Slashdot Log In
Call for Apple Security 'Czar'
Posted by
Zonk
on Thu Mar 09, 2006 12:28 PM
from the i-imagine-a-guy-with-a-stogie dept.
from the i-imagine-a-guy-with-a-stogie dept.
conq writes "The second security non-incident to hit the Mac platform in as many weeks has been debunked. People are talking a lot about security on the Mac these days, and the result is that a great deal of FUD is being spread around. BusinessWeek's latest Byte of The Apple column suggests that its time for Apple to appoint a security Czar to get out ahead of the FUD before it spreads much more." From the article: "Creating a CSO position may be viewed by some as an admission of weakness. Still, I say it would be a good way for Apple to inoculate itself against the perception -- warranted or not -- that Mac security may be eroding, and get ahead of the curve for any troubles that may be inevitable. That may not be the case, but in matters related to product marketing, it's the public perception, not the reality that really matters. And once you've lost a user's confidence, it's hard to get it back. Just ask Microsoft."
Related Stories
[+]
Apple: U of Wisconsin's Mac OS X Security Challenge 401 comments
digitalsurgeon writes "The University of Wisconsin [ed: Go Badgers] has launched a Mac OS X Security challenge, in response to a 'woefully misleading ZDnet article'. From the site: 'The challenge is as follows: simply alter the web page on this machine, test.doit.wisc.edu. The machine is a Mac mini (PowerPC) running Mac OS X 10.4.5 with Security Update 2006-001, has two local accounts, and has ssh and http open - a lot more than most Mac OS X machines will ever have open.' Are you up to the task? Can you prove ZDNet wrong, or can you show that Mac OS X can really be hacked in less then 30 minutes? More information about the challenge is at http://test.doit.wisc.edu/ The challenge ends Fri 10 March 2006 10:00 AM CST." Update: 03/07 14:32 GMT by Z : Commentary on the contest and original claim is available at VNUNet
[+]
Apple: Mac OS X Security Competition Ends in 30 Minutes 388 comments
ninja_assault_kitten writes "ZDnet is running an article on how a Swedish Mac OS X enthusiast held a competition to prove how good security was on his new fully patched Mac Mini was. Unfortunately, 30 minutes after the competition began, a hacker known as 'gwerdna' had broken in and defaced the website, thus winning the contest.
According to gwerdna, 'Mac OS X is easy pickings for bug finders. That said, it doesn't have the market share to really interest most serious bug finders.'." It's also worth noting a piece that says all the security news is much ado about nothing, in practical terms. The security contest also allowed people to have local access via SSH, so that had a lot to do with the crack.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Chief Security Officer? (Score:5, Funny)
Re:Chief Security Officer? (Score:5, Funny)
Parent
Re:Chief Security Officer? (Score:5, Funny)
Parent
Re:Chief Security Officer? (Score:3, Funny)
He he he... The other day I was talking to a young woman who'd just got a Mac and set her download directory to "Applications" so that anything she downloads is automatically installed. She said it made it easier to use the computer.
User ignorance is still the biggest threat.
Sounds like a PR or Legal issue, not a security. (Score:5, Insightful)
Sounds to me they need to hire someone with appropiate skills in either their PR or Legal departments.
Two non-security incidents in a month almost certainly mean that they're the victim of a FUD campaign.
The right way to answer that is not to validate the fud, but
... communicate the truth - which is a function of PR, and ... make sure no-one's illegally slandering their trademark -which is a function of legal.
The latter is far more dangerous to Apple than the hypothetical security non-issues a CSO could address.Parent
Apple's recent security update patched 20 holes (Score:5, Insightful)
Apple needs to treat their holes as real problems, not just as a PR problem. And they're actually doing just that by releasing fixes and not spouting PR. Spouting PR would only make them a bigger target for hackers, just as appointing a "Security Czar" would. The latter would also undermine confidence of the general public ("If Mac is so secure, why do they need a 'Security Czar'?")
Parent
Would it be like the Maytag repair man? (Score:3, Funny)
Worf: "This job gives me an intense feeling of Gardachk! I think I'll kill one of the developers at our next hackeysack battle."
Well, then, that would be poetic justice (Score:3, Informative)
Re:Well, then, that would be poetic justice (Score:3, Informative)
The importance of user confidence (Score:5, Informative)
And yet, they still seem to be doing OK.
I'm concerned (Score:5, Funny)
Re:I'm concerned (Score:4, Funny)
Parent
Nominate Slashdot as the Apple CSO (Score:3, Funny)
Public confidence? (Score:5, Insightful)
Huh? Most of the "public" I know doesn't have any lack of confidence in OS X and hasn't even heard all the latest "scares" of OS X's security. In fact, I'd venture to guess that most of the "public" knows nothing about OS X being more secure than Windows (as it isn't really an advertised fact) and think that viruses/trojans/worms, etc, are just a part of computing.
Re:Public confidence? (Score:5, Insightful)
Parent
Re:Public confidence? (Score:3, Insightful)
Re:Public confidence? (Score:4, Insightful)
What they seemed to just say, in a nutshell:
"Apple should create a executive position to serve as a figurehead in charge of security. Doing so will create the perception that Apple's shit is not as secure as it used to be, but is needed to maintain the perception that it's still as secure as it used to be."
So, if they don't hire somebody like that, confidence in their security will erode.
But if they do hire somebody like that, confidence in their security will erode.
Here's a thought: Why not just keep putting out an OS which is vastly more secure than Windows? As a customer, I've been pretty happy with that strategy so far.
Parent
Re:Public confidence? (Score:5, Funny)
What is OS X? Should it effect me?
Parent
Just ask Microsoft???? (Score:3, Interesting)
Re:Just ask Microsoft???? (Score:5, Insightful)
Or are you trying to imply that MS is now secure?
Parent
Not a bad idea, (Score:5, Interesting)
If nothing else, it'll start an effective and accurate comparison of the state of security between OSX and Winodws, a feature of OSX that Apple has not stressed as much in their ads as they should.
They recently hired on the FreeBSD CSO (Score:5, Interesting)
It's just how you handle the marketing (Score:5, Funny)
Just ask Microsoft (Score:5, Insightful)
Re:Just ask Microsoft (Score:3, Insightful)
Biased poster (Score:3, Insightful)
Re:Biased poster (Score:4, Informative)
Parent
What is it with the 'Czar' title? (Score:5, Funny)
What about other titles for potentates?
'Chief' 'King' 'Master' 'Commander' 'Lord'
Re:What is it with the 'Czar' title? (Score:4, Funny)
Parent
That's not security, that's marketing (Score:3, Interesting)
Perception? (Score:4, Insightful)
OK, then everybody else can stick to the illusion of security with Windows despite reality, and I'll be happy in the reality of my secure OS X machines.
OS X is not 100% secure, but out of the box, its about as secure as any system can be that has a network adaptor in it. Try this on your average box:
netstat -an |grep -i listen
tcp4 0 0 127.0.0.1.631 NOT JUNK LISTEN
tcp4 0 0 127.0.0.1.1033 NOT JUNK LISTEN
Go ahead, break into 127.0.0.1. I dare you.
Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK Please use fewer junk characters OK
Re:Perception? (Score:4, Funny)
I will take that challenge using all of the tools that I have. You'll be sorry when I break into your...
CONNECTION DROPPED
Parent
He's not calling for a CSO (Score:4, Insightful)
As stated in the article, putting security in the hands of an individual is counter to Apple's philosophy of having security be a priority for everyone.
I personally think Apple's better off letting third parties defend the FUD; they seem to be doing a swell job with the last two instances. By now, no one in the know doesn't know that the past two were FUD.
Those who aren't in the know didn't even hear about it.
IMO, we should never ASK a company to add in another layer of publicity and marketing. That's asking to be mislead by slanted information, be it MS, Apple, Google, IBM, or whomever.
MS's problem is the reality, not the perception (Score:5, Insightful)
Wow, talk about an unassailable position (Score:5, Informative)
While I agree that every company that sells operating systems should take security seriously, and that having somebody responsible is practically always a prerequisite to being "serious", it's really too bad that people don't seem to absorb a bit more reasoning skill by the time they get out of school.
Sure, Apple's relatively superior security record "may" erode as they start to gain market share and visibility to the black hats. In fact I'd say there's not much room for it to go other than the direction of erosion. However, we don't have any evidence that that anything like a disaster is about to happen. You can posit that terrible things may happen, and nobody can prove you wrong. You could posit that Steve Jobs is the vanguard of an alien mind-control invasion, and nobody could prove that wrong either. These are the sort of things that can only be proved in an affirmative sense: some researcher finds a vulnerabilityin the Mac OS authentication system, or tentacles suddenly springing from Steve's head.
Right now I'd say the biggest problem are the Mac user base's overconfidence. While back in the day, Mac users did struggle quite a bit with viruses, which were oh-so-much more interesting to write for the more advanced Mac platform than for DOS, recently, they're getting a bit cocky. They're not as used to the security patch grind as the people running Windows.
Security Czar role will fit in well in Apple (Score:5, Funny)
Every week, they hold a cross group meeting with the Sultan of Marketing, the Sales Duchess, and the Distribution Führer. They all are answerable to the Grand Baron of Charging More for Stuff because it is Shiny (he prefers people call him Tim, for brevity).
The wrong perspective. (Score:4, Insightful)
Of course, you could argue that it be completely locked down with no keyboard or connection to the Internet, etc... but this would be a completely moot point.
With this in mind lets consider the overall design of the security subsystem. Apple Mac OS X is much better DESIGNED than Windows in its current state. I won't delve into detail about protected memory, access controls, permissions, default configurations, open ports, etc... but out of the box Mac OS X is more "security minded" that Microsoft's Windows.
Now, keep in mind that things ARE changing. No matter how much heat Microsoft takes they are still managing to improve the quality of their product. Windows XP is a far superior product (security wise) than was 98 or ME... and it appears that the next version of Windows is even more security conscious.
In conclusion, people should not "judge" an OS based on the potential for it to have problems... they all will. Mac OS X has enjoyed a reputation for safety that is based on many factors (including having a small market share). However, the bottom line is that it is very "security aware" and has the potential for you to lock it down even more... and this is the right perspective to look at.
Matt Wong
http://www.themindofmatthew.com [themindofmatthew.com]
We need to defend against scare tactics (Score:5, Funny)
Pictures of Jane Fonda on her iMac will be forthcoming.
Just ask Microsoft (Score:4, Insightful)
Or an ex-customer like me [msversus.org].
Perception of course matters to many people. But hopefully reality matters to many more people.
Apple, please... just please... do everything you can to keep your customers' computers safe. That's all I ask. Appoint a CSO or don't, I don't care.
Uhh, personally (Score:5, Informative)
Analysts and bloggers crowing endlessly about "Apple/Linux/Firefox/whatever don't have better security, they're just smaller" gets attention for a little while, but just let time pass. Eventually people realize they're being cried wolf to. After a few years people will have forgotten the bloggers, but will remember whatever the next major Windows worm incident that gets on the nightly news turns out to be.
Unfortunately, this only works if you really do have better security. And while this article is just talking about media events like the mac mini challenge as if they're all that matters, Apple has had real security problems of late. Whether or not the mac mini challenge was important for real security there are apparently some os x privilidge escalation exploits floating around, and there was that incredibly embarrassing bug [slashdot.org] awhile back where Safari could be tricked into launching a shell script as if it were a
Taking this seriously does not mean-- as the article suggests-- appointing someone to talk to the press about how great Apple's security is. It means actually fixing the problems, and making some effort to see what other problems might be out there. PR is temporary, and if you do too much of it it can backfire (as people start to assume anything positive they read about your platform is just a result of PR). Real security problems like the filetype bug I mention can impact your reputation for years, no matter how much you try to spin them.
Speaking of which, there was a new security update on Apple Software Update this week. Anyone know what exactly that covered? Is the jpg/sh MIME or whatever problem fixed yet?
personally I'd like to see..... (Score:3, Interesting)
That said i do want to migrate...
Apple should put up a honeypot. (Score:4, Insightful)
Oh please ... (Score:3)
Business Weak (Score:3, Insightful)
Who do they back on National Security issues? How do their favorite National Security spokesmodels rate?
Might not be in Apple's gameplan. (Score:4, Interesting)
Re:I Don't See What all the Fuss is About... (Score:3, Insightful)
What about U of Wisconsin? (Score:4, Insightful)
Instead of bleating for help howzabout looking up your question for yourself?
"university wisconsin mac challenge" are some good key words.
If you think the topic is of general interest then post back your results.
Parent
Re:U of Wisconsin? (Score:3, Informative)
Re:Debunked? (Score:4, Insightful)
The second challenge debunks nothing. One challenge gave shell access, the other didn't.
The second challenge did not debunk the first challenge, it debunked the poorly written and misleading articles about the first challenge by replicating the situation the articles depicted the first challenge as being.
Only one of those actually ended up demonstrating a result.
You can't logically prove a negative. What amount of time is sufficient to show something won't ever happen?
Not to mention that the second challenge was pulled early...
But not because it was hacked. It was pulled for reasons outside the control of the person running it and certainly stood up to more than 30 minutes of attacks, thus the sensationalist articles were debunked.
Remote "shell" exploit? Why would it be a shell exploit, necessarily?
I certainly think it is likely there are remote exploits for OS X out there. There are certainly a lot of white hats and other crackers that would love the publicity this could have generated for them. There are also a lot of people that would like to quiet down the small number of uninformed, overzealous fans of OS X that at times can be quite annoying. What this has show is that remote exploits are not common enough that people can demonstrate one to show boat and they are not easy enough to find that they can be found and demonstrated by the white hats in that short a period.
Basically this confirmed what pretty much every security person already has plenty of evidence to support. The point you are missing is that while the original test was somewhat useful, the very poor articles about the original test spread misinformation and FUD that did more damage than the original test did good. It is those articles that this challenge was designed to rebuke and it has done that much at least.
Parent
Re:non-incident? (Score:3, Informative)
Could someone please enlighten me as to why it is possible for a least privileged user account to gain root without the consent of the owner to be classed as a "non-incident"?
It isn't a non-incident, but neither is it a remote exploit. Apple fixes 5-10 local escalations a month in their security updates, many of which are found by outside security people. Thus exposing one more is not exactly news. This is the same for Linux or most any other OS not designed to be ultra-secure. (Except Windows which has