honour their license. I've had first hand experience of this - it's a nightmare. Microsoft's representatives (mostly offshore) don't understand their own license. They also hide behind the "it's OEM" excuse. My advice for anyone buying a PC with Windows pre-installed is be very careful you get either the version you actually need (64 or 32 bit) because trying to fix it later shows up Microsoft's support badly. If you are stuck in this hole something worth knowing (apart from the fact you ARE RIGHT despite what you're being told is if your system was build by a smaller vendor Microsoft call them "system builders" make sure you tell them your system was build by a "system builder" and not an OEM - no I don't understand why this works, but it does, you will need to pay a little for the DVD but I did expect to)
Here in the UK almost every school runs software by Capita, generically it's called SIMS. SIMS cannot run on Windows 64bit (which is how I got to know the above) AND can't deal with UAC (you have to run it as administrator) this software is almost universal in UK schools - not something small that nobody actually uses. There are plenty of other examples from other industries that similarly don't play well with Vista's security model. You'll tell me that the problem is the application, and I'll agree with you - but none of that actually matters when it's your line of business application. I'm not apportioning blame here. And no it's not all about numbers either.
If you only run nice up to date applications, written by the big vendors, well sure you might well get one impression about the state of Windows security. You deal with a few SMEs, believe me, you'll get another very different view.
Yes, I have a Windows 7 box here, yes it's a step forward from Vista (though I think Vista gets a bad rap because so many applications have a problem with it - from a security technology perspective Vista was a big step up from XP SP3) I don't see the giant leap forward that's being talked about. I think Vista's taken most of the heat and Windows 7 is benefiting from that. If you're on Vista I think Window 7 is a small upgrade (especially if we're limiting ourselves to security matters) but worthwhile. If you're on XP then things are different, moving to Windows 7 is a big step (but you'll have to make it sooner rather than later) but will improve the security of your PCs hugely.
As for the Mac is a shambling mess, I just don't recognise that. Yes, Snow Leopard is a huge step forward from Leopard (in terms of security) but in reality this is fixing a problem that doesn't exist yet (though waiting for it to exist would be stupid).
if you buy from an OEM then you're buying from their master of Windows which is a system builder copy. You approach the OEM to get the 64 bit version. I did this with MESH.
"Here in the UK almost every school runs software by Capita, generically it's called SIMS. SIMS cannot run on Windows 64bit (which is how I got to know the above) AND can't deal with UAC (you have to run it as administrator) this software is almost universal in UK schools - not something small that nobody actually uses."
Well since Capita Children's Services recommendation is that you run it on MS Server 2003 I'm not sure where you're going with this. I believe they're also building Vista support - as well as Office 2007 - support into it anyway.
Conversely SIMS won't run on OS X at all. That's why you're analogy is a bit silly - it doesn't matter that OS X has a nice version of UAC because:
a) The application you mention doesn't even run on OS X.
b) If it did it may very well run into the same problems as Vista does with UAC.
If your system was built via a "system builder" then it actually IS Microsoft who are offering the 32/64 bit migration (but hardly anyone inside Microsoft know this... ). Trying to get this resolved is utter voodoo - eventually somebody will figure out what you're supposed to do, then you pay your £26 and the DVD arrives - until that, well it's nightmare city (Again it's Capita's SIMS - won't run in 64bit mode)
Your talking about the requirements for the Server, I'm talking workstation. Captia claim they've "done" the migration to Vista - but it needs to be run as Admin (which is hardly my idea of a proper Vista app...) It also works with Office 2007 (I have no idea if there are any issues - the whole thing is a stinking pile, and no I'm not blaming Windows, it's pretty clear where the fault lies).
My point is, there is a lot of software that "runs" on Vista, but needs Vista's security somewhat hobbled (which lets face it, while it's not Window's fault rather blunts the security). So the "average" box, can't be considered as having all those feature intact (as a significant number simply won't). On the Mac, with Apple's attitude to backward compatibility (which is basically: "sure, as long as it doesn't get in the way") things are different, if a program can't run due to some new feature then it doesn't run (you can't switch the feature off). Now that means that Apple switch new features on with care (32 bit Kernel, for example) but more often it's the applications that have to come up to snuff. Now this is short term pain, so denying it, but it makes the ecosystem evolve faster. A lot of Vista's problem was it tried to adopt a more "Mac-like" approach, and that was a heck of a shock to the Windows ecosystem (rather more than it could stand in fact). Windows 7, is a pause, UI features with few real changes. But I think it just that "a pause" I fully expect Windows 8 to arrive quite quickly (if Microsoft have any sense at all) and to take a "hang-em high" approach to laggard applications. Will it stick? I don't know, but if it does Windows will be all the better for it.
Do you see what I was driving at now? I'm not a "Windows hater", I don't think Vista failed because it was bad software, or badly marketed, or even the wrong ides - no it was simply a bit too much of a shock to the PC ecosystem, but Microsoft should adopt a similar policy in the future, the PC ecosystem will adapt, and Windows can improve much faster as a result. I currently have Windows 7 RC on a machine (not a Mac I hasten to add) and it's OK, I'm not a great judge for everyone as the system is new and I don't run lots of old software on it - YMMV, but if you're on a new system with new (mainstream) software then it's a great version of Windows. It won't have me giving up Mac OS X, I'm a Unix person and more than that I came from NeXTSTEP so I really, really like Mac OS X. I do recommend Mac OS X for most people - but not everyone. If you've grown up on Windows I can see you take a different view, as I say YMMV.
It is ludicrous to say that the Mac is more secure because fewer hackers attack it. That is like saying the bank with no security guards is more secure than the ones with security guards, as evidenced by the fact that it does not get robbed.
First of all, security is not determined by the number of attacks. Security is a quantifiable issue based solely upon whether or not a system possesses the requisite deterrent to thwart hackers. To say that Mac... which never gets exploited... is catching up to Windows... which gets exploited by the minute... is nothing short of a ludicrous argument.
Second, hackers love a challenge. To say that hackers bypass the notoriety of hacking a Mac, simply because there are only 100 million Macs on the market in contrast to he 900 million PC's is... dare I say it... ludicrous.
The only thing hackers bypass are systems that are too difficult to crack. This article is one huge logical fallacy. And I don't even own a Mac.
Statement 1: Security is not determined by the number of attacks
Statement 2: Security is a quantifiable issue based on possessing the requisite deterrent to thwart hackers
Statement 3: Windows gets attacked more often, Macs don't.
1 and 3 are contradictory. First you say it doesn't matter how much an OS gets attacked, then you refer to the number of hacks as a reason for macs being more secure. 2 is the exact point of the article. Vista and Windows 7 have the requisite deterrents to thwart hackers and leopard doesn't.
i think you have a bit of a logical fallacy of your own going on.
1: Macs have a smaller base. There just aren't as many programmers willing to do it for a Mac. If you think it is because Macs are harder to hack, please read up on Charlie Miller
2: Macs are based on Unix. The security model in my opinion does have a stronger base, but it is still a little underdeveloped on the Mac.
3: Mac users are generally more educated about viruses and hacks. This is the biggest one. Most people that use macs have switched from PCs for one reason or another. In order to feel comfortable with a new OS a user must learn why they are switching and all about the new/different features of the OS. That being said, most(not all, most) Mac users are more aware of these threats. In my experience with the average (don't get mad at me windows fans, I just said the average) windows users, they are all very aware that viruses exist, but they wouldn't know one if it hit them in the face, so they just give it permission to run without a second thought.
The article talks about numbers and user base. The relative desire for hackers to "GO AFTER" a mac. It's not worth their effort is the articles' assumption.. Oh please. Like PTRSR states.... give em a challenge. Why don't they take the challenge?
Ok, let's say that the user base is 5% Mac, let's half that and say 2.5% of the hackers are trying to go after OSX. So we should at least see (let's be conservative) 1% of all malware being successful against Mac users.... Sorry, no luck. And that's with 99% of all Mac users not even attempting to block the threat.
Yes, the potential is there, but it's not happening, so that tells me there is a difference, and if Snow Leopard improves the chances even more..... GREAT!
Talk all you want, I'm a fanboy all the way and proud of it! I'll also repeat what I've stated in previous threads. I sell School Surplus. I look at piles of old computers every day, I separate the Macs, sell those on ebay, send the PC's to e-waste for recycling. Just last month, the company I work for sold over 100,000 dollars in Macs that were 5-7 years old. The funny thing is, the PC's I trash are usually only 3 years old... go figure.
I have to laugh each time someone brings up the "Oh, the Mac got hacked in 2 minutes" thing. Every time I read about someone "hacking" a Mac, they always have to remove security from the equation BEFORE they can hack in.
You point to Charlie Miller. If YOU did your research, you'd know that no one was able to get into the Mac they way a normal hacker would. The only way he was able to hack it was AFTER the CanSecWest guys changed the rules and removed a layer of security.
I'll quote the Macworld article: "Nobody was able to hack into the systems on the first day of the contest when contestants were only allowed to attack the computers over the network, but on Thursday the rules were relaxed so that attackers could direct contest organizers using the computers to do things like visit Web sites or open e-mail messages."
Again, this all comes down to user issues. I've never heard of an instance where a Mac has been hacked remotely. Every time they have one of these "contents," they always have to adjust the rules so they can have people go to websites or they allow the hackers direct access to the computer. Those types of things aren't common, so these kinds of arguments are garbage.
Is OS X totally secure? No. No system is. It's impossible to have a completely secure system. And better security is never frowned upon. But the day one of these so-called "hackers" can actually get into a Mac without having someone in the user side do something stupid or having to have layers of security turned off to prove their stuff, then I'll pay attention.
Real world security is determined by the number of attacks. Macs win on this point.
Windows has a higher level of security measures built in. They are harder to hack than a Mac but far more frequently targeted at this point. Obviously that means they are not "harder enough" to attack.
For an anology, typically a town with a larger police force has it becuse it's needed. It's actually a symptom of the level of crime. You are safer in the town with a smaller police force. Windows is more secure out of need. OS X is increasinly more secure out of an increasing need.
Do try to keep up.
Err, isn't Snow Leopard that exactly what you're talking about? This is Apple's response to a threat that hasn't happened yet. Yes there have been some isolated attacks (none of which have gained any traction) but the wave of attacks that Microsoft have faced still hasn't happened, Snow Leopard is an attempt to make sure it never does.
So why's it still happening then?
That's what this article says. Apple is getting is crap together in the security dept.
The majority of malware capitalizes on the ignorance/mistakes of a user.
...if you had root privileges, sure. Here's a simple "malicious script" that will blow up any *nix machine, assuming the user had root privs:
============
#!/bin/sh
sudo -u root rm -rf /
exit 0
============
...and here's a similar one for Windows (as a .bat):
============
del /p /f /s /q /a:RHISAL c:\*.*
attrib -s -h -a -r recycler
del /p /f /s /q /a:RHISAL recycler
============
Now - which one would do the most damage, assuming an ordinary user with no administrative rights? :)
In your example, the WIndows system would be left corrupted and largely unusable, if not unbootable.
The Linux system would have allowed the person sexploiting it to have full root access, the ability to install anything they want on your system including keyloggers, bots, etc, *all without your knowledge*
In your examples, I think I'd rather have my system destroyed since I have backups of data than to have it turned into a spy without my knowledge, quietly snatching up my banking information for ID theft.
Both are bad, but... yeah, guess it's a matter of preference I suppose.
#!/bin/sh
Type Adminpassword:___________
sudo -u root rm -rf /
Comment "Running this command can....blah blah"
Type Password:__________
exit 0
Also, something like this would require you be at the machine itself, where as on a windoze box... lol. I can yell at the internet from across the room and crash several windows computers.
It has alot to do with the open ports on a winbox which are closed by default on a mac. Hell, even the admin account on a mac can not destroy the system without jumping through hoops. Most hackers are script kiddies nowadays. They do not have the natrual talent to exploit a mac and its inherently tighter security. I for one would love the bragging rights of releasing a mac virus into the wild but its just not possible to creat something that would spread past the first dumb user to let it be installed.
He asks "Now - which one would do the most damage, assuming an ordinary user with no administrative rights?"
If they have no admin rights, then the script fails at "sudo -u root rm -rf /"
If you have admin rights and you're a moron no useful OS will help you.
Enough with the strawman arguments.
So... millions upon millions of near-homogeneous machines whose owners are in a relatively higher-paid demographic and don't run any sort of A/V would not make for a valid target? Hell, botnet herders start bragging at 100k or more 'doze boxes in their stable. Imagine what a million or two machines could do...
Thar's money in them thar Macs - and I don't doubt that many have tried. So far, the best the black-hat community can come up with is a spate of trojans that requires a real stupid user to activate.
They're going to have to try harder than that...
"So far, the best the black-hat community can come up with is a spate of trojans that requires a real stupid user to activate."
Spot on, and you nailed it right there. That's the problem that Apple has facing them. Their end users are used to not worrying about security and ARE ignorant enough to click on whatever is on their screen. Sure, YOU won't do it, but the average Mac user is not a geek to that level. And that's the real danger, isn't it? The ignorant few who do click on this or that exploit vector and create the bot net without their knowledge until it's too late.
It changes from Security through Obscurity to Insecurity through User Ignorance. :/
Speaking of conficker, regarded as the most "successful" virus ever, in install base, it still only infected around 2% of the Windows PCs in the world. OS X has around a 5% worldwide market share worldwide. With that small of a market share proliferation of the virus to 2% would be incredibly hard because depending on how it spread it would hit a dead end 95% of the time. But let us just say it did hit those high numbers, 2% of 5% of the computers in the world would yield you a zombie network of little importance due to it's low volume.
As for what has already been done, there are several drive by downloads that have been shown that require no user interaction what so ever, as well as plenty of downloads with code that can take over a system.
The mac fanboys have ignored this fact here and are instead reminding the Windows user that in practice, OS X is more secure. This is something I would agree with.
Though it sounds good, you know not 1% of what you speak. And chaning the word "virus" to "malware" in your hitpiece du jour still does not an argument make.
There are fewer viruses and malware because the platform is stronger. Been using my Mac without any protection since OS X came out and never have I run into 1/100th of the malware, spyware or virus problems my cheap-ass Windows friends have.
Pull your head out of your cubicle once in a while!
This article was more about actual code security, not user security. They even mention that the user is ultimately the most important factor. Pull your head out of your cubicle.
You assume that in the computer realm, all bullets and all targets are equal. Cute analogy, but it doesn't fit at all.
It fits perfectly to what the original commenter stated Just because you don't grasp the concept doesn't mean the analogy fails.
/"Microsoft has had a head start. That's why they had ASLR and DEP first," Miller said. "It's not because they're geniuses. They just started caring about it sooner."/
Really? When? After years of neglect, that's when. Microsoft didn't have an epiphany about security. They were besieged by viruses and malware.
And I note they mention "from a software standpoint." As opposed to an OS standpoint?
http://en.wikipedia.org/wiki/AutoRun
Do you really want to type your password everytime something is inserted? (be it USB/DVD/CD/what ever can autorun..) I can guarantee you hundreds if not millions of ppl will start shouting in uproar, not to mention the fact you probably checked off always run with this app box... which should never be done unless if ur lazy and dont care
On Vista and Win7, if an application you run, on removable media or not, requires admin privaleges you will get a UAC prompt. In the original versions of UAC in the Vista beta, Microsoft required a password. However too many "knowledgeable" tech journalists wrote negative reviews of UAC being annoying, so they reduced it to a simple Continue or Cancel prompt (for admins... limited users still get a password prompt). Admittedly, UAC in Vista delivered too many prompts causing the typical user to just click Continue for everything. With Win7, this has been reduced by changing the UAC default to only display when a program needs admin privaleges not for user driven admin actions.
Your comments show how little you know about how modern Windows operating systems work. You really need to do some research before attempting to contribute to a topic.
Nice but not quite apt. If you were going to install a metal door, you install the frame first.
Being in a contemplating mood, I contemplate on my PC-using friends, who have more or less serious malware problems now and then despite using time-consuming and intrusive anti-malware programs, and my Mac-using friends, not one of whom I've ever heard having a malware problem despite not one of them having any sort of anti-malware program.
I must say I have some problems aligning this real-world fact with the above propsed fact that Windows is more secure, at least in any real-world, joe-or-jane-the-user perspective.
Mac has less need (from less attacks) and thus has taken less measures. Windows has more need (from more attacks) and thus has implemented more security measures.
That's what you are observing.
Mac is seeing more attacks and Apple increased their security measures with Snow Leopard.
What you are seeing shouldn't give you more problems with Windows having more security measures built in.
- by ddesy August 27, 2009 5:59 AM PDT
- Oh yes! More FUD claiming that Vista and 7 are more secure than Mac OS X. What are the real life, common exploits? We already know that "security through obscurity" is a myth.
- Like this Reply to this comment
-
-
- by NikEst August 27, 2009 6:06 AM PDT
- If Vista and Windows 7 have ASLR and DEP, but OS X doesn't, then Vista and Windows 7 are more secure. Those are simple, but effective, methods of providing basic security to the OS. Personally, Snow Leopard needs to have those things included.
- Like this
-
- by Random_Walk August 27, 2009 8:59 AM PDT
- "...then Vista and Windows 7 are more secure."
- Like this
-
- by TechSlap August 27, 2009 10:05 AM PDT
- Totally agree NikEst. Hire people to find those exploits, then patch them before there made public. Now, I'm sure they must have a team that does this but... Maybe try and get some outside sources.
- Like this
-
- by DrtyDogg August 27, 2009 5:07 PM PDT
- @Random_Walk:
- Like this
-
- by santuccie August 28, 2009 4:58 PM PDT
- Denial. He's so devout in his religion that he is refusing to acknowledge the truth.
- Like this
-
- by Renegade Knight September 8, 2009 12:09 PM PDT
- Oh Yes a FUD argument about non FUD.
- Like this
-
Showing 1 of 4 pages (202 Comments)Also, if Vista and Windows 7 are exploited more, then we know about the holes in Windows, whereas we have little to no idea about the holes in OS X because people haven't exploited them.
For the interest of not being flamed: I am a Mac user that thinks Apple needs to get on the ball about making real attempts to secure its operating system. Hire some hackers and fix what they find, that's not that hard to do.
Explain Conficker, then. ;)
http://blogs.pcmag.com/securitywatch/2009/03/the_most_important_things_to_k.php
"Windows Vista is technically vulnerable in this way, but the exploit is almost impossible to execute on it. Conficker is basically an XP problem"
Why would you ask that question when you already know the answer ;)
/p