Apple Updates Mountain Lion Developer Preview With New Security Features

[AidenShaw]

I ran my game companies on Windows since 3.1. I've switched to Mac OS X since 2001. My personal experience is that on Mac OS X I have had zero incidents. On Windows....plenty of virus squashing and reinstalls. I don't give a crap about your "excuses" on why Windows has tons of exploits.

So, if your thesis is that "OSX is more secure than Windows 9X" - I don't think that you'll find any argument here.

On the other hand, you say that you haven't used Windows in the last 11 years. You should be aware that a lot has changed in the last decade.

When I get hit by a virus on OS X then you can talk.

Congratulations for dodging Flashback, hope your luck is as good with the next OSX malware.

 

[Nermal]

The update removed all my Login Items - anyone else?

Mine are gone too.

 

[NAG]

Second: I said, THIS WAY (FEEL THE FURY OF CAPS LOCK) that Market Share isn't THE ONLY reason.

Okay then. You seemed to be preaching that marketshare = god or something weird. Glad to know you don't think it is the only metric.

As far as the rest of the stuff. I'm going to assume you're not talking about me since it sort of starts to ramble off into all caps and such and I never called you moronic (seriously, I'm not following half of what you wrote). Perhaps you're talking to someone else and only quoted me, no?

Mine are gone too.

Wouldn't be surprised if this is somehow security related (security feature gone wrong). They do something to limit autolaunching?

 

[andrebrait]

Okay then. You seemed to be preaching that marketshare = god or something weird. Glad to know you don't think it isn't the only metric.

As far as the rest of the stuff. I'm going to assume you're not talking about me since it sort of starts to ramble off into all caps and such and I never called you moronic (seriously, I'm not following half of what you wrote). Perhaps you're talking to someone else and only quoted me, no?



Wouldn't be surprised if this is somehow security related (security feature gone wrong). They do something to limit autolaunching?

It wasn't you, man, sorry if you even came close to thinking I said anything about you... It was another user a couple of comments below =) I was on the iPhone and forgot to quote him aswell.

 

[NAG]

It wasn't you, man, sorry if you even came close to thinking I said anything about you... It was another user a couple of comments below =) I was on the iPhone and forgot to quote him aswell.

What I thought. Glad we're all not confused anymore! lol

 

[extensor]

So, if your thesis is that "OSX is more secure than Windows 9X" - I don't think that you'll find any argument here.

My last Windows machine was XP.

My point is, there is no proof that Mac OS X is not secure, just opinion. Mostly by security vendors who have financial motives...

 

[kustardking]

We should all care! The language in the USA is becoming so convoluted that it's becoming almost impossible to communicate or understand what's being said. Substituting 'weight' for 'size' when the subject has no weight is confusing and a bastardization of the language.

"Weighing in at..." is a casual, jocular reference to boxing contestants. Language is rich in that way.

 

[Yamcha]

I ran my game companies on Windows since 3.1. I've switched to Mac OS X since 2001. My personal experience is that on Mac OS X I have had zero incidents. On Windows....plenty of virus squashing and reinstalls. I don't give a crap about your "excuses" on why Windows has tons of exploits. When I get hit by a virus on OS X then you can talk.

I'm a Mac user, and if you think Mac OS doesn't have viruses then your wrong, obviously It's still nothing compared to Windows...

But not sure If you've read up on it, Mac OSX was hacked in under 30 minutes, so while Mac Users are less susceptible to viruses, it still doesn't make it more secure.. But obviously that may change with Mountain Lion..

Another thing to note is, Mac OSX is growing quickly, we've seen it time and time again on Apple keynotes.. The more popular Mac becomes the more viruses & malware we will see..

Just wanted to point that out.. While we as Mac users don't have to deal with the small viruses or malware, that could easily change in the future..

 

[munkery]

OS X NEVER was more secure than Windows - that's just a stupid myth.

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Much of the ability to turn these vulnerabilities into exploits is due to the insecurity of the Windows registry. Also, more easily being able to link remote exploits to local privilege escalation exploits in Windows is due to the Windows registry.

Mac OS X does not use an exposed monolithic structure, such as the Windows registry, to store system settings. Also, exposed configuration files in OS X do not exert as much influence over associated processes as the registry does in Windows.

Mac OS X Snow Leopard has contained only 4 elevation of privilege vulnerabilities since it was released; obviously, none of these were used in malware. Lion has contained 2 so far but one of these vulnerabilities doesn't affect all account types because of being due to a permissions error rather than code vulnerability.

The following link shows the number of privilege escalation vulnerabilities in Windows 7 related to just win32k:

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+7

More information about privilege escalation in Windows 7:

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://mista.nu/research/mandt-win32k-paper.pdf -> more complete documentation about alternative methods to exploit the Windows kernel.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

2) Windows has the potential to have full ASLR but most software does not fully implement the feature. Most software in Windows has some DLLs (dynamic link libraries = Windows equivalent to dyld) which are not randomized.

http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf -> article overviewing the issues with ASLR and DEP implementation in Windows.

Also, methods have been found to bypass ASLR in Windows 7.

http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf -> article describing bypassing ASLR in Windows 7.

Mac OS X has full ASLR implemented on par with Linux. This includes ASLR with position independent executables (PIE). DLLs in Windows have to be pre-mapped at fixed addresses to avoid conflicts so full PIE is not possible with ASLR in Windows.

Using Linux distros with similar runtime security mitigations as Lion for a model, client-side exploitation is incredibly difficult without some pre-established local access. Of course, this is self defeating if the goal of the exploitation is to achieve that local access in the first place.

See the paper linked below about bypassing the runtime security mitigations in Linux for more details.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

The author only manages to do so while already having local access to the OS.

3) Mac OS X Lion has DEP on stack and heap for both 64-bit and 32-bit processes. Third party software that is 32-bit may lack this feature until recompiled in Xcode 4 within Lion. Not much software for OS X is still 32-bit.

But, not all software in Windows uses DEP; this includes 64-bit software. See first article linked in #2.

4) Mac OS X implements canaries using ProPolice, the same mitigation used in Linux. ProPolice is considered the most thorough implementation of canaries. It is known to be much more effective than the similar system used in Windows.

http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf -> article comparing ProPolice to stack canary implementation in Windows.

5) Application sandboxing and mandatory access controls (MAC) in OS X are the same thing. More specifically, applications are sandboxed in OS X via MAC. Mac OS X uses the TrustedBSD MAC framework, which is a derivative of MAC from SE-Linux. This system is mandatory because it does not rely on inherited permissions. Both mandatorily exposed services (mDNSresponder, netbios...) and many client-side apps (Safari, Preview, TextEdit…) are sandboxed in Lion.

Windows does not have MAC. The system that provides sandboxing in Windows, called mandatory integrity controls (MIC), does not function like MAC because it is not actually mandatory. MIC functions based on inherited permissions so it is essentially an extension of DAC (see #1). If UAC is set with less restrictions or disabled in Windows, then MIC has less restrictions or is disabled.

http://www.exploit-db.com/download_pdf/16031 -> article about Mac sandbox.

http://msdn.microsoft.com/en-us/library/bb648648(v=VS.85).aspx -> MS documentation about MIC.

https://media.blackhat.com/bh-eu-11/Tom_Keetch/BlackHat_EU_2011_Keetch_Sandboxes-Slides.pdf -> researchers have found the MIC in IE is not a security boundary.

6) In relation to DAC and interprocess sandboxing in OS X in comparison with some functionality of MIC in Windows 7 (see #5), the XNU kernel used in OS X has always had more secure interprocess communication (IPC) since the initial release of OS X.

Mac OS X, via being based on Mach and BSD (UNIX foundation), facilitates IPC using mach messages secured using port rights that implement a measure of access controls on that communication. These access controls applied to IPC make it more difficult to migrate injected code from one process to another.

Adding difficulty to transporting injected code across processes reduces the likelihood of linking remote exploits to local exploits to achieve system level access.

As of OS X Lion, the XPC service has also been added to implement MAC (see #5) on IPC in OS X. (http://developer.apple.com/library/...stemStartup/Chapters/CreatingXPCServices.html)

7) Windows has far more public and/or unpatched vulnerabilities than OS X.

http://www.vupen.com/english/zerodays/ -> list of public 0days.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker -> another list of public 0days. (Most if not all of the Apple vulnerabilities in this list were patched in the latest Apple security update -> http://support.apple.com/kb/HT5002)

http://m.prnewswire.com/news-releas...-vulnerability-in-microsoft-os-110606584.html -> article about 18 year old UAC bypass vulnerability.

8) Password handling in OS X is much more secure than Windows.

The default account created in Windows does not require a password. The protected storage API in Windows incorporates the users password into the encryption key for items located in protected storage. If no password is set, then the encryption algorithm used is not as strong. Also, no access controls are applied to items within protected storage.

In Mac OS X, the system prompts the user to define a password at setup. This password is incorporated into the encryption keys for items stored in keychain. Access controls are implemented for items within keychain.

Also, Mac OS X Lion uses a salted SHA512 hash, which is still considered cryptographically secure. It is more robust than the MD4 NTLMv2 hash used to store passwords in Windows 7.

http://www.windowsecurity.com/articles/How-Cracked-Windows-Password-Part1.html -> article about Windows password hashing.

9) The new runtime security mitigation improvements to be included in Windows 8 have already been defeated.

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

To put this into perspective, methods to bypass the new runtime security mitigations in Mac OS X Lion are not yet available.

10)In regards to recent earlier version of Mac OS X:

The following article relates to varying levels of security mitigations in different Linux distros but it is applicable in revealing that the runtime security mitigations in some earlier versions of Mac OS X prior to Lion were far from inadequate.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

While Mac OS X Leopard/SL lack full ASLR, Windows Vista/7 have stack canaries (aka stack cookies) that are trivial to bypass.

The following link shows the issues with stack canaries in Windows. -> http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf

So:

Windows Vista/7 = NX + ASLR
Mac OS X Leopard/SL = NX + stack cookies

These articles show that NX in combination with stack canaries is more difficult to bypass than a combination of NX and ASLR.

11) Mountain Lion only improves upon the security of Lion.

BTW, Safari on a Mac running Lion was not hacked at the last pwn2own.

 

[Ger Teunis]

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

...

BTW, Safari on a Mac running Lion was not hacked at the last pwn2own.

What I really hate about posts like the one made by andrebrait: they really have NO technical background at all. Just some guy keep posting lost of posts what he thinks (guesses) what is right. If users disagree: keep posting more long posts with even CAPS so he will be more right. Stop it: get the facts right!

Stop talking about stuff what you THINK, only post when you are technically right.

munkery really gave some technical background what the current state of OS X is currently: real proof and even comparisons to other Operating Systems.

OSX has made a massive amount of progress since Lion. Mountain Lion added even more security measures, even so much that they per-default block apps which are not signed with a developerid certificate. This can be used by apple to remove or block apps which in their eyes break the rules (viruses, spyware etc)

But sadly the truth is not that important anymore, the people who shout the hardest or plan on the person really are right here lately.

 

[marcusj0015]

Weird, my Windows 7 computers just asked me if I wanted to install updates when I shut off the computer. It already downloaded them in the background without bothering me.

It couldn't be that Windows had options regarding updates - options that it shows you when you first install it so you can forget it. Nah.

You're talking about security patches, but I'm refering to definition updates for all 14 different anti-xware included, lthat you have to load for it to start updating the definitions, basically, another reason Windows sucks.

 

[theSeb]

OS X NEVER was more secure than Windows - that's just a stupid myth. It just has an insignificant market share and only recently began to appear on the radar screen of malware authors. But in every hacker contest, OS X usually is the first system that gets hacked.

Since Vista, Windows has an architecture that provides much more security out of the box than most other operating systems on the market.

But that's the amazing thing here: Apple is playing catchup with Microsoft's security features and all of a sudden everything you people have bashed Microsoft for in the past becomes an awesome new feature in OS X.

Please post facts to back up your statements or gtfo

http://arstechnica.com/apple/2012/04/5-os-x-security-threats-that-fizzled/

http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/

The most important addition is full ASLR. Short for address space layout randomization, the protection makes it much harder for attackers to exploit bugs by regularly changing the memory location where shell code and other system components are loaded. Other improvements include security sandboxes that tightly restrict the way applications can interact with other parts of the operating system and full disk encryption that doesn't interfere with other OS features.


“It's a significant improvement, and the best way that I've described the level of security in Lion is that it's Windows 7, plus, plus,” said Dino Dai Zovi, principal of security consultancy Trail of Bits and the coauthor of The Mac Hacker's Handbook. “I generally tell Mac users that if they care about security, they should upgrade to Lion sooner rather than later, and the same goes for Windows users, too.”

It also prompted many to wonder why Apple engineers bothered to put it into the OS in the first place, or didn't properly implement it with the introduction of Snow Leopard. Windows Vista and Ubuntu, by contrast, added much more robust implementations of ASLR years earlier.

“When they went from Leopard to Snow Leopard, as far as I'm concerned, there really wasn't any change,” said Charlie Miller, principal research consultant at security firm Accuvant and the other coauthor of The Mac Hacker's Handbook. “They might have said there was more security and it was better, but at a low functionality level there really wasn't any difference. Now, they've made significant changes and it's going to be harder to exploit.”

With virtually all browser exploits targeting the way the program parses web content, Apple engineers have tightly locked down the new process, called Safari Web Content. The design is intended to limit the damage that can be done in the event an attacker is able to exploit a buffer overflow or other bug in the browser.

“Now, you end up inside this restricted process that only does the web parsing, and you can't do other things you might want to do as an attacker, such as write files or read a person's documents,” Miller explained. “Even when you get code execution, you no longer have free rein to do whatever you want. You can do only what the sandbox allows you to do.”

Reality must be brought back in though:

No doubt, Apple deserves kudos for setting a new standard in OS security that Microsoft and Linux distributors would do well to emulate. But it would be a mistake for Mac users to think their OS is invulnerable. As the most recent Jailbreakme exploit made clear, real-world hackers can still find ways to root iPhones and iPads when the devices do nothing more than visit a booby-trapped website.

If iDevices, which contain security protections that go well beyond those found in OS X, can succumb to drive-by downloads, there's no reason Macs aren't also vulnerable.

“Those guys are seriously raising the bar, but no matter how high the bar is, somebody is going to get over it,” said Rich Mogull, CEO of Securosis. “As long as we have even moderately open operating systems, there's always going to be somebody smart enough to get through that stuff.” ®

I am more inclined to believe people that actually know what they're talking about than some random internet expert that skimmed over the results of a white hat competition, without understanding the context.

 

[mw360]

"Weighing in at..." is a casual, jocular reference to boxing contestants. Language is rich in that way.

I think everybody knows that. The point is that it's a cliche. Something that was once clever, or 'jocular', but has been so overused its lost all of its impact and is now, at best, just a bunch of extra words, and at worst irritating or annoying.

Professional writers are supposed to exhibit skill with words. The first guy to used the phrase 'weighs in at' outside of a boxing context probably did that. The first guy to equate screen space with valuable real estate should be proud of himself. But those gags are done and old. 'Weighs in at' has been used over 1000 times in MacRumors articles alone. If you can't think of a clever way to describe the size of a file, stick with 'x is yMB' for the time being, or risk looking like an amateur.

 

[beg_ne]

Excellent information and links from munkery.

Thank you very much.

 

[bushido]

delete please, wrong topic

 

[jyavenard]

4th kernel panic since I updated ....

so beware....

 

[Apple Knowledge Navigator]

4th kernel panic since I updated ....

so beware....

Can't you just tell it to calm down?

 

[Waxhead138]

We should all care! The language in the USA is becoming so convoluted that it's becoming almost impossible to communicate or understand what's being said. Substituting 'weight' for 'size' when the subject has no weight is confusing and a bastardization of the language.

I agree our language is getting butchered daily, between people just not caring and flat out ignorance.

However, there is a difference between a metaphor, or a substitution, and flat out stupidity and the MTV influence on a language.

Things like using "ur" for any of the versions of your kills me....but there is a balance. If we are 100% literal about everything we'll getting very boring, very fast...everything will read like stereo instructions. There does need to be a little bit of color and variation. I do completely agree with the idea that we don't need to use the same old phrases everytime though.

 

[mrbyu]

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default.
...
BTW, Safari on a Mac running Lion was not hacked at the last pwn2own.

I saved your comment in PDF to be able to throw it in anybody's face who talks ******** about OS X vs Windows security.

 

[MonkeySee....]

OS X NEVER was more secure than Windows - that's just a stupid myth. It just has an insignificant market share and only recently began to appear on the radar screen of malware authors. But in every hacker contest, OS X usually is the first system that gets hacked.

Since Vista, Windows has an architecture that provides much more security out of the box than most other operating systems on the market.

But that's the amazing thing here: Apple is playing catchup with Microsoft's security features and all of a sudden everything you people have bashed Microsoft for in the past becomes an awesome new feature in OS X.

Man, you hate Apple don't you

 

[RobertMartens]

Please stop saying "weighs in at".

I have been making this request for a couple of months but this is the first time I have seen anyone else join in. Not just you but two or three others agreed with you.

They should write 'is' and stop pretending that something that is not clever is.

 

[Can't Stop]

I have been making this request for a couple of months but this is the first time I have seen anyone else join in. Not just you but two or three others agreed with you.

They should write 'is' and stop pretending that something that is not clever is.

I’ve been asking for 5 accounts now.

 

[polaris20]

But not sure If you've read up on it, Mac OSX was hacked in under 30 minutes, so while Mac Users are less susceptible to viruses, it still doesn't make it more secure.. But obviously that may change with Mountain Lion..

You're reading too many headlines. While it may have taken 30 minutes to perform the hack, it didn't take 30 minutes to find the vulnerability and develop the hack. Same goes for any of these hacks for any of the OSes. It's sensationalistic.

You should educate your company IT guys about WSUS.

It's a little feature that let's IT define intranet Windows Update servers, and force company clients to look at the local version, not the Microsoft site. IT can test the updates, and move them to the local server after verifying local apps.

MS has seen the problem, and provided the tools for IT to manage updates without "stressing to users not to download an update".

WSUS is great, but it doesn't do you a whole helluva lot of good when two of the main security problems on any platform are Flash and Acrobat Reader. You need a third party tool like Eminent (now owned by Solar Winds) to actually patch manage Windows machines properly.

 

[hamidb83]

Sleep problem?

My mac does not go into sleep anymore since the update. anybody has the same problem?

 

[linux2mac]

On the other hand, you say that you haven't used Windows in the last 11 years. You should be aware that a lot has changed in the last decade.

I kept hearing that in these forums and was optimistic. That is until I watched the Surface demo and realized nothing has changed with MS.

Watch Microsoft’s Surface Tablet Freeze in the Middle of a Presentation
http://betabeat.com/2012/06/watch-microsofts-surface-tablet-freeze-in-the-middle-of-a-presentation/

Congratulations for dodging Flashback, hope your luck is as good with the next OSX malware.

I doubt it. Been using Macs for three years and I have had zero viruses/malware. Can't say the same for my Windows days. None of my Macs are running any anti-virus software either. Macs saved me money by not having to buy Norton licenses. How do you like having to buy anti-virus software annually?