What is the big picture when it comes to Apple security? Is OS X safe enough to be a viable contender for running public Web sites and general enterprise applications? Read the article at NewsFactor.
How Secure Is OS X?
About The Author
Eugenia Loli
Ex-programmer, ex-editor in chief at OSNews.com, now a visual artist/filmmaker.
Follow me on Twitter @EugeniaLoli
no, I don’t think so:)
Fodder… is the article.
That was a terrible article… There was no real data, no proof, nothing worth reading at all… basically they boiled it down to: “the biggest factor is probably that mac os isn’t as popular”.. how about not running untrusted code as super user? or requiring super user authentication to run anything that affects system-wide stuff? or not holding user and system settings in the same place (registry)
I mean common, this may be an okay article for something like cnn, but OSNews should be a little more technical.
afp is not used for websites is it? Apple talk is used for workgroup environments. Face it, any Unix OS has better security than windows. Unix has security and multiuser features built into the core of the system.
I’m sure OS X is decently secure due to a BSD core. BSD is known for security.
I doubt Apple is a company that focuses heavily on security beyond using BSD as a logical choice for an OS foundation.
I’m sure the kernel in OS X is secure. I’m not so sure about anything Apple welds on top of OS X though.
As for if OS X is ready for primetime hosting I’d say sure. If you can host a commercial site of Windows then OS X can’t be any freakin’ worse on the security front.
they claim that windows can’t be secure like OS X because it was build in the ’80 without the internet in mind. *lol* how old is BSD? Was it designed with todays internet in mind???
I have to agree with ‘me’ that “…this may be an okay article for something like cnn, but OSNews should be a little more technical.”
[quote]I’ll stick to modern OSes like NT and 2000. Thank you.[/quote]
…remembering LoveSan & MyDoom…
http://www.fcw.com/fcw/articles/2004/0322/feat-smart4-03-22-04.asp
“We’ve had tremendous interest from federal, state and local governments because of the security of a Unix foundation,” said Ken Bereskin, director of Mac OS X product marketing. “Every aspect of the OS has been enhanced, from the drivers to the kernel.”
One feature of OS X 10.3 that could be particularly useful to federal customers is the FileVault 128-bit real-time encryption. Kennedy’s office has not yet begun encrypting its files, but a recent incident in which Republican staffers accessed Democrats’ files have prompted Pole to plan to do it soon. “I’m not saying it is going to happen again, but it is what people do,” he said.
All you need is local access and a OSX 10.2/3 disk.
1.Reboot machine with disk inside
2. press C while booting.
3. choose disk manager and change root password.
No previous pasword needed no hasels 😉
Ohh and don’t worry if you actually have enabled reall root just go to the netinfo manager with your new account and deleat the pass entry in root…
I am not going to defend anyone, even though the author of this artical takes pieces of quotes, instead of the whole quotes. Just look at the rest of the articals that deals with Apple on the page, you will get the hint that these people can only see one side of things. You will notice he does not go into detail about anything mac security related. But… at least I can read my email and not get virii…even if they have attachements (read about new viruses for windows that will run code and virii even if the email does not contain any attachements!)
True, BSD was developed earlier – as a timesharing system with a concentration on security. The internet was built on UNIX BSD at the core. Unlike DOS – Unix has always dealt seriously with securlty.
As for Apple’s extensions – i trust what I have seen. There is not a mindset to take over the internet with propritary features like the MS stuff. A lot of the security holes are due to allowing things like Active-X to run via the web. They wanted the technology because it was windows only – but the whole concept is a security nightmare. There are many other examples.
Security must be in the forefront, BSD has done this, and Apple seems to be following suit.
I think you don’t get the point. We are talking about OS security in reference to network security. What that means ist the security the syst5em offers throug NETWORKS. That bars that you can get in physical contact with the machine or that you can even reboot it. Every serious network server I know is locked away in a fire proof, air-conditioned server room.
If you can get in physical contact with the machine you don’t need the reboot shit – just grab the Mac on its two handles an carry it with you 😉
*ANY* computer with physical access is insecure, period. There are few exceptions, such as encrypted filesystems… If you’re worried about local access you need to physically lock the machine away.
Yeah, you can get local root on OS X by booting from install media. Assuming the interrupt hasn’t been secured.
Alternatively, what prevents me from walking up to a mac, powering it off, yanking the drives and doing whatever I want to them on a machine I have direct access to? Oh yeah- access to the machine. You can security lock the case, which still leaves the media bay open… and your position in the company, or what’s left of your bank account after company legal gets done with you.
No machine is secure if you have direct physical access to it. Remote access has always been the metric of security- how many remote root exploits are available for OS X, compared to windows?
So from now on we should ingnore local exploits? Tiz good save me from downloading patches.
afp is not used for internet webhosting! this article was a waste of time to read, especially on a p800!!
Same thing with any Linux install … you can alway mount the
HD after booting from a CD/Disk an edit the file …
there must be some missunderstanding…
all I want to say is, like you said, that the BSD basics wheren’t developed in the internet-age and are more secure than Windows – which’s basics aren’t developed in the internet-age, too.
These people continually put inflammatory pieces on their websites for more traffic. They don’t need research because the idea is to make money from the advertising. Give an article an over-the-top title and people will visit.
Mac OS X is fine as far as security goes. Yes, there are various security issues from time to time. They’re often found in the open source world and since they’ve been included in Mac OS X, they’re also a problem for it. Apple has been fairly swift on pervasive issue resolution but the fact is that many of the security issues come in pieces that are turned off by default.
[quote]Same thing with any Linux install … you can alway mount the
HD after booting from a CD/Disk an edit the file …[/quote]
Yeah lets stick a knoppix cd in… K lets change the bios config to boot from cd…
PASSWORD: uhmmmm dog
PASSWORD: ehmmm snitza32
PASSWORD: GRrrr $£”!$£”!FKSKFSK
PASSWORD:
Ahhh fsck it! I’ll go get some beers instead…
Prrrrrffff.
Just kill the bios via the jumper, or just use a cmos passwd cracker. PC Bios was *never* a secure thing…
And what? You can do the same thing via an Open Firmware password.
Here is the article from Apple’s KB:
http://docs.info.apple.com/article.html?artnum=106482
[quote]And what? You can do the same thing via an Open Firmware password.
Here is the article from Apple’s KB:
http://docs.info.apple.com/article.html?artnum=106482%5B/quote]
Just what I was looking for,thank you for participating in my experiment… This is way quicker than the forums…
You are right Digit0, I didn’t think about that … I have no
idea if there is something similiar to a BIOS password on Mac
hardware …
Look at this:
http://docs.info.apple.com/article.html?artnum=106482
Yes you can reset paswords at startup from a cd, but you can always put a password on your ability to do that.
Mac OS X is one of the most secure operating systems I’ve used. Windows is an OS where everything is turned on by default and active which is one of the stupidest decisons from an OS security point of view. I mean it’s taken Microsoft 20 some years to finally realize that this might not be the best way to lets Windows run.
On Mac OS X, any system wide change has to be authorized with an administrator password. Any service you turn on Mac OS X automatically turns on a firewall for that service. No Operating System is totally secure, not even OpenBSD, but Mac OS X is a lot more secure than Windows and many other OS’s out there, granted I can’t speak to Linux security because it’s not something I have looked into that deeply.
okay boy-ees, what about filevault? can ya change root name and access the ‘vaulted’ home directory?
Are you unfamiliar with the adage “local access is root access”?
Here’s what I don’t understand, perhaps because I don’t know the nitty gritty details of SSH.
The article sez: [quote]AFP enables a secure connection using the secure shell (SSH) protocol. The flaw is in AFP’s warning mechanism: Users may request a secure connection, but Panther will not warn users if the connection is in fact not a secure one.[/quote]
I don’t get it. I mean if you’re SSHing, you either have an SSH connection or you don’thave a connection right? Or is SSH some sort of protocol that gives you a secure connection when it feels like it or what?
Because when I go to the terminal or to Fugu and tell it to SSH a file to a server, how can I not be SSHing a file?
> okay boy-ees, what about filevault? can ya change root name
> and access the ‘vaulted’ home directory?
Nope. Filevault uses an encrypted disk image. The only way to access it is to know the password.
I don’t get it. I mean if you’re SSHing, you either have an SSH connection or you don’thave a connection right? Or is SSH some sort of protocol that gives you a secure connection when it feels like it or what?
Unfortunately SSHv1 contains some pretty fundamental design flaws which make it trivial for a number of tools (e.g. ettercap) to decrypt a SSHv1 session. This is compounded by the fact that most SSH servers are not configured to require SSHv2 per default, and even further compounded by the fact that some popular SSH clients, most notably PuTTY, default to SSHv1 per default and “fall back” on SSHv2 if the server does not support/allow SSHv1.
I’m not certain if this is what the article is referencing, but suffice it to say that packet capture tools exist which render the cryptographic properties of SSHv1 useless.
Wasn’t there a bug in the file vault feature that resulted in users losing data?
Look up man-in-the-middle attacks.
Under Debian (I assue BSD / other distros are the same) if I attempt to connect to an ssh server, and it’s sig has changed on me, it’ll drop the connection and warn me that the key has changed, which ussually means that the server has generated a new key, or someone is pretending to be a server between us. I understand from the article, that OS X _doesn’t_ tell you, and just accepts the new key.
“Unix has security and multiuser features built into the core of the system. ”
Same as Windows NT kernel.
“if I attempt to connect to an ssh server, and it’s sig has changed on me, it’ll drop the connection and warn me that the key has changed, which ussually means that the server has generated a new key, or someone is pretending to be a server between us. I understand from the article, that OS X _doesn’t_ tell you, and just accepts the new key.”
If you open a terminal and ssh to another comp OS X will notify you if the key has changed and will drop the connection.
What the article is talking about is that when you try to connect to an afp server (Accessed in Finder from menuitem Go > Connect to Server…)and choose to allow secure connections using ssh (tunneling afp though ssh). If the server doesn’t accept connections through ssh, it will connect without telling the user it’s not using ssh.
Survey says…………… aaaaaaaaaa
sorry DigitO. If I wanted to wreak havoc on a local machine, why not just use a baseball bat?
Why do windows users waste their time defending their OS?
Look, go send an email to Microsoft support and get off our backs. It’s not our fault that OS X is Must Better at Security then windows. Take your troubles to Bill!
– Tell Bill, to update user settings to OFF thru windows Update!
– Teach your users to use Hard passwords
– Disable Auto-Anything from Email Attachments.
– Teach users to Encrypt their personal Data!
– Teach Microsoft Programmers to stop taking the Short Cuts,
and write the Error Checking code into the OS.
– Teach yourself RATIOS.
1 Mac bug Doesn’t Equal 10,000 Windows Bugs.
– Real world example: My wifes IMac has been running for 3 years without virus protection, on the Internet using AOL, I recently discovered, so, I loaded up Virex and did a Full Scan. Zero Virus’s were found.
– Windows users, think about it, it’s just Computer Science,
not Infidility! You can buy an IBook for your personal use and protection of your personal data, and still run Windows at Work. No, you won’t be burned at the stake.
– Microsoft Office on the Mac is a very nice experience.
– You won’t know the tranquility of the Apple experience until you try it.
MAC User:
– Enjoy your trouble free computers, but, keep up with Apple Updates.
“Wasn’t there a bug in the file vault feature that resulted in users losing data?”
There was, but it only affected very rare setups and was fixed in about 2 days.
Not secure enough.
well as the old saying goes:
Windows is designed for the Internet
The Internet is designed for UNIX.
and it is still true today.
Today’s Internet hasnt changed much, (RFCs are still very much in use)
New software may be added, but the foundation is still the same.