The old adage about there being “safety in numbers” no longer applies, at least not in the world of IT security. Microsoft platforms are not only the most widespread, but also the most attacked. About that much, most — but not all — commentators agree.
The mi2g Intelligence Unit, a UK-based security consultancy, issued three bulletins recently. One suggested that direct attacks — as opposed to worms or viruses — on Linux-based servers were on the rise and had for the first time outstripped those directed at Microsoft platforms. Microsoft systems were still found to be the major targets of malware.
An equally interesting claim came next: After examining more than 17,000 attacks in January and again in February, mi2g Intelligence Unit concluded that when it comes to direct attacks, “the world’s safest and most secure online server operating system is proving to be the Open Source family of BSD (Berkley Software Distribution) and the Mac OS X based on Darwin.”
Several Questions
Several questions suggest themselves immediately: Is it true, how do you know, and can any such judgment even be meaningful?
The third question must be answered before tackling the others, and Laura DiDio, senior analyst at the Yankee Group, suggested that the answer is no. “Overall,” she said, “no operating system or piece of software is going to be inherently more secure than another.”
She said she agrees, however, with the parts of mi2g’s reports that attribute greater Linux insecurity to administration woes. They cite a widespread lack of “training and knowledge on how to keep that environment secure when running vulnerable third-party applications.”
“You could have a very fortress-like system,” DiDio told TechNewsWorld, “but all that security goes to hell in a handbasket if it is not administered correctly. The human element cannot be discounted. I would say that’s 51 percent of the equation to 49 percent inherent security.”
Safe Foundations?
Even if that’s true, and even if no operating system can be made completely secure, mightn’t some be safer than others at the fundamental design level? Richard Forno, security consultant, author and former chief security officer at Network Solutions, thinks so.
While he expressed skepticism about mi2g’s methodology and what he sees as a tendency toward sensationalism, he agreed that the Mac OS is intrinsically a safer architecture. “It’s much more compartmented,” he noted.
He said that unlike on Windows, applications installed on OS X don’t patch the kernel at low levels. This is, he has suggested, “something Microsoft unfortunately can’t accomplish without a complete rewrite of the Windows software — starting with ripping out the bug-riddled Internet Explorer that serves as the Windows version of ‘Finder.'”
He added that, “At the very least, from the all-important network perspective, unlike Windows, Mac OS X ships with nearly all Internet services turned off by default,” and “unlike Windows, Mac OS X requires an administrator password to change certain configurations, run the system updater and when installing new software.”
What about other non-Windows platforms? “OS X, as you probably know, is based on FreeBSD, so it’s got Unix underpinnings, which is good. Unix, Linux, they’re all about the same. NetBSD, I think, is specifically designed to be hardened.”
OS X, he conceded, is not without vulnerabilities. “We never used to see these prior to OS X,” Forno observed. “To my knowledge, the security issues affecting Mac OS X for the most part have been, for instance, a vulnerability with Apache or FSL — things that hearken [back] to its Unix underpinnings. Welcome to the world of Unix.”
Security by Obscurity?
Mi2g’s conclusions appear to be based on the raw numbers of attacks in its 17,000-plus sample. With BSD and Mac OS representing only a tiny fraction of installed systems, the number of attacks on these systems is obviously low.
A more sophisticated analysis surely would relate the raw numbers to each system’s user base. This is a much-argued point: Is Windows attacked so much because it is far and away the most prevalent platform? Do BSD and OS X appear safer because they are, as niche players, less targeted?
“According to our research, attacks on Mac OS systems are less pro rata than what would be expected by solely taking the ‘security by obscurity’ issue into account: Fewer vulnerabilities pro rata have been announced for Mac OS X than for other operating systems,” an mi2g spokesperson told TechNewsWorld.
“However,” he added, “a system running Mac OS X with applications that have glaring vulnerabilities will still draw a lot of successful attacks from hackers.”
The Yankee Group’s DiDio gives more credence to the “obscurity” argument, although her take on the issue does include malware vulnerabilities in addition to the denial-of-service attacks or other direct attacks measured by mi2g.
“In today’s networked environment,” she noted, “the most important parameter is the popularity and connectivity of the operating system. In that sense, Windows is the number one target. They’ve got 94 percent on the desktop; 66 percent of servers. And you’ve got a lot of interconnected networks globally.”
High Degree of Connectedness
It is in that high degree of connectedness, she feels, that the greatest potential for damage lies: It only takes one or two successful local attacks for damage to spread quickly to a much wider area. For the time being, she said, Linux has an apparent advantage simply by virtue of a lower level of connectivity.
But, she added, “I have spoken to sophisticated Linux proponents running all-Linux environments who have been alarmed at the recent increase in Linux-specific hacks that have cropped up even in the last four to six months.”
She went on to say there are differences between Windows hacks and Linux hacks that can make the latter “fairly dangerous and more difficult to initially pinpoint,” mainly the fact that many attacks can propagate automatically without the need for human interaction, such as opening an e-mail attachment.
“Forget about the OS,” DiDio concluded. “Don’t even argue those merits. Every piece of software that is connected is potentially vulnerable and at risk.”
Loading ...
"…,DiDio concluded. "Don’t even argue those merits. Every piece of software that is connected is potentially vulnerable and at risk." I agree that human error will continue to render systems unsecure, any connected system could be probed or receive DOS attacks and systems running applications that have glaring vulnerabilities will be vulnerable.
So what is the point in saying something so glaringly obvious akin to "people who stand in the rain are likely to get wet, even if they have an umbrella?
In practice, Mac OS X 10.3.3 is the most secure system for mass market personal computers and servers, when compared to other OS such as Microsoft XP. This is a fact which has nothing to do with "obscurity", but all to do with OS architecture and built-in software firewalls.
I won’t deny there are vulnerabilites with Mac OS X, but most of these concern theoretical threats for certain configurations in very specific settings and they are patched more swiftly by Apple than any on XP by Microsoft.
Over 60’000 assorted "Windows" viruses compared to zero Mac OS X virii speaks volumes. There will surely be a Mac OS X virus in the future, probably based on some applescript that some dumb user will choose to install and expressly authorise on his system, but there is not much inherently insecure with Mac OS X.
In summary, I completely disagree with DiDio. Either she demonstrates a lack of expertise or the article was badly written, stiching out-of-context citations together for pure sensationalism.
I have to agree with Clue Giver – there has never been a breach of Mac OS X so it IS the definitive secure OS. But, the IT world MUST use the specious and flimsy argument about how little Mac OS X is used because otherwise, they look like bleeding idiots for having spent the billions they spent on Windows and Microsoft Server.
IT professionals are the ones that made the choices, spent the money, got on the MS band wagon so any admission about Microsoft being a bad OS as opposed to being a security risk due to its ubiquitous position would just confirm their status as the AM ateurs most of them are. So, you will never see anyone in the IT community come out and say that Mac OS X is a better OS than Windows because it would not serve their personal interest or credibility.
Remember as well that the inherent problems with Windows are GOOD for the industry – it expands and grows to control the problems. But the real value-add parts of business suffer because IT commands so much investment now just to keep it secure and operating.
Remember the 2000 date issue? Macs didn’t have that problem. Billions had to be spent the world over because IT professionals had no vision in the 60’s, 70’s and 80’s to ensure that the turn of the century wouldn’t stop computers around the world.
Mac OS X is still very insecure by design, because of its lack of proper permission compartmentalization and propagation. In Mac OS X (as well as in Linux, Windows and the BSDs) every program you run can still do whatever you (as a user) can. This means that a little game you download and run can read all your files, including your address book, your love letters and any other secret files (perhaps some browser cache containing your visa number), and send it over the internet. In a properly designed system (e.g. KeyKOS, EROS) this would never happen.
Bill Gates, Steve Jobs and other equally clueless monkeys apparently don’t realize the obvious fact that programs aren’t either "completely trusted" or "not trusted at all", but almost always something inbetween. Some programs are trusted for some things and other programs for other things. (E.g. the editor used to compose those love letters is not trusted to access the network at all, and the game you downloaded isn’t trusted to read any of your documents.)
>
> Mac os x has NEVER had a virus nor breach so that makes
> it INFINITELY more secure than anything else, PERIOD.
>
Is that sarcasm? By that logic any obscure OS that no one uses would be equally secure, because none of the very few users using it have written a virus for it or tried to break into it. This is of course nonsense. The level of security is what it is regardless of how many successful or unsuccesful attempts there have been to break it.
If you want to know real security I suggest you look up basic info on capability-based security and POLA.
I assume this is meant as a joke article? No!
If it’s supposed to be serious then it’s a farce. Pure FUD. A pack of lies. Worthy of Iraq’s information ministers derision.
If an OS gets all the viruses and is perpetually broken into millions of times a day – Windows anything – then it is inherantly and in Windows case utterly insecure. Anyone who has a passing familiarlity with Windows knows it is unfixable as is and can only begin to have some security by starting from scratch with virgin code and no Microsoft coders. So enjoy the trip because as long as you use Windows you are 100% screwed. All the FUD you are shoveling on other OS here are simply a pack of lies.
Linux is much more secure than Windows and has less successful breaches by a few orders of magnitude than Windows anything.
Mac os x has NEVER had a virus nor breach so that makes it INFINITELY more secure than anything else, PERIOD. Its been in use by tens of millions for several years and still nothing. Lying doesn’t change those facts.
You can make all the felicious arguments about how many morons you can get to repeat your lies while sitting on the head of a pin, but in the end in practice the FACTS are:
1. Windows = 100% certainty of breach in very short period of time, like days or more likely minutes.
vs
2. Mac os x = no beaches EVER of any kind in tens of trillions of attemps, perpetrated on ten million computers over several years.
If this logic escapes you, if its truth isn’t self evident, then you’re one of the morons shilling for this article or you haven’t the competance to use a keyboard.
Clue Giver
Because someone has to help the clueless