My Thoughts ... : Security

IBM Reports Apple #1 in Reported Security Vulnerabilities

Donnie Wilemon — Thu, 07 Aug 2008 18:49:31 GMT

Infoworld is reporting that a new IBM security study is showing Apple as the #1 provider of security vulnerabilities. Final results were close, according to the IBM X-Force 2008 mid-year report , with Apple achieving vulnerability disclosure score of 3.2 percent, followed by Joomla (open source) with 2.7 percent and Microsoft at 2.5 percent. Internet Explorer and Mozilla Firefox browsers had a marked drop in critical vulnerabilities from 2007. Both browsers had six memory corruption vulnerabilities, down from 20 and eight respectively in 2007, however Firefox fell short of it's rival with one security zone bypass, and a single miscellaneous vulnerability. Firefox had 11 security zone bypass and four buffer overflow flaws in 2007.

Microsoft More Reliable for the Enterprise in Update Services

Donnie Wilemon — Fri, 11 Jul 2008 23:30:24 GMT

A company that measures Internet service reliability has given Microsoft the top score in a test of operating system update services.

Microsoft's Windows Update was available 100 percent of the second quarter of 2008, Pingdom said in a blog posting Friday. Apple's service was down 2 hours and 34 minutes, with 99.9 percent uptime, and Canonical's Ubuntu version of Linux was down 1 day, 5 hours, and 45 minutes, for 98.64 percent uptime.

>> "Microsoft wins this one hands down," Pingdom said.

The company tested the three services every five minutes.

iPhone Vulnerable - Lacks Security Updates, Doesn't Want to Talk About it ...

Donnie Wilemon — Sun, 06 Jul 2008 03:00:49 GMT

Robert Vamosi reports on his news.com site that Apple has not kept the iPhone operating system up to date with patches it has issued for the desktop. The iPhone runs a stripped-down version of Mac OS 10.5 and automatically checks for security updates. The last update for the phone, 1.1.4, was issued in February. That means iPhone users are still vulnerable to a flaw discovered by Charlie Miller in March - that's 4 months ago for those of you who are counting. I guess the most telling piece of information from Vamosi, apart from the fact that Apple hasn't updated this greatest and most innovative piece of hardware the world has ever seen (sic), is his last sentence ...

>> "Apple does not respond to requests for comment on its software security policies ..."

How nice must this be ? When did the rules change ? I didn't know this was an option ! Don't even talk to me about "enterprise ready" and Apple. I want the same set of rules applied to them that everyone else, including Microsoft, has to play by. How many times has Windows Mobile had to jump through every security hoop in the universe to justify a proof-of-concept inside a particular company, but the iPhone/iMac/i-whatever can just glide in on pure marketing and never have to prove a thing. Microsoft has a completely transparent message about our security processes and communicates them regularly to our customers and the press as part of our "Trustworthy Computing" initiative ... on the other hand you have Apple, which "does not respond to requests for comment on its software security policies". Makes me think that they don't have any "software security policies" other than to just patch stuff whenever they get around to it.

Why doesn't the "professional IT media" begin holding their feet to the fire on this stuff a little more ? Why the continued pass ??

'Get a Mac ... it Just Works' Indeed - Apple Patches 25 Flaws with Latest Update

Donnie Wilemon — Tue, 01 Jul 2008 06:52:59 GMT

I guess this is the "And then some" part ... Apple today released TWENTY-FIVE (25) updates for the Mac OS (10.5.4) and Safari (3.2.1) browser (and some networking hardware) - THIRTEEN (13) of which are security related. Fixes/enhancements/vulnerabilities were littered across the products and include alias manager, CoreTypes, c++filt, dock, launch services, Net-SNMP, Ruby, SMB File Server, System Configuation, Tomcat, VPN, and WebKit. This is across processors and client/server scenarios, but, nonetheless, do the math below - unless I'm mistaken, that comes to approximately 2GB. Not as easy at it looks or advertises, huh Steve ?

Seriously - creating and maintaining a full-featured and powerful operating system for today's computers is not an easy or perfect process. The lengths that Apple goes to in their advertising to persuade the general public that they can become immune to the various trials and tribulations of personal computing if they buy a Mac because it "it just works" is misleading at best and false-advertising at worst IMHO. This speaks for itself ... updates/patches/fixes are a way of life regardless of the platform - no company is excluded. See how stable and/or secure your Mac is if you ignore a couple rounds of these updates ...

Microsoft Home Environment Pointers using Windows Vista Media Center

Donnie Wilemon — Fri, 06 Jun 2008 07:01:00 GMT

I’ve received a few questions about how I do things with my ever-maturing home environment and thought it might be useful to share a few things … I would also very much like to hear from others who might’ve done things better or differently. That said, I’ve actually finally got things hooked together pretty well and thought others might like to skip the learning part I endured and move straight to something that works J …

Features …

1. Centralized File & Print (Windows Server, Windows Vista)

2. Centralized Media Sharing & Distribution (Windows Vista, Windows Media Center)

3. Well-managed Desktops (Windows XP, Vista, Windows Server, Windows Live OneCare)

4. High-speed Internet, Wireless

5. High-speed Internet gaming, IPTV/VOD (Xbox 360s, Xbox Live)

6. Backup & Restore (Windows Live OneCare)

7. Archiving & Disaster Recovery

8. Desktop Anti-Virus, Malware, Tuning (Windows Live OneCare)

Centralized File & Print, Media Sharing …

Although I’m running Windows Server 2003 R2 to handle the desktop management via group policies & Active Directory, I decided to centralize documents on another dedicated system running Windows Vista Ultimate (a lid-down notebook PC; accessed “headless” via Remote Desktop), mainly due to the fact I frequently test and change settings that require reboots on the Windows Server and do not want to impact up-time for the rest of my household. The centralized family documents are in shares available over the network in a hierarchy which represents my family members names. Permissions are enforced accordingly for appropriate access and administrative functions. This gives the kids their own area to store files, pictures, etc centrally and be able to get to them anywhere on our network … they are also automatically backed-up nightly.

Centralized Media Sharing & Distribution …

Windows Vista Ultimate also includes Windows Media Center, which I use to host my household media including digital pictures, videos (home movies, etc) and music. We can upload pictures from our digital cameras, etc from any PC to be stored either in our own PICTURES folder or we can copy/move them to a peer folder in the Media Center file structure. Media Center could be configured to monitor these folders to automatically add pictures, but we prefer the staged approach to make sure we don’t get dupes, etc. We use Windows Movie Maker to import home movies off our Mini-DV digital video camera. We have an extensive music library where we’ve ripped music off owned-CDs, and I’ve loaded the Zune software on the Windows Vista Ultimate system so we can sync DRM music as well. We are able to access all the media from the Windows Vista Ultimate PC itself, the playroom LCD TV or the den/media-room’s HD DLP, both of which use the Media Center Extender functionality of the 2 Xbox 360s.

Well-Managed Desktops …

Using Windows Server 2003 R2 as a server and DC in my home AD forest to manage 3 home PCs via group policy. The policies aren’t too elaborate, but lock-down the kids systems to keep them from messing things up J, and then sets the various file/share-pointers for personal documents, pictures, etc.

Networking (High-Speed Internet, Wireless, etc) …

I have Comcast’s business-class offering which provides 8MB downstream and 2MB upstream, although I almost always get 10-13MB down. This also provides me with 5 dedicated public IP addresses, which comes in handy for my hosted public domain and various other server testing & evaluation. They provide a multi-port switch which is also helpful in connecting the various devices or servers. I have a 802.11n WAP NAT’ing my internal network and providing DHCP; I’m using a wireless repeater to boost the signal of my wireless coverage in the areas of my home farthest from my WAP. The wireless is plenty fast for most activity, but something more reliable and less latent is needed for Internet gaming (Xbox Live), IPTV/VOD and streaming media from Media Center … to accommodate these needs, I’ve installed a few “Ethernet-over-power-line adapters” from Sling. These are extremely easy to install, pretty inexpensive, and surprisingly fast. I use these to interconnect my Xbox 360s for Xbox Live Internet gaming, IPTV/VOD and for streaming rich media from the Windows Media Center. When I tried to use wireless bridges to achieve this same functionality, it was spotty at best and mostly unusable. Lastly, also using Vonage (VoIP) for my home telephone service.

High-speed Internet gaming, IPTV/VOD via Xbox 360s & Xbox Live …

As mentioned earlier, 2 Xbox 360s connected to HD monitors via HDMI (one cable for video+audio, simple and clean) … both systems connected to the high-speed Internet connection over the Sling devices. Performance is excellent even with both 360s playing simultaneously with multiple gamers. Due to the excellent network connectivity, we’re also able to take advantage of Xbox Live’s full offerings around IPTV and VOD (video on demand). If you haven’t checked out the media options available from the Xbox Live Marketplace, it’s getting more exhaustive and entertaining. I’ve downloaded multiple movies (some in HD), TV shows, game trials, etc. on both systems. Also using the Xbox 360s as Media Center Extenders to access our family library of digital pictures, movies and music, not to mention the IPTV content from MSN. I also have a Slingbox connected to the network and Comcast cable-TV feed so I can view live television from any Internet-connected PC in the world or from my Windows Mobile phone.

Backup & Restore …

With all my family documents, digital pictures, videos, etc centralized and growing daily, backing up family memories and information is getting more important, so I wanted to have a couple of backup strategies. Past the shadow copy functionality in Vista, I connected a USB-attached, external 1TB hard drive where I have OneCare doing automated, nightly backups (among other things). In addition to the centralized system, I have OneCare loaded on the other household PCs backing up (over the wire to the 1TB drive as well) any documents that someone might’ve accidentally saved locally.

Archiving & Disaster Recovery …

To address the situation of a disastrous event in my home that could destroy not only my “server” containing my digital archives of family memories, but also the external drive with the backups, I am using an off-site backup service from Carbonite. The service installs a small client on your system (my central Windows Vista Ultimate “server”), then you easily define the folders/files you want encrypted and then backed-up over the Internet to their off-site repositories. The unique aspect of Carbonite compared to other services I’ve seen is that they have no disk space limits ! It took a while (almost 45GB !), but I ran an initial backup with the service and now have immediate off-site backups for all of my centralized documents and media. From this point, the backups are only differentials. The interface is “right-mouse-button” aware and very intuitive.

Desktop Anti-Virus, Malware, Tuning …

I am using Microsoft OneCare for all my systems in regard to anti-virus, malware, first-line backup/restore and performance tuning. You can load the software on up to 3 systems and then manage the alerts from the “hub” PC via a Windows Live account. This is perfect for monitoring the kid’s PCs for needed updates, problems with backups, etc. You can also use OneCare as a gateway to manage/control your kid’s Internet access through Windows Live OneCare Family Safety, which provides parents with ways to lock-down access, review usage reports, approve access requests from the kids centrally, etc etc.

That’s about it … if anyone has any questions or suggestions on something I’m overlooking or how I could improve things, I’m all ears !