Does this mean OSX isn't secure? :(

[coolbits]

So on windows you hack UAC an you have complete access... what do you hack on osx for that, kernel?
UAC is just another layer on top, nothing more...

 

[polaris20]

Not really if you make a regular user that doesnt know admin password... there is NO WAY he will make changes to ANY system file. Same is if you dont type your password on prompt, and no software is capable to do it without pass either.

The more you add on top of a system, the more complexity and potential vulnerabilities stack up on a system. This is how it is on any platform, Windows, Linux, and OS X.

Do you think everyone's web servers running on Linux have a regular desktop running with Firefox, Evolution, and a GUI? No. It's a stripped down, purpose built platform, with everything possible disabled. We don't even run SSH on our web servers here.

 

[belvdr]

We don't even run SSH on our web servers here.

Using telnet? How do the server admins take care of the thing?

 

[polaris20]

Using telnet? How do the server admins take care of the thing?

keyboard and chair. I admit it's a bit tinfoil hat-ish, but that's how the web admins wanted their outward facing boxes set up. It's on ESX though, so you can access it internally from any machine with the VI3 client on it. The machine is completely sandboxed on the ESX box then, and there would have to be both a vulnerability on ESX as well as firewall vulnerabilities before access could be had.

 

[belvdr]

keyboard and chair. I admit it's a bit tinfoil hat-ish, but that's how the web admins wanted their outward facing boxes set up.

Yeah that's a bit extreme. Simply open SSH (v2 only) from the internal to the DMZ, and enable only the web ports required from the Internet to the DMZ and you're fine. I mean, you're already allowing anonymous access to the web box. What does disabling SSH buy you if the firewall isn't allowing those connections through.

 

[polaris20]

Yeah that's a bit extreme. Simply open SSH (v2 only) from the internal to the DMZ, and enable only the web ports required from the Internet to the DMZ and you're fine. I mean, you're already allowing anonymous access to the web box. What does disabling SSH buy you if the firewall isn't allowing those connections through.

See above, I edited.

But yeah I agree with you, and if those machines were completely under my "ownership" I'd do it that way too. But these guys are a little nuts with it.

 

[TommyCo]

I wasn't being patronising, thanks.

It's simple economics, as Miller states in the article I quoted. 90% of the machines in the world run Windows. Which target would you like to aim for? Would you write malware for 10% of the market, or would you write malware for 90% of the market, which also happens to comprise a huge portion of business desktops? Remember, malware isn't just script kiddies anymore. This is big business.

I'm well aware that malware is a massive business. There are nearly a billion computers in the world. Ten percent of a billion is one hundred million. Malware was around before there were anywhere near that amount of machines were even in existence. It becomes financially viable to target the minority considering the absolute massive numbers of machines. Who would I attack? Personally I would attack the easiest machines to breach, this would yield a higher success rate. If this platform also was the minority and thus largely ignored by other malware developers and as such hasn't evolved an adequate immune system, I'd DEFINITELY make it my target. Bonus!

But the obscurity theory in my opinion definitely holds up, because when given two OSes, one a little less secure than the other, but with a fraction of the market share, there's no other logical explanation for it.

This is where I disagree. I don't see it as a logical explanation at all. It makes no sense for a malware developer to ignore any serious vulnerability since the sheer numbers at stake even of a 'minority' platform could stand to make them a lot of money. Especially if the security is weak due to a lack of previous malware exposure, which the obscurity theory suggests.

This argument is going around in circles and we learn nothing with each new cycle because there is nothing yet to discuss except pure speculation.

 

[polaris20]

This is where I disagree. I don't see it as a logical explanation at all. It makes no sense for a malware developer to ignore any serious vulnerability since the sheer numbers at stake even of a 'minority' platform could stand to make them a lot of money. Especially if the security is weak due to a lack of previous malware exposure, which the obscurity theory suggests.

This argument is going around in circles and we learn nothing with each new cycle because there is nothing yet to discuss except pure speculation.

We won't know for sure until we can take a poll of malware writers, asking them why OS X hasn't been attacked yet. However, I'm more inclined to agree with people that have already hacked OS X as to why it's not been attacked then I'm inclined to agree with your theory, no offense.

And again, I never claimed OS X is swiss cheese, like WinXP. It's not like it is vastly less secure than Win7 is.

 

[stainlessliquid]

I'm well aware that malware is a massive business. There are nearly a billion computers in the world. Ten percent of a billion is one hundred million. Malware was around before there were anywhere near that amount of machines were even in existence. It becomes financially viable to target the minority considering the absolute massive numbers of machines. Who would I attack? Personally I would attack the easiest machines to breach, this would yield a higher success rate. If this platform also was the minority and thus largely ignored by other malware developers and as such hasn't evolved an adequate immune system, I'd DEFINITELY make it my target. Bonus!




This is where I disagree. I don't see it as a logical explanation at all. It makes no sense for a malware developer to ignore any serious vulnerability since the sheer numbers at stake even of a 'minority' platform could stand to make them a lot of money. Especially if the security is weak due to a lack of previous malware exposure, which the obscurity theory suggests.

This argument is going around in circles and we learn nothing with each new cycle because there is nothing yet to discuss except pure speculation.

Windows is still vulnerable, until its invulnerable then theres no point in targeting anything else. None of what they do is legal either, its not done for fun and its stupid to take unnecessary risks for little reward.

Would you rather rob a hot dog stand or rob a bank if both places were equally guarded?