Apple Security: Vulnerability Inevitability
Perhaps, but the security tide is slowly turning against Steve Jobs and company as market share numbers climb and outside developers create applications to run on Apple devices. June 2010 may go down as the pivotal moment when Apple’s invulnerability was dispelled. (In fact, we hear rumors that Apple may turn to the channel for help with its mounting security woes -- more to come on that.) First, there’s the iPad debacle. To be fair, this wasn’t Apple’s fault; blame rests with AT&T. It was the carrier’s customer service portal that was breached by gray hat hacker group Goatse Security to reveal more than 114,000 iPad 3G accountholder email addresses. Apple CEO Jobs was reportedly infuriated by the incident, given his maniacal pursuit for airtight security in all facets of Apple operations and products. >> CHECK OUT: "Lessons from the iPad/AT&T Hack" But the security woes are actually reflective of the increasing number of vendors announcing the discovery of security problems in and security products for Apple products. Two weeks ago, Apple released an update to Mac OS X Snow Leopard (version 10.6.4), but failed to note that it included new antivirus protections that guarded against the HellRTS Trojan. The Trojan is disguised as an iPhoto update to trick Mac users into installing the malware that allows hackers to surreptitiously take remote control of Macs Symantec, Sophos and Apple security specialist Intego had identified and released protections for HellRTS in April. Apple’s late response to the Trojan threat and failure to note the update in the OS update raised many questions in the security community. "In my opinion Apple stands at a crossroads with regards to what they do about security. They can either continue as they are claiming that they have no malware, no problems and just doing enough to get by. Or they can invest in making security a 'feature' of the Operating System," said Graham Cluley, a senior technology consultant at Sophos, noted in his company blog. The stealth antivirus update is indicative of the rising threat against the Mac platform. Symantec, McAfee, Sophos and Kaspersky Lab have offered Mac antivirus software for some time. However, other security vendors are releasing new Mac tools to combat Web-based threats. For instance, AVG Software released new versions of its Internet Security and Anti-Virus Free Edition (v9.0) that includes LinkScanner for Mac. The software monitors browsing to guard against malicious content coming through compromised, media-rich Web site. The iPad and iPhone are not invulnerable to security threats, either. While some enthusiasts claim that iOS (v3 and v4) are more secure than even Mac OS X, the record states differently. When Apple released iOS 4.0 last week, it included patches and fixes for more than 65 vulnerabilities. More than one-half of the patches addressed “arbitrary code execution” problems. That’s what the rest of the world calls critical vulnerabilities that could result in hackers taking control of a client. Several security vendors have recognized the rising threats against smartphones and, in particular, the iPhone. More than a year ago, Eugene Kaspersky warned that Apple’s closed, proprietary platform wouldn’t insulate the iPhone from attacks forever. The acceptance of third-party applications would force Apple to reveal more about the inner workings of its operating system, and that openness would allow hackers to reverse engineer exploits. >> CHECK OUT: "More Virulent Smartphone Malware on the Horizon" All this adds up to what many security experts have predicted: If Apple ever achieved a critical mass of users and device install base, it would attract the same interest that Microsoft has garnered for years and more security problems would be revealed. Now that Mac’s market share is peeking above 10 percent and millions of iPhone 4s and iPads are racing out of warehouses, Apple may have finally achieved that critical mass. |
Apple has sat atop a high pedestal when it comes to security (and just about everything else in the user experience). Reports of leaked Windows 8 development plans reveal how Microsoft engineers marvel at how Mac’s operating systems and applications “just work.” And, for the longest time, Mac and Apple devices seem impervious to malware and hackers. 
Comments (5)
Appple and its fans have more than enough holier than thou attitude to go around, however...
The, "root," of the problem is that one or more users running the machine are given a mechanism to assume administrative rights. That's the same problem that faces Windows isntallations. Users have to be given a lax enough security environment that there is reasonable chance that non-technical users can figure out how to install critical updates or new software.
Yes, I know there are tweaks for configuring sudo or setting policies, but remeber that we'd like minimally savvy users to succeed. The Windows Vista debacle shows the kind of reaction that ensues when security is too heavy-handed.
Any time you hand over the keys to the kingdom (i.e. administrative rights), there exists a chance the holder of the keys can be duped into a blunder that hands over the keys to parties unknown.
Malware authorship migrated away from pimple-faced teenagers to orgnaized crime syndicates years ago. Crime is a business and there is greater pay-off for development work in the Windows deployment space than for the previously tiny Macintosh space. As numbers of Macintoshes deployed increase, they are more likely to attact the sights of malware auhtors. Sometimes, it isn't so cheerful to be in the lime light.
So, it really isn't about plaform superiority, it is about which platform it makes more business sense to attack.
Posted by Bill | June 30, 2010 3:39 PM
What iPad hack? They hacked AT&T's WEBSITE by breaking an easy to break reference sequence AT&T (NOT APPLE) was using to log email addresses. iPad had nothing to do with it.
The built-in anti-malware has been with OS X v10.6 since it's inception. This is not news and simply bolsters the already stalwart Unix security that OS X uses. My gawds! They made it MORE secure!? How dare's thay!
No. OS X is not impenetrable. There's still one weakness, the user. BUT, because of OS X's Unix underbelly (OS X is a fully compliant Unix distribution) the user has to ACTIVELY install it. And for it to run in an independent security context of the user it must be installed as an Administrator authenticating to root.
All systems have vulnerabilities. The question is, a) "Is the vulnerability easily exploitable?" and b) "Can it be exploited remotely WITHOUT local user action?" If the answer is , "No, to either" then it's not a critical vulnerability.
With OS X's popularity increasing why wouldn't "Security Vendors" want to sell their wares? That doesn't mean everybody needs to run out and get it. These vendors need to generate fear (not necessarily justified fear) to get their products off the shelf.
The fact is there is not one single "In the Wild" (meaning it gets on the system with NO user interaction) virus for OS X. It's claimed that this is due to "market share" which is to simplistic to be valid. There's more 7-11's than Fort Knox's. Which gets "hit" more often? The reality is that thieves go for the most reward with the least effort. A Return on Investment as it were. Put that into perspective and Operating Systems as targets are no different.
Posted by Michael | June 30, 2010 3:44 PM
This article was over-hyped big time. Michael's post was far more reasonable and representative of the state of Mac security.
The anti-Trojan signatures released by Apple deal with the only malware in the wild for Macs: pirated software with a Trojan hidden within. Presently, if one doesn't install pirated software, Mac users have no known malware to concern them. Nice of Apple to furnish signatures for piracy.
As others have said, real malware will strike the Mac. 2010 may be the year. Despite the lack of exploits, Apple patches vulnerabilities. And with 10.5 and 10.6, Apple has released more and more security building blocks. With 10.7, if they continue to enhance memory protections such as ASLR as well as process sandboxing and some anti-execution features, the Mac will be well prepared (not infallable) for the eventual onslaught of software application exploits.
Posted by Eirik | June 30, 2010 9:10 PM
I feel very secure when connected to the Internet with my mac. These articles are always coming down on Apple but Apple releases security fixes quite regularly and they haven't been wormed like every other operating system out there. I highly doubt hackers could find a wormable interface in OS X to be quiet honest.
Posted by Maximus Trollovski | July 1, 2010 10:35 AM
Just to reiterate what I perviously worte, and that several other people have expressed: the end user is at least as big a problem as the technology of the operating systems and their applications. I have supported Microsoft, Apple and other desktop and server systems extensively since the 1980s. By far, the greatest number of failures and security compromises are cuased by clueless, careless or just plain malicious end users.
It probably is not what the editors of this forum would like me to write, but an equal amount of money spent on a user education campain would probably garner more pay-off than dumping the same money into a technology refresh of the corporate firewall.
Form a technical standpoint, the operating systems of OS X and Windows 7 are both pretty good at implementing security. I give the nod to Windows becuase it incorporates more modern technology into ints kernel than does OS X. For both systems, it is the layers of application software and the end users that compromise security. In the Macintosh space, the Safari web browser and QuickTime media systems have suffered significant exploitable security short-comings over the last few years. Microsoft has done a better job than Apple at realeasing fixes in a timely manner.
As far as the iPad problem with the AT&T web site exposing user data goes, I will hold Apple's feet to the fire for responsiblity. Apple, and probably Steve Jobs himself, have quite consciously made the decision to make the iPhone and iPad captive devices on AT&T's network. Apple has full ownership of any shortcomings of AT&T becasue of the captive relationship. Customers have no Apple-sanctioned choice of any network other than AT&T. An AT&T network problem is an Apple device problem. As John Gage famously said, "The network is the computer."
Posted by Bill | July 6, 2010 11:02 AM