Mac OS X Security Myth #3: Mac OS X Has More Security Designed In

Jeff Jones Security Blog — Sat, 13 Jan 2007 04:20:20 GMT

Following up on Mac OS X Security Myth#1 (fewer vulns) and Security Myth#2 (nobody attacks), this post

Mac OS X Security Myth #3: Mac OS X Has More Security Designed In

Jeff Jones Security Blog — Sat, 13 Jan 2007 04:20:59 GMT

Following up on Mac OS X Security Myth#1 (fewer vulns) and Security Myth#2 (nobody attacks), this post

re: Mac OS X Security Myth #2: Nobody Attacks Mac OS X

PCSA — Sun, 14 Jan 2007 21:48:50 GMT

Jeff, while your point is a valid one -- no OS is 100% secure -- I'm curious as to your thinking here. Site defacements are certainly annoying and costly, and they certainly represent a security breach, but they are not necessarily OS attacks. One of my sites was defaced a couple of years ago, and the culprit was a PHP script someone was using that had a privilege escalation flaw. Some of the blame was also on Apache, and by extension OS X Server, which comes with Apache, but still, the OS itself had nothing to do with the attack. It would have worked on any platform, including Windows.

So, did you examine each of the attacks in those 50 pages of matches to see what the details of the attack were before trusting the claim that it was a compromise in OS X?

Also, each of these was an attack on a server. The majority of attacks these days are on clients, whether it's identity theft or creation of botnets. Now I'm no zealot. I know a Windows machine can be as secure as a Mac if it's properly maintained, but I can tell you from hard experience that this is beyond the ability of most Windows users. A network is only as secure as its weakest link.

Now when you list the number of security flaws in OS X (quite fairly, you note that they all count, since it's all bundled software) you point out that the covered CVEs numbered over a hundred two years in a row. Is that a few? A lot? There's no context. How many similar vulnerabilities were patched in Windows/Office those two years? More or less? How about Linux? Were all the vulnerabilities critical? What percentage of them were, by platform?

Now maybe those questions aren't really fair. They ask you to do a lot more work than would be reasonable for a blog post. But then again, security is not simple, so we should try not to simplify it to the point of uselessness.