7 ms·

How long will it take to change the mindset at Apple to think about security before shipping? Microsoft did their job years ago, now Apple has to follow. How l

by mrich 15y ago

How long will it take to change the mindset at Apple to think about security before shipping? Microsoft did their job years ago, now Apple has to follow. How long will it take for Mac users to learn that viruses are indeed a threat on all kinds of computers, not just PCs? I can only hope Apple will take a more active role in educating them.

hej 15y ago
I'm guessing Apple's plan involves Gatekeeper (coming soon) and not shipping OS X with Java and Flash by default (already implemented, but installing both is ridicoulously easy). I'm not sure how teneable and wise that is, though.
- LinaLauneBaer 15y ago
  I agree - but there is a catch: Gatekeeper will help to prevent things like that. The default mode in Mountain Lion is only to allow to run apps downloaded from the App Store and/or signed by a developer whose certificate can be revoked by Apple at any time. This will prevent at least the spreading of malicious software components after it has been discovered. And this is the point... Apple needs to react faster and malicious software has to be detected first - otherwise a revoking system makes little sense...
  - hessenwolf 15y ago
    So the default mode of the entire operating system is to only let you install software approved, for a fee, by Apple? Go business. Am I understanding correctly?
    - coob 15y ago
      No, Developer IDs are free.
    - yusefnapora 15y ago
      Not quite. You can get a free certificate for non-appstore apps. Apps signed with the free cert aren't reviewed or endorsed by Apple, but they can revoke the certificate after the fact if they find that you've been publishing malicious apps. The Mountain Lion default allows signed apps only, both appstore and non-appstore. You can also set it to 'appstore only' or 'anything goes'.
- thoradam 15y ago
  > and not shipping OS X with Java That won't help the people who actually use Java on OS X. It would be better to allow Oracle to manage the updates for Java on OS X, the vulnerability that Flashback abused was patched by Oracle back in February.
  - meepmorp 15y ago
    Which, I believe, is the plan in the longer term. Apple is going to leave Java platform development to Oracle - there was a spate of "Apple eliminating Java from OS X" articles back when it was announced (last year?)
    - pooriaazimi 15y ago
      It was November 2010: Oracle and Apple announce OpenJDK Project for Java on Mac OS X (http://www.appleinsider.com/articles/10/11/12/oracle_and_apple_announce_openjdk_for_java_on_mac_os_x.html http://www.appleinsider.com/articles/10/11/12/oracle_and_app...)
      - meepmorp 15y ago
        Thanks for being my lazy web.
- dubya 15y ago
  Is Apple getting dinged for Java installation being too easy? That seems pretty easy to fix. Having Java on by default in Safari was a bad choice (just like disk images and packages last year). I hope they'll do a scan and remove with Software Update soon, if that's possible.
rbarooah 15y ago
What do you think Microsoft has done that Apple has not?
- mrich 15y ago
  Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore). Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize. An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...
  - rhplus 15y ago
    2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx
  - rbarooah 15y ago
    You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...
dguido 15y ago
... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it. The next best thing they'll have to do is, when they install it, disable the web plugin in Safari by default or add an interstitial that prompts the user for it to run. One 500k node botnet really is not that large in the grand scheme of things.
- justinschuh 15y ago
  I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call. And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.
  - dguido 15y ago
    Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.
    - justinschuh 15y ago
      I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).
nirvana 15y ago
Can you name a single mac virus that has infected a significant number of machines in the wild since the mid 1990s? Note a Trojan, is not the same thing as a virus. A virus self propagates, a trojan propagates when a user overrides a security warning. Viruses have been a problem for Windows for decades, but not a problem on macs, since the late 1980s, possibly early 1990s.
- SpiderX 15y ago
  I think that's more to do with "herd immunity" than anything else. There haven't been enough macs communicating with macs to have widespread damage from a mac virus.
- blub 15y ago
  "Hey, this trojan has stolen our CC numbers, photos and personal documents, but at least it's not a virus! THAT would have been really bad...". And please try to keep up with the latest developments, this trojan requires no user intervention. Not running Little Snitch + antivirus at this point is just ignorant and asking for it.

by mrich 15y ago

hej 15y ago

I'm guessing Apple's plan involves Gatekeeper (coming soon) and not shipping OS X with Java and Flash by default (already implemented, but installing both is ridicoulously easy). I'm not sure how teneable and wise that is, though.

LinaLauneBaer 15y ago
I agree - but there is a catch: Gatekeeper will help to prevent things like that. The default mode in Mountain Lion is only to allow to run apps downloaded from the App Store and/or signed by a developer whose certificate can be revoked by Apple at any time. This will prevent at least the spreading of malicious software components after it has been discovered. And this is the point... Apple needs to react faster and malicious software has to be detected first - otherwise a revoking system makes little sense...
- hessenwolf 15y ago
  So the default mode of the entire operating system is to only let you install software approved, for a fee, by Apple? Go business. Am I understanding correctly?
  - coob 15y ago
    No, Developer IDs are free.
  - yusefnapora 15y ago
    Not quite. You can get a free certificate for non-appstore apps. Apps signed with the free cert aren't reviewed or endorsed by Apple, but they can revoke the certificate after the fact if they find that you've been publishing malicious apps. The Mountain Lion default allows signed apps only, both appstore and non-appstore. You can also set it to 'appstore only' or 'anything goes'.
thoradam 15y ago
> and not shipping OS X with Java That won't help the people who actually use Java on OS X. It would be better to allow Oracle to manage the updates for Java on OS X, the vulnerability that Flashback abused was patched by Oracle back in February.
- meepmorp 15y ago
  Which, I believe, is the plan in the longer term. Apple is going to leave Java platform development to Oracle - there was a spate of "Apple eliminating Java from OS X" articles back when it was announced (last year?)
  - pooriaazimi 15y ago
    It was November 2010: Oracle and Apple announce OpenJDK Project for Java on Mac OS X (http://www.appleinsider.com/articles/10/11/12/oracle_and_apple_announce_openjdk_for_java_on_mac_os_x.html http://www.appleinsider.com/articles/10/11/12/oracle_and_app...)
    - meepmorp 15y ago
      Thanks for being my lazy web.
dubya 15y ago
Is Apple getting dinged for Java installation being too easy? That seems pretty easy to fix. Having Java on by default in Safari was a bad choice (just like disk images and packages last year). I hope they'll do a scan and remove with Software Update soon, if that's possible.

rbarooah 15y ago

What do you think Microsoft has done that Apple has not?

mrich 15y ago
Microsoft had its security Waterloo 6-8 years ago, and they have dramatically improved and changed their development practices since then. I once read that they have one whole building of engineers dedicated to security (sorry cannot find the link anymore). Reports involving security breaches of Apple products often show Apple as someone who feels wronged and would rather try to kill the messenger than fix the problem. To their credit, they appear to be looking for fixes that cause the least harm to their users. But to me they appear to be operating on very limited manpower/budget for this so they have to prioritize. An example: Apple didn't fix a flaw on Windows iTunes for 3 years because it wasn't a priority, and intelligence software companies sold software based on this hole - imagine if Microsoft did this: http://www.telegraph.co.uk/technology/apple/8912714/Apple-iTunes-flaw-allowed-government-spying-for-3-years.html http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT...
- rhplus 15y ago
  2002 was the start of Microsoft's major security rethink, prompted in part by exploits like the Code Red worm. For a short period it wasn't a building of engineers, but the whole engineering staff that stopped development and focused on security code reviews and bug fixes[1]. One of the outcomes was the Security Development Lifecycle[2]. [1] http://www.windowsitpro.com/article/security/microsoft-reportedly-halts-new-software-development-temporarily http://www.windowsitpro.com/article/security/microsoft-repor... [2] http://www.microsoft.com/security/sdl/default.aspx http://www.microsoft.com/security/sdl/default.aspx
- rbarooah 15y ago
  You dodged the question. You haven't listed a single thing that Microsoft has done that Apple has not. You are right that Microsoft started to take security seriously before Apple did, but Apple is not still behind. http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/ http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_securi...

dguido 15y ago

... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it. The next best thing they'll have to do is, when they install it, disable the web plugin in Safari by default or add an interstitial that prompts the user for it to run. One 500k node botnet really is not that large in the grand scheme of things.

justinschuh 15y ago
I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call. And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.
- dguido 15y ago
  Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve. I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.
  - justinschuh 15y ago
    I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).

nirvana 15y ago

Can you name a single mac virus that has infected a significant number of machines in the wild since the mid 1990s? Note a Trojan, is not the same thing as a virus. A virus self propagates, a trojan propagates when a user overrides a security warning. Viruses have been a problem for Windows for decades, but not a problem on macs, since the late 1980s, possibly early 1990s.

SpiderX 15y ago
I think that's more to do with "herd immunity" than anything else. There haven't been enough macs communicating with macs to have widespread damage from a mac virus.
blub 15y ago
"Hey, this trojan has stolen our CC numbers, photos and personal documents, but at least it's not a virus! THAT would have been really bad...". And please try to keep up with the latest developments, this trojan requires no user intervention. Not running Little Snitch + antivirus at this point is just ignorant and asking for it.