Mac easiest to hack, says $10,000 winner

[rdale]

http://www.computerworld.com/action...articleId=9072959&taxonomyId=89&intsrc=kc_top

March 28, 2008 (Computerworld) The security researcher who walked away with $10,000 yesterday by hacking a MacBook Air in less than two minutes said he chose to attack Apple Inc.'s operating system for one simple reason.

"It was the easiest one of the three," said Charlie Miller, a principal analyst with Independent Security Evaluators (ISE), a Baltimore-based security consultancy. "We wanted to spend as little time as possible coming up with an exploit, so we picked Mac OS X."

The MacBook Air was running the most current version of Mac OS X, 10.5.2, with all the latest security patches applied. The other two computers, a Sony Vaio VGN-TZ37CN running Ubuntu 7.10 and a Fujitsu U810 notebook running Windows Vista Ultimate SP1, were also up-to-date and fully patched.

Wow, maybe they should rename Safari... too jungle-like.

 

[zoziw]

Vista got hacked via an Adobe Flash exploit the next day.

Linux wasn't hacked, there were bugs found but no one was interested in putting in the effort to write the exploit code.

PC World

Official contest site:

TippingPoint

In other news, MS patches bugs quicker than Apple.

They analyzed 658 vulnerabilities affecting Microsoft products and 738 affecting Apple. They looked at only high- and medium-risk bugs, according to the classification used by the National Vulnerability Database, said Stefan Frei, one of the researchers involved in the study.
What they found is that, contrary to popular belief that Apple makes more secure products, Apple lags behind in patching.
"Apple was below 20 [unpatched vulnerabilities at disclosure] consistently before 2005," Frei said. "Since then, they are very often above. So if you have Apple and compare it to Microsoft, the number of unpatched vulnerabilities are higher at Apple."

PC World

 

[MrJim]

...and the moral of the story is I should go back to my pc with the daily virus/spyware scans, wrestling with antivirus/antispyware sofware (hmm, should I continue with Zone Alarm or maybe buy some~is AdAware and SpyBot going to catch everything~maybe I should go to FileHippo and see if there is anything new today), continual checking for virus/spyware updates instead of continuing with this little mac mini I got in Nov 06 that with only the stock firewall have had no virus/spyware issues, scanned twice in 17 months with no malware?

Think I'll keep it, and when~yup when~someone decides they are going to become famous for the first BigMacAttack Virus(tell me that wouldn't be a cool virus name ) them I'll go back to doing what I used to.

 

[peanutbutter12]

I always find it amusing that people bring up the virus issue with Windows. It's been years now since I've been infected with a virus. I have my little virus scanner that scans every day automatically while I'm at work or sleeping, and my virus vault and reports have both been empty... as for firewall, I have no need for it. Windows built in firewall and the one built in to my router are more than enough for protection. Nor do I use adaware or spybot. I have no need for them.

People need to wake up and get rid of old stigmas that Mac still forces people to believe in their marketing ploys. :\

Yes, viruses still exist. All it takes is a brain to prevent from getting infected and not opening every .exe that comes in your email.

 

[MrJim]

I always find it amusing that people bring up the virus issue with Windows. It's been years now since I've been infected with a virus. I have my little virus scanner that scans every day automatically while I'm at work or sleeping, and my virus vault and reports have both been empty... as for firewall, I have no need for it. Windows built in firewall and the one built in to my router are more than enough for protection. Nor do I use adaware or spybot. I have no need for them.

People need to wake up and get rid of old stigmas that Mac still forces people to believe in their marketing ploys. :\

Yes, viruses still exist. All it takes is a brain to prevent from getting infected and not opening every .exe that comes in your email.

My point still stands~I currently live in "No Worries" land, and it's nice to not have to deal with the malware. I remember with the ol' compaq I used to think that all I did was scans, though some of the that had to do with being on dialup the first year and waiting, waiting, for updates to to download and scans to get done.

I do plan on getting the compaq back onto the net, just been putting it off. And someday I'll be back in pc land; I'd like to try to build a computer someday when my son is a little older. But for now "No Worries" land is pretty sweet.

 

[zoziw]

I always find it amusing that people bring up the virus issue with Windows. It's been years now since I've been infected with a virus. I have my little virus scanner that scans every day automatically while I'm at work or sleeping, and my virus vault and reports have both been empty... as for firewall, I have no need for it. Windows built in firewall and the one built in to my router are more than enough for protection. Nor do I use adaware or spybot. I have no need for them.

Agreed! I have not had a virus on any of my PCs or any of my families PCs since at least XP SP2.

For pretty much an entire decade I didn't hear anyone talk about Macs. About three years ago, people like me who have at least some tech knowledge started checking them out and praising them for a number of reasons, like security.

What is really going to damage Apple's security image is the next phase in their comeback and that is people moving to Macs who basically refuse to learn or observe even basic safe computing practices.

They will move to a Mac and get burned by an email phishing attack the next day and eventually fall victim to trojans that remind the user that Macs are overly sensitive and entering their admin password to view the "picture" attached to the email is just a formality.

 

[MrJim]

Agreed! I have not had a virus on any of my PCs or any of my families PCs since at least XP SP2.

For pretty much an entire decade I didn't hear anyone talk about Macs. About three years ago, people like me who have at least some tech knowledge started checking them out and praising them for a number of reasons, like security.

What is really going to damage Apple's security image is the next phase in their comeback and that is people moving to Macs who basically refuse to learn or observe even basic safe computing practices.

They will move to a Mac and get burned by an email phishing attack the next day and eventually fall victim to trojans that remind the user that Macs are overly sensitive and entering their admin password to view the "picture" attached to the email is just a formality.

Yeah, I can see that happening~AND as I said earlier some enterprised young fellow will create the bigmacattack virus and become famous

Never seen a trojan like you described~will remain vigilant

 

[pgp_protector]

I always find it amusing that people bring up the virus issue with Windows. It's been years now since I've been infected with a virus. I have my little virus scanner that scans every day automatically while I'm at work or sleeping, and my virus vault and reports have both been empty... as for firewall, I have no need for it. Windows built in firewall and the one built in to my router are more than enough for protection. Nor do I use adaware or spybot. I have no need for them.

People need to wake up and get rid of old stigmas that Mac still forces people to believe in their marketing ploys. :\

Yes, viruses still exist. All it takes is a brain to prevent from getting infected and not opening every .exe that comes in your email.

But it's funner to complain about the Evil Micor$oft

 

[MrJim]

But it's funner to complain about the Evil Micor$oft

It's happenin less though~lastest issue of MacWorld has big review on the Mac version of Office~the lines are gettin' blurry

 

[MrJim]

...and something else~MS didn't create software to run Mac OS, but BootCamp/Parallels was created to run MS-appears that Mac users need Windows and not the other way around

 

[pgp_protector]

...and something else~MS didn't create software to run Mac OS, but BootCamp/Parallels was created to run MS-appears that Mac users need Windows and not the other way around

Yea I've noticed that.

Even (some) Linux users have Dual Boot Systems (Linux and Windows )

 

[MrJim]

Yea I've noticed that.

Even (some) Linux users have Dual Boot Systems (Linux and Windows )

Hanging around and learning from you PC guys has corrupted my harddrive

 

[peanutbutter12]

If it wasn't for the lack of drivers and compatibility with programs, I'd be on Linux right now.

 

[pgp_protector]

If it wasn't for the lack of drivers and compatibility with programs, I'd be on Linux right now.

Drivers are not too much of an issue for my system.

For me though I'll admit

I like my games, and Tux Racer just doesn't cut it

 

[zoziw]

Never seen a trojan like you described~will remain vigilant

That is my point, people like you and I are going to be vigilant and likely will avoid problems.

About 3 years ago people like you and I gave Macs a first (or second) look and liked what we saw. In my case, I picked up a MacMini and an iBook...love them both.

As a general rule, we were security hardened tech savvy people who had just gone through the pre-SP2 days of XP.

Even if a real threat had emerged for OS X, we likely would not have have fallen for it.

The place I work is largely made up of people with at least average IQs and most have at least undergraduate degrees, these are not dumb people, however, they continually refuse to either learn or observe even basic internet security guidelines to the point where our IT department had to pretty much lockdown our boxes because they were wasting too much time cleaning up malware and viruses from these users' computers. As you probably guessed, this is an XP environment.

These days it is difficult to use the internet for even work related reasons as many webpages causes IE to crash because of the draconian security installed by our IT department.

That there have been more problems with XP than with OS X is a given.

The problem Apple faces is that the next phase of switchers are the click happy people at work who refuse to learn and take the steps that people like you and I do to protect themselves online.

If one of these people bought a Mac this afternoon and started surfing with Safari, they would be at a greater risk of falling victim to a phishing attack than if they had purchased a Vista machine and were using IE7.

Let's call a spade a spade, the problem is largely human and going forward probably will continue to be so.

The problem for Apple is that these people are headed for the Mac and: Apple is slower to patch exploits than MS, Apple does not have as strong of an anti-phishing strategy as either MS or Mozilla, people will blow through the Apple admin password prompt as quickly as the Vista UAC prompt to look at that "picture" and one of the big selling points of the Mac has been that you don't need to run antivirus software.

Apple's marketing department and a large number of its user base are going to end up doing untold harm to the brand if they don't start preaching security to these incoming users.

I don't know when the first big trojan will hit OS X but the exploits are there and the percentage of security ignorant Mac users grows daily. When it hits, these people won't even have the protection they are use to having due to automatic antivirus security updates.

 

[Sketcher]

A swing and a miss for security by obscurity.

 

[peanutbutter12]

Drivers are not too much of an issue for my system.

For me though I'll admit

I like my games, and Tux Racer just doesn't cut it

I run studio equipment on mine so drivers are a necessity.

I also love my games.

 

[MrJim]

http://christianforums.com/t7094634-attention-msn-virus.html

speak of the devil~something going on with "msn virus"?

 

[pgp_protector]

http://christianforums.com/t7094634-attention-msn-virus.html

speak of the devil~something going on with "msn virus"?

Had Messenger open all day, nothing , nada , zip, zilch.

 

[MrJim]

HA just experienced my first mac crash this evening~with help from a fellow at another forum I frequent I rebooted from the disc and reinstalled osx, and everything came back up~gotta do some checking for the cause, kinda scary seeing mac's "gray screen of death"