Linked by Thom Holwerda on Tue 21st Feb 2006 17:59 UTC
Mac OS X "[Last week], we reported on a Trojan horse for Mac OS X that is just like the entry for Earth in the Hitchhiker's Guide to the Galaxy in that it is mostly harmless. A new vulnerability targeted at Apple's home-grown web browser, Safari, is another matter entirely. A German security firm appears to have been the first to discover the Safari flaw, which allows for shell scripts to be executed after clicking a link."
Thread beginning with comment 97891
To read all comments associated with this story, please click here.
Look below the surface
by elsewhere on Tue 21st Feb 2006 18:33 UTC
elsewhere
Member since:
2005-07-13

This will be dismissed as not being a serious flaw for those not running as admin, or having disabled the default setting for running safe items.

And on it's own, it's probably true. But if this were combined with one of those privilege escalation flaws that until now were dismissed as minor because they couldn't be executed remotely, it could be something bigger.

I'm not going to criticize OS X, but I will say don't take security for granted. Don't assume a false sense of security and brag about Apple's track record for security because, frankly, they've never been tested. The true test will be a combination of how many inherent vulnerabilities are found once people put their minds to finding them, and how quickly (and responsibly) Apple responds to them.

That earlier flaw with the widgets, now this, may be easily dismissed and fixed with simple settings changes etc., but that's not the point. Microsoft has learned some valuable lessons about the impact of default settings on security, among other things, and they're still wrestling with it. I would hope Apple (and *nix et al.) take this into account and don't learn the hard way as well. Assume the worst and account for it, don't bank on the common sense of your users.

Reply Score: 4

RE: Look below the surface
by Soulbender on Wed 22nd Feb 2006 05:20 in reply to "Look below the surface"
Soulbender Member since:
2005-08-18

"This will be dismissed as not being a serious flaw for those not running as admin, or having disabled the default setting for running safe items. "

malware dont need root privs to participate in botnets/drone armies or to read your private data.

Reply Parent Score: 1