Microsoft Could Teach Apple a Lesson about Security

(3 Pages)
1
2
3
→

You cannot start a new topic
You cannot reply to this topic

Microsoft Could Teach Apple a Lesson about Security

#1 PCWorld

Advanced Member

Group: PCWorld BOT
Posts: 44,278
Joined: 01-August 07

Posted 13 May 2009 - 01:27 PM

Post your comments for Microsoft Could Teach Apple a Lesson about Security here

#2 BGG001

Senior Member

Group: Members
Posts: 552
Joined: 24-March 09
Location:Wisconsin

Posted 13 May 2009 - 02:43 PM

Finally an article that actually states the truth about Apple security. I'm a Windows user who actually wants apple to get on the ball with this type of stuff, better competition.

#3 GetReal

Advanced Member

Group: Members
Posts: 269
Joined: 01-April 08
Location:East-Central Florida

Posted 13 May 2009 - 03:05 PM

The Apple fanboys still won't believe it!
Apple is great!
Long live Apple!

ha

#4 techie4fun

Expert

Group: Members
Posts: 2,838
Joined: 18-October 06

Posted 13 May 2009 - 03:21 PM

I'm also sure that if the Mac was targetted the way Windows was, things would be different.

#5 dragon69

Advanced Member

Group: Members
Posts: 361
Joined: 03-February 07
Location:SK. Canada

Posted 13 May 2009 - 04:36 PM

until macs start getting attacked on a regular or intense basis there is not much need for security programs but in the near future that will be changing as more and more macs are being sold everyday ( they have gained a small market share thanks to vista )

#6 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 13 May 2009 - 05:02 PM

Actually, what the stuff in the ARTICLE as about was how many
lessons both Micro$uck and Apple could learn from the OSS community.

After all, the patches for badness come overnight.

Micro$uck leaves widely known and exploited security holes open for YEARS. They only make those security patches so often because there are so many to make.

All Micro$uck could teach about security is "LEAVE IT TO THIRD PARTY VENDORS".

Ship an awful, insecure mess, then recommend everyone fill their computer up with security scanning software.

It's, like, establishing a market 'n stuff.

#7 jdhayes117

Newbie

Group: Members
Posts: 1
Joined: 26-February 09

Posted 13 May 2009 - 06:01 PM

Researchers Show How to Take Control of Windows 7

http://www.pcworld.c...699/researchersshowhowtotakecontrolofwindows7.html

"Security researchers demonstrated how to take control of a computer running Microsoft's upcoming Windows 7 operating system at the Hack In The Box Security Conference (HITB) in Dubai on Thursday.

Researchers Vipin Kumar and Nitin Kumar used proof-of-concept code they developed, called VBootkit 2.0, to take control of a Windows 7 virtual machine while it was booting up. They demonstrated how the software works at the conference.

"There's no fix for this. It cannot be fixed. It's a design problem," Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. ...more..."

...Note, this is for THE FOLLOW-ON to Vista...

Say what you will, 30+ Million Macs, Zero viruses, despite no Norton, Kaspersky, MacAfee, Panda, etc...

Consumer Reports top rated laptops in every category...

JD Powers #1 in Reliability and Customer Service...

Let Lauren have her PC. Maybe the "fanboys" are fanboys for a reason...

#8 hawhite

Member

Group: Members
Posts: 40
Joined: 09-September 07

Posted 13 May 2009 - 07:33 PM

I believe in order for this to work you need physical access to the computer in question. Any computer is at risk if someone has access to it.

Woudn't enabling the BIOS password plug this vulnerability?

#9 sfoalex

Advanced Member

Group: Members
Posts: 215
Joined: 26-April 08

Posted 13 May 2009 - 07:42 PM

jdhayes117 said:

Researchers Show How to Take Control of Windows 7

www.pcworld.com/businesscenter/article/163699/researchers[ushow[/u]howtotakecontrolofwindows7.html]

"Security researchers demonstrated how to take control of a computer running Microsoft's upcoming Windows 7 operating system at the Hack In The Box Security Conference (HITB) in Dubai on Thursday.

Researchers Vipin Kumar and Nitin Kumar used proof-of-concept code they developed, called VBootkit 2.0, to take control of a Windows 7 virtual machine while it was booting up. They demonstrated how the software works at the conference.

"There's no fix for this. It cannot be fixed. It's a design problem," Vipin Kumar said, explaining the software exploits the Windows 7 assumption that the boot process is safe from attack. ...more..."

...Note, this is for THE FOLLOW-ON to Vista...

Say what you will, 30+ Million Macs, Zero viruses, despite no Norton, Kaspersky, MacAfee, Panda, etc...

Consumer Reports top rated laptops in every category...

JD Powers #1 in Reliability and Customer Service...

Let Lauren have her PC. Maybe the "fanboys" are fanboys for a reason...

30 million macs...

PCs sell 205 million units per year. We're attacked so much because we're the biggest target of all time. Macs, what is a Mac again? Oh yeah, that computer sold by a single company that can't even reach the top 5 when compared to hundreds of companies that produce Windows based PCs.

#10 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 13 May 2009 - 07:51 PM

If you have physical access, you can pop the case cover and reset the BIOS password, and have instant access.

So, if the case is lockable, you need a padlock.

Most likely the machine will have left the CD/USB boot enabled (most people never knew they could be turned on/off) so anybody with a Linux 'Live' CD or USB drive can boot the machine, bypass all Windoze security, and all your bases are belong to them.

Or you can unplug the drive, and plug it into a notebook with a universal SATA/IDE to USB adapter (I have one, super handy). Just mount the drive in read-only mode, copy everything you want, put it back the way you found it, and the owner will never know it happened.

Or (simplest, most ancient access-based security threat) people could steal the whole computer, do what they like with it at their leisure while you try to make an insurance claim and wonder when you backed up last (most people won't wonder when they backed up last, they'll just lose all of their data, most activation codes for software, and most of the passwords they let the browser remember for them).

#11 sfoalex

Advanced Member

Group: Members
Posts: 215
Joined: 26-April 08

Posted 13 May 2009 - 07:54 PM

Evildave said:

Totally agree! If you have physical access, all bets are off unless you have absolute cloud computing and the computer is nothing more than a logged off terminal. I miss terminals.

#12 BGG001

Senior Member

Group: Members
Posts: 552
Joined: 24-March 09
Location:Wisconsin

Posted 13 May 2009 - 07:55 PM

Yeah, Microsoft doesn't patch things for years, despite fixes every tuesday; Macs have a "Service Pack," if you will, every 4-6 months, no patches in between. Apple took 3 months to fix the WIDELY KNOWN EXPLOIT IN SAFARI discovered in PWN2OWN back in March.

Microsoft patches fewer bugs than Apple does in the same time period, which says something considering the user base's abilities to find them. These are facts, you can't deny them no matter how much you may want to.

#13 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 13 May 2009 - 07:58 PM

I wish people would stay abreast of the numbers. There aren't 30,000,000 Macs.

There are almost 100,000,000 Macs in use.

Save this link.

http://marketshare.h...t.aspx?qprid=9#

1% = over 10,000,000 users.

#14 sfoalex

Advanced Member

Group: Members
Posts: 215
Joined: 26-April 08

Posted 13 May 2009 - 07:59 PM

Evildave said:

I wish people would stay abreast of the numbers. There aren't 30,000,000 Macs.

There are almost 100,000,000 Macs in use.

Save this link.

marketshare.hitslink.com/report.aspx?qprid=9#

1% = over 10,000,000 users.

I use mine to hold a cup.

#15 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 13 May 2009 - 08:29 PM

Oh dear! Something didn't get plugged between March and May that wasn't used to make any actual viruses! How horrid!

Oh looky, a still-open YEAR old hole.

http://www.theregist...9/03/18/windowstokenvuln/

Of course, who could forget 'Autorun'? It is a hole that has existed since 1995. It was identified as a severe vulnerability way back then. Most recently, conficker was using it.

Almost 14 years later, through Win95, Win98, Win98SE, Windoze 2000, Windoze XP, Vista... and still left running whatever got inserted on any kind of media, by default.

I wonder how long until someone starts infecting ISO images? After all, autorun.inf is very permissive, assuming a read-only CD is 'secure', and all kinds of ISO images are floating around, waiting to be burned (or virtually mounted). Oh, never mind. It's been done to death already.

#16 sfoalex

Advanced Member

Group: Members
Posts: 215
Joined: 26-April 08

Posted 13 May 2009 - 08:36 PM

Microsoft is indeed guilty as you have charged.

But let me ask you this... How does that change the reality that Apple takes many months to fix a security leak. If I understand what you are saying you feel it is okay because others do worse in your opinion. Now on my Mac, if I insert a DVD, the player plays it automatically. Hmmm... If I insert a disc, it is mounted automatically. The reality is simple. No one gives a crap about the tiny audience of the Mac. But to suggest that makes it okay is a little bit off in my view.

#17 chevrolet1994

Advanced Member

Group: Members
Posts: 245
Joined: 22-December 08

Posted 13 May 2009 - 10:18 PM

I guess the hackers have too much time
on their hands if they're hacking Mac
OS X, in addition to MicroSoft products.

#18 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 14 May 2009 - 12:35 AM

It takes Apple months to fix a hole. It takes Micro$oft months to fix a hole (when they finally get around to admitting it exists and do something about it). It takes days to make a patch for a Linux kernel, but also takes time to test, and up to a few weeks to a couple of months to actually get it distributed to end users as patches/updates.

Everything takes time to move through channels. It's worse to knee-jerk and slap up a patch without adequate testing than to delay fixing the original problem, because you can ALWAYS make matters worse.

YEARS? That's inexcusable. Pure negligence.

The only reason the crooks go for Windoze is it's low-hanging fruit. Criminals will never go straight for the big, locked vault in the castle if they have so many open windows, unlocked doors and carelessly laid valuables in plain sight to pass on the way to it. Windoze cracks and hacks are readily available. Mix and match the security hole with the rootkit and payload, and then link it and post it where people will get it.

So, in a back-handed way, Windoze does keep Macs a little safer, the way someone who leaves their car open with valuables visible through the windows next to your locked car makes your car (and its contents) safer. Thanks, guys! Very nice of you to do that every day of your lives for us! Of course, this is a blessing and a curse. By breeding on-line criminals, Windoze also establishes on-line crime and grows it. According to Symantec, 65% of all running Windoze software is now malware. So also in the same way, someone who consistently lets their car get broken into becomes an attractive menace, attracting criminals who are looking for something to steal.

YOU may be an alpha-windoze-geek, but your mom/sister/aunt/grandma/etc. aren't. YOU may know how to keep your files safe and computer clean, but THEY don't. YOU (presumably) have backups. They don't.

It's technically harder to make a Mac virus than it is to make a Windoze one, and it's almost impossible to make a Linux virus. In the case of Linux, this is mainly because 'Linux' encompasses such a vast array of binary-incompatible systems, installation schemes, differing available libraries, etc., that any universal Linux virus you attempted to create will simply sputter and die out. To be small and compact, the virus/worm/spyware/malware needs uniform system services. You might make an 'Ubuntu killer', but Redhat, DSL, etc. users wouldn't even notice. Generally users of one version up or down from your Ubuntu target might not be infected, either.

Windows makes the perfect environment for malware writers with almost universal binary compatibility and very uniform libraries and services, with very uniform exploits, and a vast reservoir of systems plugged into dial-up connections that never, ever get patched with near-gigabyte sized service patches. Especially not after they get that critical mass of infection where the computer just CAN'T install patches, and the poor, clueless end user doesn't know how to fix it. They just whine about their 'slow' internet connection (busily sending thousands of spam email messages) and poor performance (busy doing illegal things for criminals), and live with it.

Like the Irish potato blight, once the bug gets started in your Windoze monoculture, it will just run its course.

It's not 'security through obscurity'. It's an survival trait passed down through a couple billion years of evolutionary development and testing of countless living things. Very well proven. A monoculture means one very simple bug can wipe the whole breed out. Diversity means that an infection can't spread. It has to cope with hosts with many different kinds of traits. The bad things can't adapt and be an all-killer, like they can when ALL of their victims are identical.

This article (and many like it) describes the monoculture problem in greater detail, and probably a bit more eloquently than I would.
http://dan.tobias.na...onoculture.html

#19 JAYoung

Newbie

Group: Members
Posts: 3
Joined: 14-May 09

Posted 14 May 2009 - 11:43 AM

Ah... I stopped reading your comment the second you wrote "Micro$uck." How you expect to be taken seriously when you can't even bring yourself to type Microsoft (try it, you may even like it) is beyond me. Do us all a favor and go bury your head in an open source book.

#20 Evildave

Expert

Group: Members
Posts: 1,549
Joined: 24-January 08

Posted 14 May 2009 - 12:00 PM

This isn't a journalism class, and and Microsoft does suck. It's your loss.

(3 Pages)
1
2
3
→

You cannot start a new topic
You cannot reply to this topic

Name	City

Address 1	State	Zip

Address 2	E-mail (optional)

PC World Forums: Microsoft Could Teach Apple a Lesson about Security - PC World Forums

PC World Community

Microsoft Could Teach Apple a Lesson about Security

#1 PCWorld

#2 BGG001

#3 GetReal

#4 techie4fun

#5 dragon69

#6 Evildave

#7 jdhayes117

#8 hawhite

#9 sfoalex

#10 Evildave

#11 sfoalex

#12 BGG001

#13 Evildave

#14 sfoalex

#15 Evildave

#16 sfoalex

#17 chevrolet1994

#18 Evildave

#19 JAYoung

#20 Evildave

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users

Skin and Language

Execution Stats

PC World Forums: Microsoft Could Teach Apple a Lesson about Security - PC World Forums

Microsoft Could Teach Apple a Lesson about Security

1 User(s) are reading this topic 0 members, 1 guests, 0 anonymous users

Skin and Language

Execution Stats

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users