Home

Mac OSX Batch Patch

Mon, 03/21/2005 - 21:53 — kebernet

News.com.com/com reports on the new patch set from Apple. This one included patches for Safari (IDN phishing), SquirrelMail, Samba, Mailman and the usual suspects.

In a related story, ZD gets a bunch of Mac bashing quotes from the *cough* independent analyst set and runs them like it is a story:

In its seventh bi-annual Internet Security Threat Report, Symantec [ed: related] said over the past year, security researchers had discovered at least 37 serious vulnerabilities in the Mac OS X system. According to Symantec, as Apple increases its market share — with new low cost products such as the Mac mini — its userbase is likely to come under increasing attack.

"Contrary to popular belief, the Macintosh operating system has not always been a safe haven from malicious code," Symantec said. "Out of the public eye for some time, it is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various Unix-based operating systems," the report said.

"Apple Computer has become a target for new attacks… The appearance of a rootkit109 called Opener in October 2004, serves to illustrate the growth in vulnerability research on the OS X platform… The various OS X vulnerabilities allow attackers to carry out information disclosure, authentication bypass, code execution, privilege escalation, and DoS attacks. Symantec believes that as the popularity of Apple’s new platform continues to grow, so too will the number of attacks directed at it," the report said.

Symantec’s concerns were echoed by James Turner, security analyst at Frost & Sullivan Australia, who said many of the people who bought Apple products were not concerned about security, which left them wide open to attack

"The iPod, PowerBooks and mini Macs are cool products," Turner said. "The by-product is that people are buying these products for form over function. [ed: Emphasis mine. Nice huh?] They say it looks pretty and then buy it but don’t secure it. As Apple increases its market share, it will be a legitimate target".

Trend Micro senior systems engineer Adam Biviano said all complex operating systems had security flaws and the more popular the platform, the more likely it would be attacked.

"All sophisticated platforms — Mac, Linux, Solaris or anything else — will have vulnerabilities," Biviano said. "The only reason Windows has had mass exploits written for it is the sheer number of connected devices that are present on most networks. As soon as you start seeing mass deployment of any technology you are going to see exploits".

According to Biviano, while there have not been any mass outbreaks of viruses targeting the Mac, the potential does exist.[ed: emplahsis mine again]

The thing all these stories miss, however, is that while every platform has flaws, a heterogenic computing environment benefits everyone. Something like SQLSlammer can bring networks to their knees, rather than just pissing off a few people. A mix of OSes AND CPU architectures mitigates the larger risks, if not the personal.

Comments

Tue, 03/22/2005 - 12:02 — atrox (not verified)

RE: Mac OSX Batch Patch

They are also missing the frequency and severity of the flaws and the FACT that OS X IS A "unix=based" operating system, HELLO?

These are apples and oranges we are comparing though (windows vs unix-based). I own "Unix-based" type machines, Apple OS X machines (4 now ;)) and Windows 2000 machines. I have also administered Unix and Unix-based machines and Windows (NT, 2000, Term Server) machines professionally.

Its no contest which are subject to more issues and flaws and problems and so on, at least in my personal and professional experience, Windows has far more issues, and far more issues of a serious nature.

Now sure there may be a real statistical correlation to the number of problems and the popularity, but as of yet we are nowhere near approaching the same number or severity of issues in "Unix-based" machines as we already have in Windows.

(Hell "Unix-based" machines, regularly do stuff like this - 11:56am up 193 days, 18:19, 1 user, load average: 0.00, 0.00, 0.00.)

And yes Cooper, great point about heterogeneous.

Tue, 03/22/2005 - 12:38 — Andy (not verified)

RE: Mac OSX Batch Patch

Just another point that I think is important...

Apple ships a LOT of open source software with OS X, including Samba, Apache, OpenLDAP, and a lot of other stuff. These are large apps and vulnerabilities are inevitably found from time to time.

However, Apple does the responsible thing by not only providing timely updates when bugs are fixed, but by exposing more people to the software and therefore increasing the chances that problems are identified and fixed.

Not to mention the fact that Apple's developers contribute a lot to the OSS software they ship, like through their work with Darwin or KHTML. I'm sure they also contribute fixes to Samba, OpenLDAP, etc, which are all important components in OS X.

So, in other words...yes, bugs are in all software, OS X included. But Apple will be in much better shape than Microsoft as market share grows because of the responsible way they respond to bugs and vulnerabilities.

Tue, 03/22/2005 - 12:42 — Andy (not verified)

RE: Mac OSX Batch Patch

I said OSS software, whoops! That's a bit like the department of redundancy department.

Tue, 03/22/2005 - 14:05 — atrox (not verified)

RE: Mac OSX Batch Patch

Good points Andy. I am actually surprised how much stuff OS X has. For example I was not aware "SquirrelMail" was in there as noted in this article, hell thats something I have hacked on myself over the years (bound to have flaws eh).

Tue, 03/22/2005 - 14:13 — atrox (not verified)

RE: Mac OSX Batch Patch

One other thing I think is worth noting here, one of my daugthers (3 year old) installed this big patch last night (at least I think it was this patch, I havent even looked at what its called, rev numbers, etc, it was A patch, and it was last night), on accident, and it all worked just fine ;).

She went to fire up a game she uses (I originally got the macs for the kids, the simple interface, one button mouse, not needing to reboot every third keystroke, and so on, works great for them) and somehow (not sure how, dont have the auto check enabled, maybe she rebooted it and it asked at startup, sometimes she presses the button too long when trying to wake it up) the dialog for software update came up, she knows "accept" and "cancel" (she learned these terms, before she can really read, she just recognizes them, from printing stuff at Noggin and Nick Jr and PBS).

Anyway it started installing and I explained to her she had to wait for it to "think". It took a while, the hard drive "optimization" being the slowest part, but it worked and then she was on to play her game.

Tue, 03/22/2005 - 16:44 — cooper (not verified)

RE: Mac OSX Batch Patch

she knows "accept" and "cancel" (she learned these terms, before she can really read, she just recognizes them, from printing stuff at Noggin and Nick Jr and PBS).

Brave New World man.. :D

Tue, 03/22/2005 - 16:48 — cooper (not verified)

RE: Mac OSX Batch Patch

Apple ships a LOT of open source software with OS X, including Samba, Apache, OpenLDAP, and a lot of other stuff. These are large apps and vulnerabilities are inevitably found from time to time.

However, Apple does the responsible thing by not only providing timely updates when bugs are fixed, but by exposing more people to the software and therefore increasing the chances that problems are identified and fixed.

Yeah, I have had this arguement with some people several times. Apple is now, basically, in the Distro business. Yeah, they have their software and it is really great, but there is a lot of open source stuff on the OSX distro too.

This is where that whole Gartner Group bullshit about security comes in: Comparing "Windows" with "Red Hat Linux" and now "Mac OS X" in "critical security report" counts is disingenous. Red Hat Linux comes with 12 email clients. Should we compare any security problem win any of the 12 to 1 flaw in Outlook Express? Mac OS X -- desktop mind you -- comes with PHP, Tomcat, SquirrelMail, Jakarta DAV and on and on. Most of this is not installed by default, but it is there. Does that mean any SquirrelMail bug should light up as a security risk? I would say no, and I am pretty sure Windows XP doesn't come with a WebMail server.

Tue, 03/22/2005 - 18:22 — atrox (not verified)

RE: Mac OSX Batch Patch

Windows XP doesn't come with a WebMail server.. Like hell it doesnt, this feature and many others much like it will allow you to install your own webmail server, and really whatever else you want.

And this is an old article but I think the points are still valid. The frequency and severity are not even close EVEN WHEN Linux/OS-X ships with 4-5 alternatives per app.

Tue, 03/22/2005 - 19:23 — Andy (not verified)

RE: Mac OSX Batch Patch

Ha! So when a hacker breaks into the corporate exchange server and posts sensitive business emails online, I guess that is "webmail" in a sense! Good point atrox.

Tue, 03/22/2005 - 21:05 — atrox (not verified)

RE: Mac OSX Batch Patch

exactly, we are all just looking at it backwards, its a feature.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.