First, let me begin by saying that I can produce the following list for any operating system, including Windows and Linux. I am not a Windows or Linux bigot, nor am I a MAC hater.
The point to the list below, of problems that Apple has had in the past six months, is that NO OPERATING SYSTEM is secure. Even with extreme attention and configuration, the best of us (on our personal and corporate computers) can easily get infected.
My problem is that there are those who like to claim that one OS is more secure than another. The truth of the matter is that some OS are less of a target than others. As an OS becomes more secure, virus writers have to become more intelligent about how to infect the OS, steal OS code to learn from it, or move to less appealing targets.
No manufacturer deliberately writes code that is not secure. Nor is any open source codebase secure. Their shortcoming is trying to provide the feature-rich environment that consumers and corporations want, often pushing schedules to beat their competition to market.
There are simply bad people out there, whose enjoyment, rather than hanging out with friends or finding a girlfriend, or browsing on AK, get their pleasure out of creating problems for other people. In a world where our judicial and law enforcement systems were more in tune with technology, we would not have the problem as much as we do. For example, I break into your house while you are not at home, and destroy or steal your belongings. That is a crime that is understood. I throw a rock into a store window. That is a crime that is understood. If the perpetrator of the crime said “I was only trying to show 3M and GE that their Lexan glass product was not secure”, the judge would not give a rat’s ass, and the perpetrator would be convicted. The same analogy can be made when a lock is picked, but you do not see anyone beating on Schlage when their locks are picked, do you? However, when the perpetrator gets caught for a computer crime, well, they were just trying to show Microsoft or Apple that their OS was not secure. And that is if they get caught. Many law enforcement agencies do not pursue this type of crime, and some do not even consider it a crime.
Again, I am not beating on Apple here, but to imply that their OS is any more secure than another’s, is the wrong answer.
Also, the practice of recommending one browser over another is not the solution. While I can produce dozens of issues with IE, and with Mozilla/Firefox, I won’t. What I will produce is the following from the SANS:
--Microsoft Investigating Possible Remote Code Execution Flaw in IE
(29 August 2005)
Microsoft is investigating a report of a remote code execution
vulnerability in Internet Explorer. The flaw affects IE6 on machines
running Windows XP SP2 with all current security patches. The
researcher who reported the flaw to Microsoft recommends using an
alternative browser.
http://news.com.com/2102-1002_3-5844431.html?tag=st.util.print
[
Editor's Note (Schultz): According to Secunia statistics (see
http://secunia.com), the number of vulnerabilities in IE6 has declined
significantly over the last half year or so. Furthermore, many competing
browsers have also had their share of vulnerabilities lately. I am not
sure, therefore, that recommending using an alternative browser is
appropriate any more.]
And, what about all of the phishing, viruses, scams, etc that arrive in email? Too many to even address. But, when a perpetrator sends out millions of messages looking for credit card numbers, or wants you to click on their link that will screw up your computer, they do not know, or care, if you have a MAC, Windows, or Linux OS. And, just because you are not getting any spam right now, just wait a bit. Someone is waiting, and searching, to harvest email addresses everyday.
And, this is the part that will really anger a lot of people: there are a lot of really stupid users out there, that are looking for a “get rich quick” message, or some Viagra message, or some weight-loss message, or even a message from
DFUYEGENDER@YOURFRIENDSATAK.COM.CC “re: Hello” because they are so curious about opening the message to see what it is, or what attachment might have been sent to them. Think of your email account as the door to your computer, like the door to your house. If you would not let a stranger in your house uninvited, why open their email on your PC?
And, I have first hand experience with a group of representatives from some of the major anti-virus product providers. Guess what? Some of them know these virus writers personally and are friends with them. Do you think there might be any collusion between the anti-virus provider and the virus writer? No, of course not. That would be illegal, wouldn’t it? And all of these companies can trust their employees, right?
And, although one can understand problems with viruses “In the wild”, does anyone ever see the problems in some of the code of the anti-virus provider? There are code problems that they have, but it is rarely brought to our attention.
And, what about those who insist upon running old, un-patched versions of the OS? "I do not want to make Bill Gates any richer", they say. Fine, you are only hurting yourself. Not that upgrading and patching is the answer, but it does help. Question: Do you refuse to purchase a new toothbrush because you do not want Proctor and Gamble to get any revenue from you? Let's be serious here. Why hurt yourself. While one refuses to spend money on a current, legitimate copy of the OS, they will spend countless hours fixing the damage to their PC caused by viruses that could have been prevented.
I could go on and on regarding this particular subject. I will also take the arrogant attitude that I am correct, and cannot be challenged on any of this. If one wants to understand the issues regarding all aspects of current threats to the on-line environment, just subscribe to the SANS NewsBites at
www.SANS.ORG. It is a bi-weekly newsletter of current issues.
By the way, one cannot even rely on the legitimacy of TLDs (Top Level Domains), like those with a .ORG on them. Recall the recent Katrina scams? But, we have opened the registration of domains to anyone now. I cannot find the message, but somewhere around 25% of registered domains have invalid contact information, and some have contact names like “SuperMAN”. One would imagine that that type of crap should be easily caught and corrected.
In closing, it is a dangerous world out there, with bad people who will steal your info, and damage your computer, just for fun. They will steal from charities that help those that are the most in need, without any shame or sense of moral behavior. These people could easily be your next door neighbor. Turn on the firewall, do not go to websites that you do not know or trust, and do not open email messages from those you do not know. And even if you follow this advice, it does not mean that you will be able to avoid viruses, scams, etc.
Now, for that list of MAC issues, see the below snipits from the SANS:
--Apple Releases Cumulative Update for Mac Os X
(30 November 2005)
Apple has released a cumulative update for the Mac OS X operating
system. The update addresses 13 flaws, that could be exploited to allow
remote code execution, cross-site scripting and spoofing. The most
serious flaws are the remote code execution vulnerabilities in
CoreFoundation, Curl and Safari.
http://www.techworld.com/security/news/index.cfm?RSS&NewsID=4891
Internet Storm Center:
http://isc.sans.org/diary.php?storyid=905
--Apple Releases Mac OS X 10.4.3
(1 November 2005)
Apple has updated Mac OS X to version 10.4.3; the update includes fixes
for five security vulnerabilities in the operating system and bundled
applications. One of the security flaws could be exploited to
circumvent security restrictions. The update is available for Mac
clients and Mac servers.
http://www.techweb.com/wire/software/173401043;jsessionid=XWKZIT1UMCWLUQSNDBCCKH0CJUMEKJVN
http://www.eweek.com/print_article2/0,1217,a=164124,00.asp
http://docs.info.apple.com/article.html?artnum=302763
http://docs.info.apple.com/article.html?artnum=301984
--Apple OS X Updates Address Java Flaws
(15 September 2005)
Apple has released software updates for Mac OS X 10.3.9 and Mac OS X
10.4.2, known respectively as Panther and Tiger. The updates address
critical security flaws in the Java software, which could be exploited
to evade security restrictions or obtain elevated privileges.
http://www.zdnetasia.com/news/software/printfriendly.htm?AT=39254741-39000001c
http://docs.info.apple.com/article.html?artnum=302265
http://docs.info.apple.com/article.html?artnum=302266
--Apple Releases Large Security Update
(17/16 August 2005)
Apple has released a security update for OS X that addresses 44 flaws.
Some of the vulnerabilities for AppKit and Safari are considered
critical. Buffer overflow vulnerabilities in AppKit could be exploited
to execute arbitrary code on unpatched systems. Flaws in Safari could
be exploited to allow attackers to bypass security checks to execute
arbitrary commands; users would have to click on malicious rich text
format files for this to happen. In addition, a buffer overflow flaw
in Apple's Server Manager D could allow remote code execution without
user interaction.
http://news.zdnet.com/2102-1009_22-5834873.html?tag=printthis
http://www.techworld.com/security/news/index.cfm?RSS&NewsID=4222
http://www.us-cert.gov/cas/techalerts/TA05-229A.html
http://docs.info.apple.com/article.html?artnum=302163
--Apple Patches 11 Security Flaws
(10 June 2005)
Apple has released a security update that contains fixes for 11
vulnerabilities in its OS X operating system. Some of the flaws are
buffer overflow problems that can result in denial of service or
unauthorized root access on vulnerable systems.
http://www.technewsworld.com/story/nw5ACVdv9UyVc2/Tiger-Jaguar-Get-Patched-Up.xhtml
http://www.informationweek.com/showArticle.jhtml?articleID=164302227
Doc
