Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Apple Hires Former OLPC Security Director

timothy posted more than 5 years ago | from the yes-but-get-the-screen-tech-too dept.

Security 144

imamac writes "It seems Apple is seeking to beef up security by hiring Ivan Krstic, the one-time director of security architecture at One Laptop per Child. 'Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week and will work on core OS security. His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it's rather trivial to launch exploits against the Mac.'"

cancel ×

144 comments

Sorry! There are no comments related to the filter you selected.

So trivial there's only one (3, Insightful)

SuperKendall (25149) | more than 5 years ago | (#27958151)

So trivial in fact to launch an exploit on the Mac, that there's only one in the wild - and that's a trojan in a pirated application.

I guess the challenge of the PC ecosystem is what draws in the thousands of viruses and malware applications they get.

Re:So trivial there's only one (1)

abigsmurf (919188) | more than 5 years ago | (#27958521)

Just because there aren't many around, doesn't mean it isn't trivial, it just means there are few malware developers who think it's worth their time.

Not entirely sure why. It may only be a 10% user base but you've more exploits being found for OSX than Linux and windows, fewer mechanisms to make it harder to infect a system through an exploit and a userbase that, is mostly connected to the internet with no anti-virus software

Re:So trivial there's only one (2, Interesting)

MoonBuggy (611105) | more than 5 years ago | (#27958593)

You're right, the number of exploits doesn't necessarily mean it's a more secure system, but the fact that (as you say) there aren't a proportionate amount to the size of the userbase does seem to imply decent security.

I personally haven't heard of any exploit in the wild except the trojan, for which the user has to be willing to provide their password to any old bit of software with unknown providence - to be honest I don't know how one could protect against that on any system. If there are other exploits out there I would like to know about it, but if there aren't then the author has no right to say it's "trivial to launch exploits against the Mac" unless he's demonstrating that by writing them himself.

Re:So trivial there's only one (5, Insightful)

Soubrause (1429687) | more than 5 years ago | (#27959047)

The malware industry has barriers to entry just like anything else, until we can make $x it's not worth any investment. OSX user base isn't big enough to generate $x yet. Even after that when x is 20% of y why not get $y for the same investment.

Microsoft & their partners also advertise bounties on exploits encouraging people to try and find them first so they can be patched, this adds to what is found considerably. I've never seen Apple pay for but have seen them deny holes that were handed to them.

I've seen OSX exploits that didn't require any more interaction from a user than those aimed at windows in farm environments; no reason something similar isn't out there on a site we've never gone to.

Firewalls and proxies exist because some of us know better than to think our OS is secure.

Re:So trivial there's only one (4, Interesting)

Anonymous Coward | more than 5 years ago | (#27959233)

If the marketshare argument was true then there wouldn't have been any viruses for pre-OSX Macs either. But there were; lots of them.
There were also viruses for the Apple IIGS, hardly a market leader.
That's a tired old troll you have there, sir.

Re:So trivial there's only one (1)

mattack2 (1165421) | more than 5 years ago | (#27961267)

What GS viruses? I had an Apple II virus before the term was used in computers, but can't think of a GS specific virus.

Re:So trivial there's only one (2, Informative)

warrigal (780670) | more than 5 years ago | (#27962125)

CyberAIDS, Festering Hate are two that come to mind.

Re:So trivial there's only one (3, Insightful)

Phroggy (441) | more than 5 years ago | (#27961625)

If the marketshare argument was true then there wouldn't have been any viruses for pre-OSX Macs either. But there were; lots of them.

Malware was different in those days. Yes, there used to be Mac viruses. Nowhere near as many as DOS/Windows viruses, but a lot. They were mostly transmitted on physical media, not downloaded over a network; most of them were written before TCP/IP support was included in the OS. Most of the holes that allowed the old viruses to spread have been closed, and there just aren't that many holes that new viruses can take advantage of.

Old-school Mac viruses were created by people looking for a creative way to make a virus because it was a fun challenge and it might gain them a bit of notoriety; there was never any profit in it (and most of the viruses weren't deliberately destructive, although some of them were accidentally destructive due to bugs). Modern malware authors are in it for the money.

Since the OS itself is really pretty secure these days, the best way to spread Mac malware is to trick the user into deliberately executing your code for you, clicking through all the security warnings. If you're in it for the money, that's the approach you'll take. If you're not in it for the money, there's no technical challenge in that! Anybody could make a malicious application that looks like a fun toy, so what's the point?

And if you're in it for the money, there's more money to be made on Windows right now. As Macs grow in popularity and Windows users start keeping their antivirus software up to date, the balance will shift, but it hasn't shifted yet.

industry amnesia (2, Insightful)

Gary W. Longsine (124661) | more than 5 years ago | (#27961895)

"If the marketshare argument was true then there wouldn't have been any viruses for pre-OSX Macs either. But there were; lots of them. There were also viruses for the Apple IIGS, hardly a market leader."

These and other inconvenient truths of the malware "market" are ignored, universally, by the industry trade press, and a surprising number of "security experts". There were worms exploiting Microsoft SQL Server on web servers when Apache + any of several other db had as much or greater market share. There have been Linux malware.

(Some of the various examples are relevant for fair comparison only within a market segment, such as the "web server" market, considered separately since these are considered "high value" targets, for their ability to spread to potentially many desktop systems, or for the data they might contain. For example, Linux had a minority share of the web server market when it first became a malware target. Perhaps this makes the case too subtle for pundits and the trade press, but it's not too subtle for the malware authors.)

The market share argument might be a partial explanation, but it really cannot explain the entirety of the vacuum in the Mac OS X malware marketplace. It's been five years, and still no malware plague. How many versions, and how many years must pass, before the industry realizes that perhaps there is something to this Mac OS X thing?

Re:industry amnesia (1)

Hucko (998827) | more than 5 years ago | (#27962433)

There isn't exactly a plague of malware outside of Microsoft products. The 'something' is not necessarily because of OS X, but in spite of it.

That said, my next machine will be a Mac. All weighed up, (I'm married, so ease of use has a significant factor for my spouse) OS X will be the center at which my computing world shall spin. Linux will be regulated back to a toy OS and if Windows appears it shall be for nostalgia --- I'm not very sentimental.

Re:So trivial there's only one (1)

ctmurray (1475885) | more than 5 years ago | (#27959537)

Can someone detail how someone makes money with malware? I thought the motivation was just the glory. But I have not followed the field much.

Re:So trivial there's only one (1)

dhavleak (912889) | more than 5 years ago | (#27960427)

Sure. Here is a tip-of-the-iceberg paragraph [wikipedia.org] from Wikipedia that explains it.

Re:So trivial there's only one (1)

ctmurray (1475885) | more than 5 years ago | (#27960873)

Thanks. Great link.

Re:So trivial there's only one (2, Interesting)

el americano (799629) | more than 5 years ago | (#27959565)

So they're only vulnerable to the hobbyist hackers... where are the successful malware examples from that group?

If the argument is that it's not worth anyone's time, then shouldn't you say that we don't know how vulnerable it is? I don't trust Apple implicitly, given how buggy early releases of many of their product seem to be, but this unfounded speculation does seem to be a popular troll that's used equally effectively against Linux. Try being a bit more responsible.

Re:So trivial there's only one (0)

Anonymous Coward | more than 5 years ago | (#27960829)

So they're only vulnerable to the hobbyist hackers... where are the successful malware examples from that group?

That's not what he said doofus!

Re:So trivial there's only one (2, Interesting)

dhavleak (912889) | more than 5 years ago | (#27960165)

I totally agree with you, but
grrr.. trust /. to degenerate the topic into "Macs are swiss cheese.." "no! widnows is swiss cheese".. etc..

I'm really interested in hearing about Krstic's security philosophy and it's merits/demerits. I found this talk on zdnet [zdnet.com] but there's only about 5 minutes of actual security architecture info in it at around 40:00 into the video. Oh, and there's also this BitFrost overview on Wikipedia [wikipedia.org] . I think there are some cool concepts there. The idea of sandboxing all apps into containers with sets of standard rights, and restricting IPC to certain approved mechanisms is pretty interesting. Was hoping poeple could focus on BitFrost and Krstic's security philosophies so we could all learn something.

Re:So trivial there's only one (1)

imamac (1083405) | more than 5 years ago | (#27960553)

Was hoping...we could all learn something.

You must be new here.

That argument was bullshit two years ago (2, Funny)

SuperKendall (25149) | more than 5 years ago | (#27961151)

The malware industry has barriers to entry just like anything else, until we can make $x it's not worth any investment. OSX user base isn't big enough to generate $x yet.

Price out botnets of a few hundred thousand nodes. Now figure there are 20-30 macs around, which are to some degree homogenous systems and thus in theory easier to target.

Your argument goes straight to hell. When the number of intel macs in peoples homes crossed about five million, the "user base" argument went straight to hell from both a technical and financial sense.

So how come no attacks to speak of? My vote is that the Russian Mafia all use macs, and they don't want to foul their own nest. :-)

Re:That argument was bullshit two years ago (1)

Phroggy (441) | more than 5 years ago | (#27961665)

So how come no attacks to speak of? My vote is that the Russian Mafia all use macs, and they don't want to foul their own nest. :-)

More likely the opposite is true: the Russian mafia all use PCs, and they have no idea how to write a Mac virus.

malware barrier to entry (4, Insightful)

Gary W. Longsine (124661) | more than 5 years ago | (#27962015)

The barrier to entry most commonly cited as the largest barrier protecting the Mac, prior to the CPU transition of the Mac platform, was Apple's use of the PowerPC, which allegedly required that malware authors know PowerPC assembly language. This argument ignored:
  1. the fact that plenty of malware existed for the old "System 7" and Mac OS 8/9,
  2. the fact that anyone who knows x86 assembly can buy a book and write a perl script to convert their egg from x86 to PowerPC, then clean the rest up by hand. They've got the skills. They've got the hubris. They've clearly got the time, particularly when so much malware was authored by people just trying to demonstrate their prowess and make pranks, and
  3. the fact that with all this malware, a small fraction of cr@X0rz are actually proficient in assembly, and the eggs are used by legion skript kiddiez who do *not* know assembly, so there was plenty of PowerPC mad skilz available.

Those people are still around, plenty of them, even though the most widely discussed malware is now part of profit seeking black market enterprises. Some of them are writing remote systems management code which puts Tivoli to shame. (e.g. Some of them are clearly bright enough to learn Objective C in a weekend, as they already know C, C++, C#, and x86 assembly) They are writing malware for Symbian, even though the statistics indicate that iPhone dominates the mobile web market. (Symbian has more browser instances on the planet, but they are not actually used by people to access the web, so you're not going to capture many passwords infecting those phones).

In fact, it's time to really start wondering: Where's the Mac OS X malware?

At some point we security experts must begin to consider the possibility that Mac OS X might be protected by more than it's niche market share.

Right, small user base (1)

SmallFurryCreature (593017) | more than 5 years ago | (#27962069)

Have you checked apples figures recently. They are the biggest PC maker in the world. That means they sell a HELL of a lot of PC's and because of OSX nature ALL with EXACTLY the same OS. Dell sells loads of different windows versions, even linux. Apple just OSX. Talk about a mono-culture.

I also see them more and more often in the wild. But they are to small a target.

Tell me this, whose credit card number would you rather have. A Apple users or a Dell users. (Dell user of course, the Apple user spend all his on his Mac :P)

security vs. safety (1, Informative)

Anonymous Coward | more than 5 years ago | (#27959447)

You're right, the number of exploits doesn't necessarily mean it's a more secure system, but the fact that (as you say) there aren't a proportionate amount to the size of the userbase does seem to imply decent security.

John Gruber had a good statement on this earlier today:

Security is about technical measures, like the strength of the locks on your doors and windows. Safety is about the likelihood that you'll actually suffer from some sort of attack. Microsoft has in fact implemented more advanced security measures in Windows than Apple has in Mac OS X, but that's not surprising, because Windows is where nearly all the malware is.

But it rings untrue to most ears to claim that Apple is doing a bad job with regard to security. The evidence suggests that Mac OS X has been and remains secure enough to be safe, and safety is what real people actually care about.

http://daringfireball.net/linked/2009/05/13/security-safety

Re:security vs. safety (1)

Weedhopper (168515) | more than 5 years ago | (#27959725)

That's a cute semantic game he plays with security and safety. You could switch the two words around and sell the same snake oil just as well.

John Gruber's wrong about the anchored shift selection, too.

Re:security vs. safety (5, Insightful)

DECS (891519) | more than 5 years ago | (#27960477)

In the dictionary that ships with Mac OS X:

Security is defined as "the state of being free from danger or threat" and Safety is similarly defined as "the condition of being protected from or unlikely to cause danger, risk, or injury."

Security comes from the Latin securitas or securus "free from care" while safety comes from the salvitas or salvus meaning "safe."

So if there were any real nuance of difference between being safe and being secure, then security would have the edge in meaning over "feeling safe", while safety could be said to imply actually "being safe." But the words are really interchangeable, and how you use them can suggest either.

The real discrepancy that needs to be pointed out between the Mac and Windows is that while Microsoft has recently invested more into building a fancy security infrastructure, Mac users continue to both feel safer and to actually be safer in the sense of being free from danger or threat.

There is clearly no immediate or impending threat to Macs, and there is little in the way of market forces or that wishful thinking pundit invention of "hacker pride" that will result in something to turn Macs into the disaster that has dogged Windows since the late 90s.

What pundits like to do is equate low risk, self-injury actions with high risk, difficult to escape from events. This is straight up misinformation mixed with fear, uncertainty and doubt. For example, nearly everyone is claiming that:

* Downloading iLife warez that pretend to be stolen software
* from a non-trusted source
* assigning it privileges to install on your system
* and then finding that you have installed a background process that does something ugly that you can trivially remove

is the same as:

* Trying to use Windows to browse the web and use email
* finding that you've been automatically infected with adware and viral malware without knowing it
* then finding that your PC is also self replicating attacks or sending spam on to other systems
* then realizing that the design of Windows' registry makes it difficult to clean things out
* then noticing how much of your CPU capacity is being used to protect you from all of these threats via malware and virus scanners
* then finding out how expensive it is to spend hours cleaning up the mess yourself, or alternatively paying some Nerd Patrol $300 to "diagnose" that your PC is hosed.

They are not the same, and only a liar would keep suggesting that Mac and Windows users face the same dangers and threats. If you're paying attention, you'll notice that those who keep suggesting this almost always work for an Anti-Virus company working to make money off of Mac users. This shouldn't require any help in dot connection.

Kaspersky Sells Mac AntiVirus Fear Using Charlie Miller... Mac AntiVirus Foe [roughlydrafted.com]

Re:security vs. safety (0)

Anonymous Coward | more than 5 years ago | (#27961423)

Someone please vote this smart man up...

Re:security vs. safety (1)

Zonnald (182951) | more than 5 years ago | (#27961805)

By your arguments "Trying to use Windows to browse the web and use email" I would have thought in the 21 years since I graduated Uni, 14 years since I started using Netscape or IE 1 on Windows 95, I should have been regularly getting virus from the get go.
This is not the case.
Wish I could prove his to you.
I did go through a period where I regularly ran virus protection and anti-spyware, but could't be bothered to upgrade it on to the next machine, as it usually didn't pick up anything
The majority of my experience with infected machines comes from my friends when their kids start using Lime wire.

Re:So trivial there's only one (1)

mdwh2 (535323) | more than 5 years ago | (#27959449)

but the fact that (as you say) there aren't a proportionate amount to the size of the userbase does seem to imply decent security.

Not at all, that's a non-sequitur. Why are you assuming there would be a linear relationship between users and exploits?

If anything I would think it highly likely to be non-linear - if the vast majority of virus writers prefer to target the most popular platform (which does not seem unreasonable), then that means they choose Windows. That's true whether Windows's market share is 80%, 90%, or 99%, you could still end up with almost all viruses being written for it.

Re:So trivial there's only one (2, Interesting)

nscheffey (1158691) | more than 5 years ago | (#27959667)

I personally haven't heard of any exploit in the wild except the trojan, for which the user has to be willing to provide their password to any old bit of software with unknown providence - to be honest I don't know how one could protect against that on any system.

Luckily, Ivan Krstic knows how. From a CNET article [cnet.com] about Bitfrost:

Instead of blocking specific viruses, the system (Bitfrost) sequesters every program on the computer in a separate virtual operating system, preventing any program from damaging the computer, stealing files, or spying on the user. Viruses are left isolated and impotent, unable to execute their code.

Re:So trivial there's only one (1)

tenton (181778) | more than 5 years ago | (#27960309)

Viruses are left isolated and impotent, unable to execute their code.

I have something in my inbox that can fix the impotency right up. At least that's what says it does.

Re:So trivial there's only one (1)

dhavleak (912889) | more than 5 years ago | (#27960367)

Instead of blocking specific viruses, the system (Bitfrost) sequesters every program on the computer in a separate virtual operating system, preventing any program from damaging the computer, stealing files, or spying on the user.

Yep. This approach is super-interesting. He also claimed that there is a 0% CPU overhead from using this approach and some ridiculously low memory overhead. I forget the number - but I promise you it was ridiculously low :).

This approach also results in an overall reduction (cleaning up?) of IPC mechanisms. So the approach doens't sound free/easy from an engineering standpoint -- it will either require apps to be re-authored or make exceptions for apps that need to use certain IPC mechanisms (or perhaps use heuristics to decide when to permit what).

Viruses are left isolated and impotent, unable to execute their code.

I saw this in the ZDNet/CNet article but I'm not sure if those are Krstic's own words or the author's. My first thought on reading that -- it depends on the 'virtual OS' we're talking about. I mean, is this a sandbox, or is it a hypervisor type thing? I haven't quite wrapped my mind around what are the attack vectors you would use in a scheme like this -- anyone know more about this??

Gotta say -- this sounds like promising stuff. Good to see Apple starting to take action before they go through a Nimda or Blaster type experience.

Re:So trivial there's only one (1)

macs4all (973270) | more than 5 years ago | (#27959203)

Just because there aren't any around

There. Fixed that for you.

A Trojan doesn't count as a vulnerability nor as an exploit; just as user stupidity, from which NO Operating System is safe.

Re:So trivial there's only one (0)

mdwh2 (535323) | more than 5 years ago | (#27959475)

Honest question, why are Apple releasing security updates [slashdot.org] if there are no security exploits in their software?

Re:So trivial there's only one (1)

cicuz (1414125) | more than 5 years ago | (#27959559)

because there might be [one day]?

Re:So trivial there's only one (3, Informative)

macs4all (973270) | more than 5 years ago | (#27959627)

Honest question, why are Apple releasing security updates if there are no security exploits in their software?

Honest answer: Because you are confusing a (theoretical) VULNERABILITY (which ALL OSes have), but which have not been "realized", and an EXPLOIT (which is deliberately malicious code RELEASED IN THE WILD that leverages a VULNERABILITY). The OP and the GP were obviously referring to OS X EXPLOITS circulating in the wild, of which there simply are NONE.

I know it sounds like I'm splitting hairs; but it is a VERY thick "hair"...

Re:So trivial there's only one (1)

mdwh2 (535323) | more than 5 years ago | (#27963593)

Right, fair enough, in which case we're back to the obvious point that no one's bothered to exploit it due to a lack of users. It's not because OS X is free of risks, because we both agree there are vulnerabilities.

Re:So trivial there's only one (1)

obarthelemy (160321) | more than 5 years ago | (#27959867)

for the same reason kids are getting shots against almost-disappeared illnesses ?

Re:So trivial there's only one (2, Interesting)

someonehasmyname (465543) | more than 5 years ago | (#27960241)

>> more exploits being found for OSX than Linux and windows

I don't believe that for Linux, and I certainly don't believe that for Windows.

Face it guys, OS X is built on a BSD userland with the same OpenSSH you all know and love. It uses the same owner/group/others file permissions. It ships with an excellent firewall, and no open ports by default.

IMO, it's as safe as Linux. The smart users will only ever see trojans and home-dir-deleting "viruses", and the dumb ones that type their password will get owned.

The probability of hitting a Mac, and then having the user enter their password into a random unexpected popup is too low for Macs to be a viable target.

Re:So trivial there's only one (1)

v1 (525388) | more than 5 years ago | (#27960811)

it just means there are few malware developers who think it's worth their time.

Because scammers are only interested in BIG payoffs, and would rather go hungry than to merely rip off a minority?

Last I checked, scammers aren't picky about who they take advantage of. They take advantage of anyone they can, every chance they get, however minor.

Re:So trivial there's only one (1)

Zonnald (182951) | more than 5 years ago | (#27961855)

Just wonder... If I was a scammer, wouldn't I just pick up on someone else's work and expand on it, maybe improve it. Why re-invent the wheel?
You can't possibly deny that most of these millions of Windows Exploits are merely derivations of earlier efforts?

Re:So trivial there's only one (1)

Hucko (998827) | more than 5 years ago | (#27962567)

That would suggest that Windows is in even worse shape than we thought. It is bad enough there have been so many attack vectors without adding that they still haven't been fixed in 7 years.

I think you are wrong and there are simply been quite a few, well publicised exploits. Of course that is just an opinion from someone majoring in a different area of using operating systems.

Re:So trivial there's only one (5, Insightful)

ihatewinXP (638000) | more than 5 years ago | (#27958881)

Yeah I would say a citation is needed here. Zero day exploits exist - on every system - but as a Mac user since '99 and a Windows admin since I can tell you no matter the skill level of the user: Macs dont get viruses. Period. Full stop. Yes I saw the embedded trojan in iLife and the zero day sploit that got the guy a free laptop recently but as a person who has really seen a wide cross section of computers and users all the way up to Vista it is decidedly two different worlds.

Im glad Apple dropped the "100% virus free" moniker from marketing as has been pointed out it makes them a target - and good job on hiring forward thinking people in _all_ facets of the business. Now just get ZFS plugged in as the default file system and I will officially drown myself in kool-aid.

And I hate to even point this out but look at the submitters username. If you just got to /. since the mac ads came out you might want to sit back and listen for a few. Years. I know I did.

Re:So trivial there's only one (0, Flamebait)

artor3 (1344997) | more than 5 years ago | (#27959441)

And I hate to even point this out but look at the submitters username. If you just got to /. since the mac ads came out you might want to sit back and listen for a few. Years. I know I did.

Those ads started a few years ago. How much longer must he wait before he is worthy to speak in your presence, oh 6-digited one?

Re:So trivial there's only one (0)

Anonymous Coward | more than 5 years ago | (#27960913)

How much longer must he wait before he is worthy to speak in your presence, oh 6-digited one?

Are you referring to his UID or the number of fingers he has?

Re:So trivial there's only one (2)

phantomcircuit (938963) | more than 5 years ago | (#27959237)

Macs simply do not have enough market penetration to be profitable. That is the only reason that they have less malware.

Re:So trivial there's only one (1)

abigor (540274) | more than 5 years ago | (#27959391)

The number of Macs out there is orders of magnitude larger than the largest botnet. Yet no Mac botnets exist. Why is that?

Re:So trivial there's only one (1)

mdwh2 (535323) | more than 5 years ago | (#27959511)

It doesn't matter, they're still harder to find due to being less common. You're also assuming that a hacker can take over 100% of machines he finds, which is unreasonable. It's not like they just round up the machines, they have to get their malware spread to machines - firstly it's easier to spread viruses with a vastly more common platform, secondly, you have much better penetration. Supposing I am only able to take over 1% of machines I attempt it on - suddenly having to find all those Macs seems a lot more work.

Re:So trivial there's only one (1)

abigor (540274) | more than 5 years ago | (#27961203)

How is it a lot more work? You scan massive blocks of ips and run your remote exploit (which the summary assures us is trivial) against them. As the botnet grows, it joins your scanning/exploiting effort. Even if you got only 1% of all Macs, that would still be completely enormous. You'd think SOMEONE would have tried it by now. But no. So maybe remote exploits aren't so trivial after all.

So maybe we have to resort to other malware. One of the main vectors into Windows is the classic malware-infested web page, which exploits ActiveX. If one in ten desktop are Macs, then those are still pretty good odds for malware writers - your classic porn drive-by would work fine. But strangely, that hasn't happened either.

The old "it's not popular so it's not worth it" argument holds no water, or else less popular but extremely insecure software like IIS would never have been exploited. Instead, it would be Apache that's causing problems. But exactly the opposite is true.

so trivial, to poke holes in your argument (1)

Gary W. Longsine (124661) | more than 5 years ago | (#27962151)

Mac are not "harder to find due to being less common". Windows malware spreads through several means, here are the three most common:
  1. sending email to everyone in your address book
    Malware could trivially examine the email headers, determine which of your friends have Macs, and attach the Mac version of itself when sending email to them.
  2. probing the network for vulnerable ports (worms)
    Malware could trivially fingerprint Macs, scan for vulnerable Mac ports, and send a custom Mac egg through the network connection. (Ed Skoudis described multi-payload worms in his encyclopedic Malware a few years ago)
  3. by infecting a web server, and crawling back down the vulnerable browser Malware could trivially fingerprint the browser, and send custom packages to Safari for Firefox on the Mac when those users connect to an infected web site

So many people who think they know this stuff, and many of whom call themselves "security experts", and yet how don't even take the time to read the literature, study the history, or even take a programming class so they understand what can be done, and what's easy vs. what's hard.

tsk tsk.

And your parent poster was suggesting that taking over 1% of the Macs would create a very competitive botnet. He's right. You're wrong.

Re:So trivial there's only one (4, Insightful)

Mr2001 (90979) | more than 5 years ago | (#27959933)

So trivial in fact to launch an exploit on the Mac, that there's only one in the wild - and that's a trojan in a pirated application.

Cute. Does that mean PC defenders get to ignore all the computers that have been infected by trojans too?

According to that logic, I think we'd find that Windows is nearly as "secure" as OS X. Most infections happen because people are stupid enough to run any program that promises them free smiley-face cursors, not because of vulnerabilities in the OS.

Actually yes, sort of (1)

SuperKendall (25149) | more than 5 years ago | (#27961127)

Cute. Does that mean PC defenders get to ignore all the computers that have been infected by trojans too?

Sort of, I would excuse all of the pirated stuff or things that get in by installing codecs to watch that "Special video". It's stuff that is only going to target a small percentage of users (unless you feel like claiming more PC users pirate stuff which may or may not be true).

Of course PC's also have categories of malware that act as desirable applications from the user to download over the web, and then of course there are thing things like attacks against open ports that we'll not ever see on the Mac (since no ports are open by default to attack so it's a poor vector) and there are no Safari exploits in the wild to install malware like there are IE exploits (though of course that is possible, there just are none).

Re:Actually yes, sort of (1)

Mr2001 (90979) | more than 5 years ago | (#27962011)

Of course PC's also have categories of malware that act as desirable applications from the user to download over the web

Those are called trojans, and we're ignoring those, remember? OS X doesn't stop a user from running a "desirable application" that turns out to be malware either.

(Frankly, I think Windows does more in that regard: you usually have to click through a warning to launch an executable that you've downloaded.)

Mac != OS X --- PC != Windows --- Mac is-a PC (1)

jonaskoelker (922170) | more than 5 years ago | (#27963005)

(*sigh* I hate being the pedantic one...)

I guess the challenge of the Windows ecosystem is what draws in the thousands of viruses and malware applications they get.

I think I fixed that for you.

If by PC you mean x86-based computers not from Apple, then if you install OS X on a Dell box, it would suddenly become malware-ridden according to what you say, right?

And if it's not the operating system, what's the difference---with respect to malware---between an x86 running Ubuntu and an x86 running Ubuntu (one from Apple, one from Dell)?

The "Mac vs. PC" distinction is really about OS X vs. Windows.

I am lost here . . . (-1, Troll)

arizwebfoot (1228544) | more than 5 years ago | (#27958163)

Pray tell the relevance of this article? Or is /. finally going the way of the three head snake or the four footed baby, or my-mother-is-an-alien ala rag magazines?

Re:I am lost here . . . (1, Funny)

Anonymous Coward | more than 5 years ago | (#27958253)

The relevance of the article is that Apple are beginning to close up their back doors, which is amazing and shows restraint on their part.

What's next, marketing to straight people?

Re:I am lost here . . . (4, Interesting)

caladine (1290184) | more than 5 years ago | (#27958353)

Apparently they think now might be a good time to start battening down the hatches. They don't want to make mistakes like they did with the iPhone. Who seriously leaves a JTAG enabled and on the board of a production phone?

Re:I am lost here . . . (1)

macs4all (973270) | more than 5 years ago | (#27959749)

Who seriously leaves a JTAG enabled and on the board of a production phone?

What real good does it do to lock down the JTAG, when you distribute firmware updates via the tubes?

Wow, look at me! I can perform a Boundary Scan, and I can dump out the (compiled) firmware (which I can also intercept during an OS sync)...

Disabling the JTAG interface (by blowing the Security bit on the Microcontroller, I assume) would do nothing at all to make the system more "secure".

Re:I am lost here . . . (3, Interesting)

orospakr (715849) | more than 5 years ago | (#27960625)

How can threats from untrusted code (or vulnerabilities in trusted code) be able to exploit a JTAG header on the board of the device?

Unless, of course, you think that the owner of the device is somehow a "security threat"? I keep meeting people who think this, and I really don't understand it at all...

(actually, Krstic's Bitfrost system is *does* implement some local physical security, but that is to address a very specific threat: theft)

Re:I am lost here . . . (0)

Anonymous Coward | more than 5 years ago | (#27962395)

Who seriously leaves a JTAG enabled and on the board of a production phone?

Uh, like anybody that wants to be able to root cause the bonepile of RMA'd units?

Lots of devices have have at least an unpopulated JTAG header block. And anyone that knows what to do with it is going to have no problem soldering their own to it.

Anyway, that's not any kind of security "mistake." A JTAG port doesn't make the phone remotely exploitable.

Re:I am lost here . . . (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27959527)

The relevance of the article is that Apple are beginning to close up their back doors, which is amazing and shows restraint on their part.

Why would they want to close their back doors? How are they going to have anal sex with their boyfriends after that?

At least... (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27960985)

...gay Mac users actually get laid. :-P

Re:I am lost here . . . (4, Interesting)

chuckymonkey (1059244) | more than 5 years ago | (#27958399)

Let's see here. The guy that invented a good security system (nerd) is hired by a large corporation (news). So far we have nerd and news covered. Now let's see, how does this matter? As macs gain popularity they also garner the interest of people looking to make exploits for them. Apple is trying to head off the tide a little so they can still market as being more secure than their main competitor. Personally I'm a Freebsd/Linux fan, but for all the mac users out there I think that it matters. So there you have it, News for Nerds, Stuff that matters. Or maybe News about a Nerd, Stuff that Matters.

Re:I am lost here . . . (1)

bluefoxlucid (723572) | more than 5 years ago | (#27959109)

Specialized security system, which can be easily evaded by replacing the kernel. kexec() is built into those kernels (I've raised this a few times, I don't think anyone cared) and last I checked (which was several months ago, mind you) it worked if you were root (trivial, no root password). The laptop's refusal to boot an unsigned kernel can easily be handled by an init script that kload()s a new kernel and kexec()s; the software mechanisms in place to protect the laptop are now moot. This is, of course, a simple implementation bug elsewhere, not a specific weakness of the security system itself.

Re:I am lost here . . . (4, Informative)

DragonWriter (970822) | more than 5 years ago | (#27958583)

Pray tell the relevance of this article?

The Bitfrost system developed for OLPC (which is, AFAIK, completely open) is a comprehensive approach to security, data reliability, theft deterrence, and centralized management of computer systems designed for what amount to massive enterprises with extremely non-technical users.

Apple picking up the designer of that system could be seen as an indication of directions they may take in the future. Its "News for Nerds" even if its not entirely clear, obviously, how much it will turn out to be "Stuff that matters".

Re:I am lost here . . . (1)

squidinkcalligraphy (558677) | more than 5 years ago | (#27963201)

Bitfrost is DRM. Open DRM, but DRM nonetheless. It could (is) used to prevent the installation of other OSes on the OLPC (among other things). Reverse that logic to get what Apple might be thinking about here - preventing their OS being installed on non-Apple systems.

One extreme to the other... (1)

smoatigah (1520351) | more than 5 years ago | (#27958191)

From what was meant to be one of the cheapest available laptops, to Apple?!


Bipolar much?

I'll tell you why they hired him (0)

Anonymous Coward | more than 5 years ago | (#27958235)

The only vowels in his first and last name? I and A.

Flamebait summary (4, Informative)

GreyWolf3000 (468618) | more than 5 years ago | (#27958239)

"His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it's rather trivial to launch exploits against the Mac."

Public knowledge? Public knowledge? I doubt the "public" really thinks it's trivial to launch an exploit against the PC.

I feel like I just listened to a 5 year old arguing to another 5 year old... "EVERYONE knows that YOUR operating system IS STOOOPED."

Re:Flamebait summary (0)

Anonymous Coward | more than 5 years ago | (#27958771)

My operating system can beat up your operating system :-P

Re:Flamebait summary (0)

Anonymous Coward | more than 5 years ago | (#27958811)

I feel like I just listened to a 5 year old

Then consider that you didn't, and reach for a dictionary. It's public knowledge -- anyone who wants to know, can know; it's no secret. My phone number is public knowledge -- anyone can look it up. That doesn't mean everyone, or even the general public, knows my phone number.

Re:Flamebait summary (1)

clang_jangle (975789) | more than 5 years ago | (#27959347)

Amusing that the Apple haters who drone on about how "insecure" OS X is don't have any malware they've written for the Mac they can demonstrate. But they sure can blow that hot air!

Re:Flamebait summary (1)

CODiNE (27417) | more than 5 years ago | (#27959137)

I feel like I just listened to a 5 year old arguing to another 5 year old... "EVERYONE knows that YOUR operating system IS STOOOPED."

Why can't his operating system stand up straight?

Re:Flamebait summary (1)

colonelxc (1467119) | more than 5 years ago | (#27961063)

What the summary is referring to is the lack of kernel level protections such as address space layout randomization and the like. AFAIK those are coming in 10.6, but it is still catching up in that regard. Windows, having been (and still is) plagued by viruses, has implemented protections such as ASLR to make it much more difficult for run of the mill buffer overflows to actually turn into an exploit.

It may not be quite "public knowledge" but it is out there [tomshardware.com] (page 4 for the talk about ASLR).

Someone else to hire in addition (1)

elbiatcho1 (1554817) | more than 5 years ago | (#27958325)

Maybe Apple should hire a new SQA/QA director?

Can't we all just get along (3, Funny)

docbrody (1159409) | more than 5 years ago | (#27958431)

Prediction:
This thread will soon devolve into a flaming argument between Apple Fanbois and Apple FanBoi bashers.

I am so tired of both sides arguing about Apple that I wish Slashdot would just remove the Apple section from the site.

let the games begin

Official title is "Apple Hater" (1)

SuperKendall (25149) | more than 5 years ago | (#27961171)

Please keep the nomenclature correct, as it depicts the appropriate level of froth around the mouth.

Removal of the Apple section would sadly not help, as the Apple Hater is persistent and will jump in with negative Apple comments in any context.

Re:Can't we all just get along (0)

Anonymous Coward | more than 5 years ago | (#27961227)

Well, guess I'll say the obvious... Since the articles you don't like are mostly isolated in one section, why not simply adjust your setting so you can't see the Apple articles?

Re:Can't we all just get along (1)

docbrody (1159409) | more than 5 years ago | (#27961529)

good point, but its not the articles i don't like, its the arguments between the fanatics on both sides. But since I took this off topic in the first place, I guess I should bring it back. Personally I think it is great that Apple is making these kind of hires, but I'd its more about the iPhone OS and not the full blown desktop OS X. (iphone, touch, possibly a tablet)

And in other news... (3, Funny)

dave562 (969951) | more than 5 years ago | (#27958479)

Apple execs have put down their glasses of marketing Kool-Aid and joined the real world. They're obviously trying to get out ahead of the potential security holes in their OS, and they recognize that, despite what the fanbois will say, OSX is just as vulnerable as most other topics. Luckily for Mac users, none of the system crackers seem to care about gay porn or graphic design files.

Re:And in other news... (1)

dave562 (969951) | more than 5 years ago | (#27958555)

..vulnerable as most other OSes. (How I got "topics" out of OSes, and why I didn't preview before posting are left up to the imagination of the reader)

Re:And in other news... (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#27959083)

(How I got "topics" out of OSes, and why I didn't preview before posting are left up to the imagination of the reader)

I imagine you were distracted by gay porn.

Re:And in other news... (0, Troll)

dave562 (969951) | more than 5 years ago | (#27959719)

You must be a Mac user if that's the first thing that comes to mind.

Re:And in other news... (1)

markkezner (1209776) | more than 5 years ago | (#27961351)

Well the word "topic" it still applies, as there can be a nasty security hole in anything theoretically. At least that's how I took it until I read your above post. Although, it's probably not the word I would have used in that context.

Ha (5, Informative)

bonch (38532) | more than 5 years ago | (#27958507)

despite public knowledge that it's rather trivial to launch exploits against the Mac.

It's not public knowledge, and the only exploit going around recently was one you had to download in a pirated application. Nice little troll slip in the summary there.

Re:Ha (1)

docbrody (1159409) | more than 5 years ago | (#27958615)

why in the world did you get modded troll for this?

Re:Ha (3, Interesting)

broken_chaos (1188549) | more than 5 years ago | (#27958789)

Someone seems to be methodically modding down any comments that disagree with the submitter.

Re:Ha (1)

H0p313ss (811249) | more than 5 years ago | (#27958849)

Someone seems to be methodically modding down any comments that disagree with the submitter.

Must be the terrorists!

Re:Ha (0)

Anonymous Coward | more than 5 years ago | (#27958823)

Its his signature.

Re:Ha (0, Flamebait)

imamac (1083405) | more than 5 years ago | (#27959227)

The trolling was a quote from TFA, actually. I happen to be be a genuine fanboi.

Re:Ha (1)

imamac (1083405) | more than 5 years ago | (#27959265)

WTF? I just realized that this is my submission verbatim, but it's someone else's name...

Re:Ha (2, Informative)

imamac (1083405) | more than 5 years ago | (#27959273)

Sigh. Nevermind. I'm going crazy.

Re:Ha (1)

Jeff DeMaagd (2015) | more than 5 years ago | (#27959865)

There is a difference between active exploits and security holes. There are very few known active exploits, but there are holes as far as I remember, and given a little time, a hole will be exploited if not patched. I don't think the security hole where a contestant won in a MacBook in a recent Pwn-To-Own contest got fixed. I don't recall that one as requiring the user to run as administrator or root, unlike past Pwn-To-Own contests.

Re:Ha (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27960565)

Well, it's reasonably well known in the security world that OS X has a number of unexploited vulnerabilities, and there have been proof-of-concept exploitations, just not any in-the-wild applications (except for the pirated application you mention). See Mudge Zatko's comments on page 8 of Andy Oram & John Viega's new book *Beautiful Security*, and Charlie Miller cracked Safari in 20 seconds in pwn20wn. I wouldn't call it "trivial," but it's not unbreakable.

That said, I think it would be a stretch to claim that OS X is more crackable than Windows. Maybe, just maybe, more so than Windows 7; and maybe it's a close contest with Vista (which has what, 1/4 the market share of XP?)

I suspect one reason the crackers haven't gone after the Mac more is the barrier to entry - buying a Mac to test exploit code on is a lot more expensive than buying a beige box. With the hackintoshs, that may change soon.

Low hurdle (1)

argent (18001) | more than 5 years ago | (#27958601)

When the competition is Windows, you don't need to be Marcus Ranum or Bruce Schnier to stroll over the hurdles... with crutches.

Good move apple! (1)

Anonymous Coward | more than 5 years ago | (#27959001)

Ivan is a genius! He's an engaging speaker who really knows his stuff. Kudos to apple.

Sick.. (-1, Troll)

Anonymous Coward | more than 5 years ago | (#27959945)

Man, am I sick of all the Microsoft cockroaches spewing FUD all over the net..

Here's a tip.. spend money and time on creating a better product.

Security in lack of numbers (0)

Anonymous Coward | more than 5 years ago | (#27960611)

uhhhhh......the more ground Apple covers and the more marketshare they gain the less trivial security becomes. I would fall just short of calling myself a "fanboy," but I'll be the first to stand up and admit that the Mac's obscurity has been one of its greatest assets. Uhhhhh...down with the Mac!!!(?!?)

Miller... Charlie Miller (1)

not_hylas( ) (703994) | more than 5 years ago | (#27961231)

This ain't the "old days".

The Mac Hacker's Handbook:

http://www.amazon.com/Mac-Hackers-Handbook-Charles-Miller/dp/0470395362 [amazon.com]

- which should be bought, read and placed on the self next to:

Mac OS X Internals: A Systems Approach:

http://www.amazon.com/Mac-OS-Internals-Systems-Approach/dp/0321278542/ref=sr_1_1?ie=UTF8&s=books&qid=1242357309&sr=1-1 [amazon.com]

Apple's security wasn't an accident, but then neither was Microsoft's - a real go-er.

Nudge, nudge, wink, wink.

http://www.youtube.com/watch?v=jT3_UCm1A5I [youtube.com]

Yes.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>