Slashdot Log In
Apple Releases 31 Security Fixes
Posted by
kdawson
on Thu Nov 30, 2006 10:40 AM
from the more-secure-than-you dept.
from the more-secure-than-you dept.
Agram writes, "This week Apple has released fixes for 31 vulnerabilities in its OS, although reportedly a number of known flaws remain un-addressed (according to the instigator of the Month of Kernel Bugs, 'Apple hasn't fixed any of the bugs published during [MoKB], except for the AirPort issue'). Earlier this year, in a move reminiscent of Microsoft's past patching faux pas, Apple released a 'fix' the installation of which broke features unrelated to the targeted flaw. With the growing number of low-level flaws, one has to wonder if Apple's 'more secure' argument still stands. Earlier this month, Microsoft released 6 fixes. Linux does not seem to fare much better. Despite all of these fixes, exploits remain in the wild for each platform. Perhaps, security-wise, the OS choice really boils down to a 'pick-your-poison X user-base' equation?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
If you are depending soley on your choice of OS (Score:4, Insightful)
1. Run a firewall and only open what you need to be opened
2. Most importantly: DONT CLICK ON STUPID SHIT! Don't run seedy programs etc. It's amazed how many Windows users get infected like that
Those obviously won't protect against 100% of threats, but very few things in life are guarenteed.
Re:If you are depending soley on your choice of OS (Score:5, Insightful)
They shouldn't have to listen; the system should be designed for security from the ground up.
Relying on user education is #5 on the Six Dumbest Ideas in Computer Security [ranum.com].Parent
Re:If you are depending soley on your choice of OS (Score:5, Insightful)
Almost no regular user is thinking about the security implications of his or her computer use. Therefore, the OS designer should do it for them, to prevent damage to other users.
If they are sophisticated enough to think about security at every step, power users can disable or change security features manually.
A computer, to most people, is a tool to write stuff, communicate, and have fun. It's not, in their minds, a tool to promote security. So why not have the machine be as secure as possible automatically?
Parent
Re:If you are depending soley on your choice of OS (Score:4, Interesting)
Do you honestly think people go Hrm, this program is pretty seedy, but I'm going to run it anyway! .
The real problem is people go Oh, I received an electronic fax, that's not a program and people like you just say No you dolt, that was an exe file, gawd how stupid are you!?
This is what I think the real problem is: Suggesting that people accept faulty software and their own failings.
Here's an idea: a big red button on the side of the computer. You hold it in, and executables can be created. Tell people that big red button lets other people change the way their computer works and no matter how the computer instructs them otherwise, to only push and hold that button in when they are unhappy about how their computer works and feel the need to change it.
That's what root is supposed to be for- whether they be called Administrator or sudo doesn't make it any more or less safe. The fact that Non-root can install software is a security weakness. The fact that the user can run as administrator and not know it is a security weakness.
My mother in law has been actively computing since 2002 without any viruses or "computer problems of any kind" simply because she has to call me in order to remount
Parent
Slashdot (Score:5, Insightful)
your readers are all technically literate. Please don't post stories where dumb ideas like "how secure an operating system is = number of potential security holes fixed". That kind of stuff is for pointy haired bosses, not technically literate people.
Thanks!
Please (Score:5, Insightful)
Almost everything relies on some form of user interaction, and yes, these things are still bad, especially ones that take advantage of some shortcoming in the OS. What's laughable about the submission is that it makes it look like it's "bad" that Apple fixed oh-so-many vulnerabilities, and then complains that it's not fixing enough. Apple does fix issues reported to them, period. And yes, we all have stories about this or that outstanding bug or vulnerability that is still open, but Apple has markedly, hugely improved, mostly because of listening to feedback from customers, particularly enterprise customers, in the security arena. It does have a way to go, and whether or not any fix is "fast enough" will always be subjective.
No one sane ever said Mac OS X was invulnerable. It has bugs and vulnerabilities like any OS. Apple responds to them. Someone will always think they're not responding fast enough, or correctly, or what have you, but the fact remains that Mac OS X has been on the market for over 5 years, and there has yet to be any substantial issue that has been exploited on any scale. And no, it's not exclusively because of marketshare.
Re:Please (Score:5, Insightful)
Effectively, for almost all desktop users in any environment, Mac OS X is much more secure, much less attacked, and much safer to use from a malware perspective, for almost all average users, period. Some of the reasons are due to marketshare, some are helped in part by marketshare, some are because of architectural decisions, and some are a mix of multiple reasons. But regardless of what someone "thinks", Mac OS X is still a manifestly safer OS for an "average user", and there is simply no disputing that.
If you want to get people to understand that even Mac OS X has bugs, great. (Duh?) If you simply want to make stupid people no longer stupid, that probably won't work. The average person doesn't care. All the average person knows, when they make the switch for example, is that their Windows box was packed with spyware and adware and then "got slow" and had multitudes of typical Windows problems that typical people have, and they don't have the same problems with their Mac.
Do Macs have problems and bugs and vulnerabilities? Yes. Will anyone win the pissing match of "which one is better" when it's not done for any reason other than to be a pissing match, like this article seems to be doing? No.
Parent
Re:Please (Score:4, Interesting)
Precisely!
What we're seeing is Apple fixing issues that cannot be successfully exploited on 90%+ of the Mac machines in existence. Worms like Code Red or Blaster wouldn't be able to find enough hosts due to the default security setup of OS X. The only folks who would be vulnerable would be the ones who know enough about internet hosting to enable a service.
While there's no guarantee that these users are significantly more educated, they do at least know that they're running a potentially exploitable service. This is in direct opposition to the situations that made Code Red and Blaster possible. Had IIS Personal Server not enabled itself without the knowledge of most users, it's highly likely that Code Red would have failed to spread. (Especially since a security patch had been available in both cases.)
Parent
You know what, you're right! (Score:5, Funny)
Bad, Apple, bad. *thwacks Apple with rolled up newspaper*
Don't break any fixes anymore, you're supposed to be perfect.
pfft. quantity of fixes means nothing (Score:5, Insightful)
These numbers mean nothing at all.
First, it's the number of fixed bugs, not of existing bugs. If product A has 500 holes and fixes 5 of them, and product B has 50 holes and fixes 10 of them - these dumbwit journalists would tell you that product A is more secure.
Two, quantity alone means nothing. If product A has 5 remote root holes and product B has 20 spelling bugs - these dumbwit journalists would tell you that product A is more secure.
The worst thing is that they get paid for producing this kind of misinformation. No, wait - the worst part is that there are lots of people out there who don't know technology and actually believe that crap.
Mac OS X is still more secure, BY FAR. (Score:5, Informative)
No, no, one doesn't.
Number of Windows machines I've had to painstakingly remove highly virulent spyware/adware from: Dozens.
Number of Mac OS X machines I've had to painstakingly remove highly virulent spyware/adware from: ZERO.
This is far more than just anecdotal evidence; this is how things go in the real world. In the real world, 50+% of Windows machines are badly infected by spyware, and 0% of Mac OS X machines.
ZERO.
By far the most prevalent security and stability breaches "in the wild" are not rootkits or remote exploits... they're spyware and viruses, both of which are virtually exclusively Windows issues. You can claim that this is mostly or wholly due to the overwhelming dominance of Windows over all other operating systems (in terms of "market share"), but the fact remains.
Until I start getting calls from blue-haired grandmas to hand-pick bits of Hotbar and Bonzibuddy and porno pop-up daemons out of their Macs, I won't buy the "Macs aren't any more secure than Windows" FUD. And neither should you!
No duh! (Score:4, Interesting)
Perhaps, security-wise, the OS choice really boils down to a 'pick-your-poison X user-base' equation?
Yeah, like, everyone knows that all OSes are, like, equal in all respect. It's not like they were designed differently or anything. It's all just 1s and 2s anyway. Every computer gets cloggged up with worms, viruses, and malware. It's just that there are more Windows users out there, and the Mac users just keep quiet about their virus infestations, so they can keep the Sacret Cult of the Mac going strong. I know plenty of Mac users who have to do clean installs all the time because their machines get so clogged up with worms and viruses. All of these whiners talk like that's not true!
It Never Did (Score:4, Funny)
It never did. First of all, you can't compare security of operating systems, because you can't eliminate bias from your tests. Secondly, Apple's OS is closed source, which you can never trust. Thirdly, much of the OS is written in unsafe languages (particularly C, C++, and, perhaps, Objective C - I don't know if the last is unsafe), and thus, the statistical probability that it will contain security holes is high. Finally, I don't think Mac OS X has been so thouroughly scrutinized by security experts as Windows has, so it's very well possible that Windows is more secure by now, regardless of it's starting position. However, we will never know that, because of the first point.
Re:Attacks Still Low (Score:4, Insightful)
Parent
Re:Attacks Still Low (Score:5, Insightful)
Anyway, as we all know, don't trust statistics because 82.35% of statistics are made up on the spot.
Parent
Exactly (Score:5, Insightful)
On the other hand, if 50% of the people were running OS X, then no exploit could harm more than half the people at any given time. So in the long run, perversely, OS X is beneficial to the security of Windows.
Parent
Re:Attacks Still Low (Score:5, Informative)
Wrong. The attacker can simply use a privilege escalation exploit.
Parent
Re:Attacks Still Low (Score:5, Informative)
If someone is standing on the corner going 'neener neener you can't hit me' someone out of spite regardless of any reward is going to do it. The fact that they've been touting they can't be hacked for several years now and they still haven't been hacked says to me that it's not easy to do/not able to be done as easily as it is on Windows.
Plus a lot of the 'security' problems don't focus on the exploits of IE and simple browsing hijacking your system with crap. That's the largest problem facing most IT departments that I've run across in the last year or two, not the OS itself being hacked but something stupid the browser does destroying the system.
Parent
Re:Attacks Still Low (Score:5, Insightful)
Your argument seems to be that OS X runs on loads of servers, which makes it a great target.. First off it doesn't run on loads of servers, it has no presence in the server market. Second the vulnerabilities are mostly all in WiFi drivers, PPPoE code, and Safari. Why would hackers going after servers be looking in client code?
Also you can only apply the fixes to 10.3 and 10.4. Never mind <10.3 users, they can pay $99 for security, and never mind if they have a machine which won't run 10.3, they can buy a new Mac. This is like MS charging for SP1.
If MS came out with a massive load of critical security fixes like this, which had all been around for ages and in use by hackers, they would be quite rightly ridiculed. When Apple comes out with this disgrace
I wish I was exaggerating but people really are posting these; it's bizarre the double standards some people on slashdot have.. We should at least like and dislike Apple and Microsoft for the right reasons, there are many reasons to prefer Apple but security just isn't one of them.
Parent
Re:Attacks Still Low (Score:5, Insightful)
Yes, because buffer overflows are so much harder to exploit on non-Windows OSes, and it's so much harder to get someone to type "sudo make install" than to get them to do the equivalent on Windows.
Parent
Re:Attacks Still Low (Score:4, Informative)
99% of all windows users run as admin. 100% of all windows server administrators log in with a admin level account and do lots of things as admin they they should not.
99% of the things malware wants to do, do not require elevated privileges.
NO APP NEEDS WRITE ACCESS TO THE C:/WINDOWS directory... NONE! yet the microsoft morons designed it that way because of the stupid registry.
Broken application that require write access to Windows system areas are 100% the fault of the app developer. It's got *nothing* to do with Microsoft.
No developer has had an excuse for releasing software that writes to places like C:\Windows for ca. 7 - 8 years.
Let's ignore the fact that most services under Unix lately do not run at the system level but under a protected user that does not have ADMIN access... but hey you were hoping that nobody noticed that.
Like modern Windows services do, you mean ?
Windows web server, buffer overflow = admin access. Linux web server, buffer overflow = user acces. Big different there. granted if you are silly and let apache user read the shadow passwords file your fault for not setting up security right.
IIS runs as its own user. A buffer overflow only nets you the privilege level of that user.
Parent
Why Windows security is terrible and OSX is better (Score:4, Interesting)
I. ActiveX. ActiveX is DESIGNED to give a web server full control over your machine. With Flash or Java, even if they're enabled a website can only do stuff if they also exploit a - very rare - flaw in your Virtual Machine. In ActiveX, if you let that control run it can basically do anything. They have some checks to try to block the probably-worst applets, but in the end it runs the code unprotected. Until ActiveX is limited to a VM, it should be totally disabled.
I'd personally guess that this alone accounts for more regular attacks than everything-else-put-together. Don't use ActiveX. And if you're not using ActiveX, there's little reason to use IE...
II. Administrator use is chronic. Basically nobody runs OSX in root or sudo-d mode. LOTS of people run Windows routinely in Administrator mode, for a few main reasons: 1) Lots of software only runs that way, and switching is a pain. NO user app should need to be root to run. 2) LOTS of software is very hard to install so a nonAdmin can use it properly, for starters because it only works on the account it was installed into.
I will completely admit that if all the ISVs behaved perfectly 1 & 2 wouldn't be a problem - but it is VERY plausible for Microsoft to exert enough control to make this better for the vast majority of users. Also, I don't believe all these ISVs do it just to be stupid - my guess is that the structure of Windows makes it MUCH easier to do it that way.
3) Lots of software that shouldn't even need admin privs to install does for no good reason. (I presume because of the way DLLs and the registry work they need to modify system folders even if they're only going to run as a local user - but that's definitely a Windows problem that it's structured that way.) And once you give those pieces of software admin privs, they can do anything - like installing themself as System so you can't kill them even WITH admin privs. All software should be installable with the MINIMUM possible privs. (Obviously system software or a virus checker needs admin privs.)
There are plenty of smaller reasons to be unhappy with Windows security, and I'm not trying to say I love their track record. I didn't address at all the fact that it comes out of the box extremely remote exploitable, (average of ~20 minutes for an unpatched box to be exploited on the internet - and several hours to download the patches!) But those are problems other OSes at least sometimes have and you can make reasonable comparisons. Until the two above are fixed, you shouldn't even COMPARE Windows desktop* security to OS X or Linux.
*Note that I said desktop. While there are some problems, neither of the above super-problems is a server problems. In fact, if you have to choose a server OS, you should probably choose based on what your admin is experienced in - better to have a well administered box than ANY badly admined box.
Parent
Re:Attacks Still Low (Score:4, Insightful)
Parent
As well they should. (Score:4, Insightful)
Therefore, they don't have people saying 'fixes for 31 vulnerabilities in its OS'
Parent
Re:I predict... (Score:5, Funny)
Parent