Industry


Ads by TechWords

See your link here


Michael R. Farnum's picture
Michael R. Farnum

Hitting the Security Nerve

OS Cage Match

Looks like the organizers of CanSecWest 2008 are going to pit Leopard against Linux against Vista this year.  After a Mac got hacked last year (in what really turned out to be a Quicktime hack that also affected Windows), it looks like some real questions are going to get answered on which OS is more secure. 

My favorite quote in the article was from CanSecWest organiser Dragos Ruiu:

The fur is flying right now about which is more secure: Linux, Vista or Leopard. Linux guys have their propaganda; Windows guys are saying this and that; Apple guys have buried their heads in the sand as usual. I guess the proof is in the pudding.

So true.  Everyone is peeing on everything to mark their territory, so it should be interesting to see what happens.  Which OS will be the Alpha male, and which ones will go running with their proverbial tales between their legs?

I know I will probably get some flames for this, but I kinda hope Leopard takes some lumps.  Though I think it is getting somewhat better, I concur with Ruiu's comment that Apple people just don't want to admit that there might be something there.  It is still on the level of a religious debate with so many people.

On the flip side, I also know that there are a lot of people on the assessment team where I work that have switched to Mac because of it being a BSD core.  They can port over all their security tools, and my thought is that they would not switch over it if wasn't fairly secure.  That tells me something is to be said for Mac security, or at the very least it is easier to lock down.

Either way, I am sure it will be fun to watch.

What People Are Saying

Is 'fairly secure' good enough?

I agree that Macs are fairly secure machines. But I would trust a default Vista or Linux install to be more secure. Apple has a history of making security sacrifices for usability.

To stave off flames, please Google 'mDNS' or 'Leopard firewall' or 'Apple firewall stealth'. Does OS X turn on the firewall by default? Nope. In fact, if you're upgrading to Leopard from an older OS, it will turn your firewall off!

And much of their touted invulnerability to hackers comes more from their userbase compared with Windows. Apple users are typically more technologically and security savvy and there are far fewer OS X installs than Windows.

But I'm looking forward to this contest. I think the real story will be the number of people attacking each OS rather than any vulnerabilities that actually come out of it. Who attacks what will show how much interest there is in probing those different OSes. That interest is a combination of both wanting to hack it and thinking those attacks will be successful.

Blah blah blah

I love the argument that Macs don't have the attacks that Windows does because there are fewer MAC machines out there.

I don't know where people get such logic. Windows is the biggest target because it is the EASIEST target.

All of those MAC adds about security and such would have been taken as a HUGE challenge to the Cracker community. If they could come up with an attack on the OS they would have. They havent...

Nuff said.

Or maybe no one cared.

Or maybe no one cared. Those adds weren't exactly effective, or well made. Seeing them advertise security only made me laugh, not want to hack apple.