Mac OS X security myth exposed

[Nomad559]

Mac OS X security myth exposed

-Snip-

Windows is more secure than you think, and Mac OS X is worse than you ever imagined. That is according to statistics published for the first time this week by Danish security firm Secunia.

The stats, based on a database of security advisories for more than 3,500 products during 2003 and 2004 sheds light on the real security of enterprise applications and operating systems, according to the firm. Each product is broken down into pie charts demonstrating how many, what type and how significant security holes have been in each.

One thing the hard figures have shown is that OS X's reputation as a relatively secure operating system is unwarranted, Secunia said. This year and last year Secunia tallied 36 advisories on security issues with the software, many of them allowing attackers to remotely take over the system -- comparable to figures on operating systems such as Windows XP Professional and Red Hat Enterprise Server.

"Secunia is now displaying security statistics that will open many eyes, and for some it might be very disturbing news," said Secunia chief executive Niels Henrik Rasmussen. "The myth that Mac OS X is secure, for example, has been exposed."

[Rabrrrrrr]

1. For some reason, it just doesn't surprise me

those hacks at Apple shouldn't have been allowed to touch unix, let alone try to make an Apple operating system using it. They should have stuck to their own housebrand.

[emulatorloo]

3. You might want to do some research on Avie Tevanian and NextStep

Highly respected guy, highly respected OS. Both the basis of OS X.

[cheezus]

15. that is the best slashdot troll I've ever seen

[ChavezSpeakstheTruth]

17. I used to like you

:(

[Liberal Classic]

2. Says PC World, of course.

Matthew Broersma writes for Techworld:

http://techworld.com/security/news/index.cfm?NewsID=1798

Secunia:

http://secunia.com/

Now, I don't think that OSX is perfect, not by any stretch of the imagination, but I have to wonder about this article.

Lots of weasel words:

Mac OS X doesn't stand out as particularly more secure than the competition, according to Secunia. Of the 36 advisories issued in 2003-2004, 61 percent could be exploited across the Internet and 32 percent enabled attackers to take over the system. The proportion of critical bugs was also comparable with other software: 33 percent of the OS X vulnerabilities were "highly" or "extremely" critical by Secunia's reckoning, compared with 30 percent for XP Professional and 27 percent for SLES 8 and just 12 percent for Advanced Server 3. OS X had the highest proportion of "extremely critical" bugs at 19 percent.

What criteria to they base 'highly' or 'critical' for example?

Several of the remove exploits for OSX have been open source packages, such as ssh or apache, which are common across Unix systems.

Unanswered is how many of these are already patched, versus how many remain unpatched. Also unanswered is how many are exploits that are in the wild versus those which are not.

Lastly, if I have to clear off another XP machine with all those darn popup malware trojan programs I'm going to puke.

[burrowowl]

5. I have a Mac, no problems,

but end up cleaning up sister's and friends' WinDoze machines?
How come!?

[gold_bug]

6. that's the funny thing,

I'm not aware of a single case of a Mac OS X system being infected with a virus, trojan, spyware, adware, etc. But I'm supposed to believe that Windows, which is rife with that stuff, is somehow more secure. :eyes:

[Liberal Classic]

8. During System 6 - 7 days Mac viruses were pretty bad

Lots of DOS viruses back then, as well.

I think people have forgotten how to practice safe computing.

It doesn't help that these days everything is so automatic that something can install itself in the blink of an eye without your knowledge.

[MadHound]

13. Then you must have been downloading some really strange stuff

First off, Mac OS 6 and 7 weren't DOS based, that was the Windoze crap that was DOS based.

Secondly, I ran did trouble shooting for six different Macs during the time period those OSs were out, and ran absolutely NO virus protection, and never, ever ran into a virus for Macs in the ten years I was runnng those systems. I know five other IT people, some of whom were in charge of large Mac systems(professional companies, college campuses, etc.) who, while they did run virus software, never had a virus pop up.

I'm really suspect of this piece. Written by a PC head, using very parsed language, I suspect that this is simply another hit piece trying to drag down Macs. I've been running OS X for over a year now and have yet to run into a virus. Nor have I had any problems with stability, crashes or spyware. Yet on the Wintel box I've got at work, I've had three different viruses, had my computer go completely balls up a couple of times(requiring a complete disc reformat and reload with software) and so many little buggy things going on, I'm not even sure what works and what doesn't. And this is on a network machine that supposedly has the best firewall and security in the business.

Look, you've got two choices, you can either be a sheep and work on a popular, cheap machine that you have to continously tweak and fiddle with, or you can actually work on a machine that has ease of use, does what it is supposed to, and doesn't break down if you look at it wrong. I'll take that Mac anyday, despite whatever POS biased hitpiece comes out. I trust my own experiences much more that the mouthings of a corporate hack with an agenda.

[Liberal Classic]

19. Er, maybe I wasn't being clear

But during the late 80s early 90s both Macs and PCs had problems with viruses, primarly from downloaded files from BBS's and the sharing floppies. I did not mean to imply that a System 6 and 7 were DOS based (wtf?) or that a Mac could catch a DOS virus or vice versa. Both had essentially the same problems though, no concepts of user privilege, no memory protection, and only rudimentary file protection. As a result, both Macs and PCs had problems with viruses which would attatch themselves to your program and data files, and copy themselves to harddisks and floppies. My significant other worked in the university mac laboratory and yes, there were many Macintosh viruses at the time that you could catch. There were never quite as many Mac viruses as there were for the PC, but just because you never got one doesn't mean they didn't exist. I recall plenty of Hypercard file infections, and when Word 6 was released for Mac macro viruses, too.

[burrowowl]

21. There were several Hypercard viruses and Word macros back then

One of the worst problems in the early days before large hard disks. People would load a program and the system file that came with. One Mac Plus got sick: I found 6 system files on it. The poor little Mac got confused.

[Liberal Classic]

7. Cleaned up my friend's son's Dell laptop last night

Now, in all fairness to Windows, he had been running Kazaa and downloading lots of files. Peer to peer sharing is notorious for being filled with trojans and spyware, and I don't think he was being careful.

Same thing with the last one I cleaned up. She had Zone Alarm, Norton's Antivirus, and Lavasoft AdAware all running. She did everything right, but her husband downloaded some stuff from a free game site and pretty soon her machine was unusable. It didn't help that whenever Zone Alarm asked "Do you want to allow program EasyMoneyClicker access to the Internet" he chose "yes" without thinking about it. She did everything right, but her husband didn't.

When I get computers for my family, and all they want is to browse the web and get email I get them a Mac. They are trouble free.

[emulatorloo]

4. Mark my words, this will be debunked in the PC Press in a day or so. . .

as all these anti-mac OS X articles usually are.

[burythehatchet]

12. Sounds like a "fair and balanced" news report

I'm goin right out and trashing my G4 powerbook. Three years, not one problem...ever. The only application that causes problems, IE. But I love the message when that happens. "Internet Explorer has become unstable and is being shut down, no other applications are affected". I crack up when I see that. Hasn't happened since I switched to Safari.

[Zech Marquis]

14. same here

if Safari has a little hiccup, I just force quit, and crank it back up. No problems for me at all!

[DBtv]

9. Bullshit.

OS X is so vastly superior to wintel crap it's absurd. Never had a virus, never will.

[leftistagitator]

10. Do you download executables off of p2p?

That's the only place I ever come across viruses, to be honest. I've been using PC's for the past 20 years, and have been infected by precisely 1 virus, a stealth b virus I got from an infected disk about 12 years ago. Took about half an hour to undo the minimal damage it caused. Users are mostly responsible for getting viruses, they get the open cable connection and don't buy a router, they run random files they get from untrustworthy sources without checking them first, and they don't keep their computers up to date. Of course, MS was stupid to add executable code to documents and email, and MS products are targeted by worm writers more. But I guess that's to be expected, everyone's software is compatible with windows, why should viruses be any different?

[DBtv]

11. I have downloaded literally hundreds of p2p files.

Using a variety of Mac OS's. Never a problem.

[leftistagitator]

16. That's cool as long as you check them

The only OS's which are safe from you running a virus on your own machine are the one's that limit user commands with a need for root access to install anything, or at least something which changes the OS. MacOSX does this, I'm fairly sure, but I don't think previous versions of MacOS do. Just a friendly warning, there are Mac virus's out there, although they are far less common. WinNT and it's derivatives 2000 and XP have tools to allow you to setup file permissions to achieve a similar effect, but it's far more difficult and come's by default turned off. It's such a pain in the butt to use a windows box in non-admin mode most simply turn file permissions off or stay in admin, defeating the purpose of even having it. But then, that's what Longhorn's supposed to be all about.

[TrogL]

18. Define "critical"

It goes on to mention that Solaris 9 had 70 "critical" security issues. I read them. They were nit-picking stuff like memory leaks, not the gaping holes that Microsoft ignores for weeks on end.

[Liberal Classic]

20. The other thing I noticed was that

All OS X vunderabilities were lumped into one category, but there were separate categories for Windows XP Home, XP Pro, 2000, 2000AS, ME, 98, etc. Might be a better comparison if all XP versions were grouped, and 98 and ME were grouped. This might compare apples to apples a bit better, anyhow. I'm sure some vunderabilities are common across XP platforms, or across 2000 and 2000AS for example.