22-03-2005 01:43									#1
	The myth that software popularity doesn't affect number of vulnerabilities is a myth Support Apolyton, buy Galactic Civilizations

http://software.silicon.com/os/0,39...39128858,00.htm

quote: Symantec: Mac OS X a hacker target March 21 2005 by Munir Kotadia "The Macintosh operating system has not always been a safe haven from malicious code..." Security vendor Symantec is warning that Apple's OS X operating system is increasingly becoming a target for hackers and malware authors. In its seventh bi-annual Internet Security Threat Report, Symantec said over the past year, security researchers had discovered at least 37 serious vulnerabilities in the Mac OS X system. According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack. "Contrary to popular belief, the Macintosh operating system has not always been a safe haven from malicious code," Symantec said. "Out of the public eye for some time, it is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various Unix-based operating systems," the report said. "Apple Computer has become a target for new attacks… The appearance of a rootkit called Opener in October 2004 serves to illustrate the growth in vulnerability research on the OS X platform… The various OS X vulnerabilities allow attackers to carry out information disclosure, authentication bypass, code execution, privilege escalation and DoS attacks. Symantec believes that as the popularity of Apple's new platform continues to grow, so too will the number of attacks directed at it," the report said. Symantec's concerns were echoed by James Turner, security analyst at Frost & Sullivan Australia, who said many of the people who bought Apple products were not concerned about security, which left them wide open to attack. "The iPod, PowerBooks and mini Macs are cool products," Turner said. "The by-product is that people are buying these products for form over function. They say it looks pretty and then buy it but don't secure it. As Apple increases its market share, it will be a legitimate target". Trend Micro senior systems engineer Adam Biviano said all complex operating systems had security flaws and the more popular the platform, the more likely it would be attacked. "All sophisticated platforms - Mac, Linux, Solaris or anything else - will have vulnerabilities," Biviano said. "The only reason Windows has had mass exploits written for it is the sheer number of connected devices that are present on most networks. As soon as you start seeing mass deployment of any technology you are going to see exploits." According to Biviano, while there have not been any mass outbreaks of viruses targeting the Mac, the potential does exist. "You don't see Macintosh viruses in mass outbreaks but you do see them in the labs as proof of concepts. There aren't any outbreaks because there are simply are not enough [Macs] out there. For a virus to be successful it needs a combination of an exploit and a large target audience," said Biviano, who nominated the mobile phone market as an example of malware writers targeting the most popular platform, not Microsoft's platform. "Look at where mobile viruses are going and they are not targeting Microsoft - they are targeting the market leader, which is Symbian," he said. The Symantec report found in the second half of last year an increasing proportion of malware designed to expose confidential information. The report also found that phishing attacks increased by 366 per cent while the number of Windows-based worms and viruses increased by only 64 per cent when compared to the first half of 2004.

I've been saying this all along, and in fact I considered it to be common sense, but certain people here seem to disagree...

Discuss...

	22-03-2005 01:45									#2
	Support Apolyton, buy Galactic Civilizations

Isn't this common knowledge? You'd have to be a pretty big fan boy to believe OS X has no vulnerabilities.

	22-03-2005 01:46									#3
	Support Apolyton, buy Call to Power 2

So a myth is a myth.

	22-03-2005 01:48									#4
	Support Apolyton buy from Amazon

quote: Originally posted by Lord Nuclear Isn't this common knowledge? You'd have to be a pretty big fan boy to believe OS X has no vulnerabilities.

It's not just about OS X, it's about Linux as well.

Certain people here say the reason that there's no widespread viruses on Mac and Linux is because of their design. I've argued that as long as you have stupid users or a single vulnerability, you'll have viruses/exploits. The amount depends on how juicy the target is.

Urban Ranger insists this is a myth...

	22-03-2005 02:39									#5
	Support Apolyton, buy Civilization III: Complete

The *only* inherent advantage with regards to security that I can think of with regards to Windows vs. Linux/OSX etc, is the whole user priviliges thing. But windows offers that, it's just idiocy on the part of the user, not any fault of the designers.

	22-03-2005 10:57									#6
	Help yourself to an AD-FREE life

Does anyone actually believe that myth though?
Im no industry expert, but thats like saying ppl try harder to find flaws in banks than in my jeans pocket...

	22-03-2005 11:00									#7
	Support Apolyton, buy Civilization III: Complete

Believe what myth?

What is the point in investing time and energy into writing a virus to target something with 2% marketshare when you can hit something with 95%+ marketshare?

It's a psychological question more than anything else. People who write viruses are out for fame or have an appetite for destruction, neither of which lend themselves to tiny marketshares...

Last edited by Asher on 22-03-2005 at 11:19

	22-03-2005 11:17									#8
	Support Apolyton, buy Galactic Civilizations

I don't think this even qualifies as a myth. More of a limited-impact reality inversion.

SP

	22-03-2005 11:31									#9
	Re: The myth that software popularity doesn't affect number of vulnerabilities is a m Support Apolyton

quote: Originally posted by Asher I've been saying this all along, and in fact I considered it to be common sense, but certain people here seem to disagree... Discuss...

You quote something Mr Adam Biviano said as gospel?

So much for you, Asher

	22-03-2005 11:32									#10
	Lose 30 kilos (of popups)

quote: Originally posted by Whaleboy The *only* inherent advantage with regards to security that I can think of with regards to Windows vs. Linux/OSX etc, is the whole user priviliges thing.

That is completely incorrect. There are huge fundamental flaws to the design of Windows. Bruce Schneier said a whole bunch of things here, and that's just part of it. Notice that newsletter was published in February 2002, yet MS has done little to fix the problems outlined.

	22-03-2005 11:35									#11
	Tired of ads?

quote: Originally posted by Urban Ranger That is completely incorrect. There are huge fundamental flaws to the design of Windows.

This is seriously about the seventh time you've said this, and the seventh time I've asked: "Such as?"

It's time for you to step up to the plate.

	22-03-2005 11:37									#12
	Re: Re: The myth that software popularity doesn't affect number of vulnerabilities is Support Apolyton buy from Amazon

quote: Originally posted by Urban Ranger You quote something Mr Adam Biviano said as gospel? So much for you, Asher

Quiz:

1) How many people are quoted with the same opinion in the article? (Hint: more than one)
2) How many people are more qualified to make an opinion in the article? (Hint: all are more qualified than you)
3) Who has shown some fundamental ignorance about computer security? (Hint: it's the person who confused a stack exploit and a heap exploit, then denied there are heap exploits. Hint2: you)

	22-03-2005 11:38									#13
	Increase Your PM Length

quote: Originally posted by Asher This is seriously about the seventh time you've said this, and the seventh time I've asked: "Such as?"

If you don't know, you shouldn't be a Computer Science student.

	22-03-2005 11:38									#14
	Support Apolyton, buy Civilization: The Boardgame

SP

	22-03-2005 11:39									#15
	Support Apolyton, buy Galactic Civilizations

quote: Originally posted by Urban Ranger If you don't know, you shouldn't be a Computer Science student.

You are so transparant, old man.

Shouldn't you be off imaging some computers?

	22-03-2005 11:41									#16
	Support Apolyton, buy Civilization 2

Just for shits and giggles, I'm going to assume one of the fundamental flaws in the Windows design has to do with it being a monolithic kernel that lets all kernel-level services play in the same memory space...oh wait a second, that's not Windows...that's...Linux?

	22-03-2005 11:41									#17
	Re: Re: Re: The myth that software popularity doesn't affect number of vulnerabilitie Support Apolyton, buy GURPS/ Alpha Centauri

quote: Originally posted by Asher 1) How many people are quoted with the same opinion in the article? (Hint: more than one)

You need to RTFA again. The others have only said that vulnerabilities exist in all OS.

quote: Originally posted by Asher 2) How many people are more qualified to make an opinion in the article? (Hint: all are more qualified than you)

Funny, since you don't have any qualifications to make such a judgement call.

quote: Originally posted by Asher 3) Who has shown some fundamental ignorance about computer security? (Hint: it's the person who confused a stack exploit and a heap exploit, then denied there are heap exploits. Hint2: you)

Just because somebody asserted that there is such a thing as "heap exploit" doesn't mean it exist.

	22-03-2005 11:42									#18
	Full PM-box? Change here!

quote: Originally posted by Asher Just for shits and giggles, I'm going to assume one of the fundamental flaws in the Windows design has to do with it being a monolithic kernel that lets all kernel-level services play in the same memory space...oh wait a second, that's not Windows...that's...Linux?

Own goal. Windows does the same thing.

	22-03-2005 11:45									#19
	Re: Re: Re: Re: The myth that software popularity doesn't affect number of vulnerabil Avatar Enlargement: We've got the solution

quote: Originally posted by Urban Ranger You need to RTFA again. The others have only said that vulnerabilities exist in all OS.

Biviano works for TrendMicro, no? TrendMicro != Symantec, no?

quote: According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack.

Then there's James Turner...

quote: Symantec's concerns were echoed by James Turner, security analyst at Frost & Sullivan Australia, who said many of the people who bought Apple products were not concerned about security, which left them wide open to attack.

quote: Funny, since you don't have any qualifications to make such a judgement call.

More than you, which seems to be more than enough. A drunken ape could run circles 'round you in computer debates.

quote: Just because somebody asserted that there is such a thing as "heap exploit" doesn't mean it exist.

Honestly, you have to be shitting me.

	22-03-2005 11:46									#20
	Increase the size of your Attachments

quote: Originally posted by Urban Ranger Own goal. Windows does the same thing.

Only with the video card and network drivers, which were moved into kernel-space in NT 4.0 (or more specifically, SP6 for 3.x, IIRC) for performance reasons.

The rest of the kernel does not share the same space, and relies on message-passing (hint: this is the major characteristic of a microkernel).

And for the record, you're not even playing the "Own goal" game correctly, either. You don't "own goal" rhetorical questions. At this point, I call "offsides".

	22-03-2005 11:48									#21
	Lose 30 kilos (of popups)

They didn't put hard drive drivers into the kernel?

SP

	22-03-2005 11:56									#22
	Support Apolyton, pre-order Civilization IV

quote: Originally posted by Fve Crathva They didn't put hard drive drivers into the kernel? SP

That's up to the driver, a lot of them do run in the kernel mode. For desktops, this is common for speed reasons. It's probably even the default behavior these days.

You can run them in ring3 as well, up in userland.

The main point is, with the way Windows NT is designed, it's almost trivial to change between running components in userland and running them in kernel-land. The original design was fully microkernel, and it's evolved ever since. It's probably even something simple like #IFDEFs that ignore message-passing and go straight for kernelspace to do it itself.

The Linux kernel, on the other hand, was designed to be monolithic. You would have to do some massive refactoring to make it monolithic...GNU/Hurd would be done sooner.

And BTW, Urban Ranger...what would you call an exploit that modified the pointer to the next "chunk" in memory/heap to whatever the hacker wanted?

	22-03-2005 12:08									#23
	Support Apolyton, buy Call to Power 2

quote: Originally posted by Urban Ranger That is completely incorrect. There are huge fundamental flaws to the design of Windows. Bruce Schneier said a whole bunch of things here, and that's just part of it. Notice that newsletter was published in February 2002, yet MS has done little to fix the problems outlined.

1) You DanSed me.
2) None of these problems are even remotely close to being "fundamental"
3) Most of those problems have been addressed, even without a Windows release since he wrote those. Half of his points are effectively shot down by the inclusion of DEP in SP2.
4) Many of his ideas are absurd and show a complete lack of understanding of how users use the products (like his idea for Office macros -- give me a break)
5) His remaining points on the "default install" are remedied quite easily in Windows Server 2003 and newer, and even doing things like enabling the firewall by default in XP2.
6) Schiener has a clear agenda to push, and I'm not surprised that you can't see through it. This line in particular cracks me up:

quote: Commercial software is full of bugs, and some of those bugs harbor security vulnerabilities.

It's awesome he qualified that to "commercial" software. Lord knows free software is free of bugs and security vulnerabilities, unlike those pesky commercial software packages.

Please, grace me with your knowledge and insight -- discuss his points and why you think they are fundamental flaws, and how they have not been addressed.

	22-03-2005 14:09									#24
	Support Apolyton buy from Amazon

I'm no expert in this field , but common sense tells me that faster release cycles , and a higher community participation , coupled with greater peer-review , would tend to make the fixing of burs faster , and bugs rarer , in free software , compared to non-open source software .

I am not , however , willing to bet anything on my judgment in this regard ( because I know that I do not know anything about this ) , so I would recommend we wait and see .

	22-03-2005 15:28									#25
	Remove this text

That would be great, if there was a higher community participation and greater peer review. As it stands, the software that gets reviewed by skilled security professionals is the commercial software (and OpenBSD). The number of eyes viewing code isn't as important as the competence of those eyes. I think open source kicks ass, but the community is too chaotic, too mismanaged, too elite to be effective. And the community just doesn't have enough money circulating in it.

SP

Last edited by Fve Crathva on 22-03-2005 at 16:31

	22-03-2005 16:21									#26
	Support Apolyton, buy Civilization 2

How retarded. A company trying to sell security solutions for a platform that doesn't really have security problems is scaremongering in order to increase sales of their product.

I'm surprised at you Asher. Your trolls are usually better than this. If you bothered looking, you'd see that Symantec comes out with a prediction like this once or twice a year.

And nothing in that article proves your point. You've been making the same claim now for years with no evidence. What you say might well be true, but you haven't proved it beyond mere speculation.

One could just as easily say that OS X's well-known security would cause more hackers to target it, just for the satisfaction. But that too would be speculation, which is no better than what you have.

	22-03-2005 18:14									#27
	Support Apolyton, buy Civilization III: Complete

quote: According to Symantec, as Apple increases its market share - with new low cost products such as the Mac mini - its userbase is likely to come under increasing attack.

10/10

	22-03-2005 19:47									#28
	Increase the size of your Attachments

quote: Originally posted by Agathon How retarded. A company trying to sell security solutions for a platform that doesn't really have security problems is scaremongering in order to increase sales of their product. I'm surprised at you Asher. Your trolls are usually better than this. If you bothered looking, you'd see that Symantec comes out with a prediction like this once or twice a year.

It's not just Symantec, you can also see that there are security experts backing up the claim with convincing arguments.

quote: And nothing in that article proves your point. You've been making the same claim now for years with no evidence. What you say might well be true, but you haven't proved it beyond mere speculation.

There's a patch the other day to fix 10 additional MacOS X security vulnerabilities.

Why do you think it's impossible to get viruses on MacOS X?

There are many avenues to take for writing MacOS X viruses, the most popular Windows viruses are "social engineering" viruses or phishing attacks, which can happen on any platform. The fact that those don't appear on Mac either (they usually send .exe's) should be a strong hint for the reasoning behind it. And it has nothing to do with MacOS X being "bulletproof" (it's anything but). There have been more vulnerabilities for MacOS X this year than Windows XP so far, just no one seems to be exploiting them on a wide scale.

It's time to look at this with common sense.

	22-03-2005 20:18									#29
	Support Apolyton, buy Call to Power 2

quote: Originally posted by Lul Thyme Does anyone actually believe that myth though?

Yes.

	22-03-2005 22:11									#30
	Support Apolyton buy from Amazon

quote: Originally posted by Asher And it has nothing to do with MacOS X being "bulletproof" (it's anything but). There have been more vulnerabilities for MacOS X this year than Windows XP so far, just no one seems to be exploiting them on a wide scale. It's time to look at this with common sense.

Generally speaking, how old is Windows NT (which XP is based on, no?) and how old is Mac OS X?

But anyway a security flaw != a security flaw and 100 flaws can be less harmful than a single other. You're playing marketing department if you just compare numbers.

However I still doubt that in OS X there are such easily exploitable vulnerabilites such as the Blaster attack, which doesn't even require user action, just a connection to the internet and the absence of a firewall (which was deactivated by default in pre-SP2 and how many OEMs shipped with an enabled firewall???). Flaws like these make MS look stupid. If it's an attachment that the user opens, you can always blame it on the user, especially since this could be considered common knowledge now, but in the case of Blaster you cannot really do so.