5 ms·

On the positive side, perhaps the publicity will cause Apple to tighten up. They have demonstrated that they are serious about security.

tomflack 14y ago
Have they? (Honest question.)
- uxp 14y ago
  I would argue that yes, they have. They removed the copy on their website that claimed that "Macs don't get PC Viruses"[1]. They disabled automatic execution of Java Applets in response to Flashback[2]. The introduction of Gatekeeper and the App Store model shows their intention for reducing the vectors average users can install random software (which reduces rogue installations like Flashback). ASLR is fully implemented in Lion now, and the inclusion of FileVault 2 suggests they are aware of and trying to mitigate offline attacks[3] Regardless if you think this is enough, it does show that they are doing something. For every couple steps forward in closing a security issue, issues such as this article show that more could be done. Security is hard, no OS or company will ever be Perfectly Secure(tm). Apple is not "doing nothing". Claiming that they aren't is an uneducated answer, claiming that they could do more and be more transparent about it is a more valid argument. [1] http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ [2] http://support.apple.com/kb/HT5242 http://support.apple.com/kb/HT5242 [3] http://www.securitynewsdaily.com/960-apple-mac-osx-lion-security.html http://www.securitynewsdaily.com/960-apple-mac-osx-lion-secu...
  - sidewalksuper 14y ago
    I would also argue that with iOS, they have the safest (big) mobile OS available as well. ASLR and DEP have long been implemented and with iOS 6 they are also implementing Kernel ASLR. Almost everything is sandboxed and there are no known viruses out there (for devices that haven't been jailbroken). Jailbreaks are still possible (like you said nothing is perfectly secure), but have been slowed down to a point where hackers wait for a big OS release, before they decide to burn the exploits.
reinhardt 14y ago
I don't know, I have mixed feelings about this. It's akin to building even more inscrutable captchas or tightening up airport security measures every time a new breach happens. At best it might close one particular loop hole but at what cost and incovenience to millions of people and billions of transactions? I had the misfortune to lock myself out of my bank account once or twice and the process for unlocking it was so dreadful (a 30 minutes interrogation with questions like "when and where did I make my last ATM transaction") that since then I keep the required sensitive info in a GPG encrypted file so that I never have to call them again. Other equally frustrated but less tech savvy customers are probably doing the same with post-it notes. Is this an improvement?
- omgbear 14y ago
  Sure - you need physical access to get to someone's post-its. Might as well install a keylogger then.
- orbitingpluto 14y ago
  I was out of town and went to make a large cash purchase. (The retailer added a very hefty 10% for using debit or credit cards.) So I ran into the problem of a daily cash withdrawal at the ATM. I also did not have anything with me other than an ATM card and a Credit card with me (No ID). Turned out the bank didn't even ask for my ID when I went in. I just explained my situation and they just handed over a couple thousand... Security at the bank seems discretionary at best.
  - rogerbinns 14y ago
    > Security at the bank seems discretionary at best No, it is a cost benefit decision. Do you know they don't check the signature on cheques or credit card transactions? Heck I bet if you mail in a change of address they will go ahead and do it, possibly sending something to your old address. The reality is that fraud is at low levels compared to legitimate transactions. Putting in lots of extra hoops just makes the legitimate transactions harder, and chances are it won't affect those trying to commit fraud since they have a wide variety of things to try while tellers don't (eg fake id in this case). In this specific case, anyone coming into the branch is on security cameras inside and out. TV shows, the Internet and technology make it increasingly easier to match up the footage with real people. And the bank doesn't bear the full costs of any investigation since they are passed off to the police/FBI. If you ran the bank would you add a dollar in expenses and one minute per transaction that has a 10% chance of catching fraud, and fraud occurs one in every 25,000 transactions? Would you have the same measures in every branch across the country or have their expense and severity proportional to the amount of fraud that does actually happen at any location? Despite what we see in films and TV shows, bank robbery is pitiful way to not make money: http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbing-Banks-Really-Doesnt-Pay.aspx http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbin... http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-stats-show-lu.html/ http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-sta...
encoderer 14y ago
I have no idea if this is related, but just now I attempted to purchase an app on the Mac AppStore and, after authenticating, I was given a prompt to re-enter my password and: Improve Apple ID Security - To help ensure the security of your Apple ID, choose three security questions and answers. Just random because I don't have challenge responses on record, or immediate low-hanging fruit in response to this breach?
- _djo_ 14y ago
  Probably just a result of having no challenge responses on record. I experienced something similar a couple of months ago.

tomflack 14y ago

Have they? (Honest question.)

uxp 14y ago
I would argue that yes, they have. They removed the copy on their website that claimed that "Macs don't get PC Viruses"[1]. They disabled automatic execution of Java Applets in response to Flashback[2]. The introduction of Gatekeeper and the App Store model shows their intention for reducing the vectors average users can install random software (which reduces rogue installations like Flashback). ASLR is fully implemented in Lion now, and the inclusion of FileVault 2 suggests they are aware of and trying to mitigate offline attacks[3] Regardless if you think this is enough, it does show that they are doing something. For every couple steps forward in closing a security issue, issues such as this article show that more could be done. Security is hard, no OS or company will ever be Perfectly Secure(tm). Apple is not "doing nothing". Claiming that they aren't is an uneducated answer, claiming that they could do more and be more transparent about it is a more valid argument. [1] http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ http://www.wired.com/wiredenterprise/2012/06/mac_viruses/ [2] http://support.apple.com/kb/HT5242 http://support.apple.com/kb/HT5242 [3] http://www.securitynewsdaily.com/960-apple-mac-osx-lion-security.html http://www.securitynewsdaily.com/960-apple-mac-osx-lion-secu...
- sidewalksuper 14y ago
  I would also argue that with iOS, they have the safest (big) mobile OS available as well. ASLR and DEP have long been implemented and with iOS 6 they are also implementing Kernel ASLR. Almost everything is sandboxed and there are no known viruses out there (for devices that haven't been jailbroken). Jailbreaks are still possible (like you said nothing is perfectly secure), but have been slowed down to a point where hackers wait for a big OS release, before they decide to burn the exploits.

reinhardt 14y ago

I don't know, I have mixed feelings about this. It's akin to building even more inscrutable captchas or tightening up airport security measures every time a new breach happens. At best it might close one particular loop hole but at what cost and incovenience to millions of people and billions of transactions? I had the misfortune to lock myself out of my bank account once or twice and the process for unlocking it was so dreadful (a 30 minutes interrogation with questions like "when and where did I make my last ATM transaction") that since then I keep the required sensitive info in a GPG encrypted file so that I never have to call them again. Other equally frustrated but less tech savvy customers are probably doing the same with post-it notes. Is this an improvement?

omgbear 14y ago
Sure - you need physical access to get to someone's post-its. Might as well install a keylogger then.
orbitingpluto 14y ago
I was out of town and went to make a large cash purchase. (The retailer added a very hefty 10% for using debit or credit cards.) So I ran into the problem of a daily cash withdrawal at the ATM. I also did not have anything with me other than an ATM card and a Credit card with me (No ID). Turned out the bank didn't even ask for my ID when I went in. I just explained my situation and they just handed over a couple thousand... Security at the bank seems discretionary at best.
- rogerbinns 14y ago
  > Security at the bank seems discretionary at best No, it is a cost benefit decision. Do you know they don't check the signature on cheques or credit card transactions? Heck I bet if you mail in a change of address they will go ahead and do it, possibly sending something to your old address. The reality is that fraud is at low levels compared to legitimate transactions. Putting in lots of extra hoops just makes the legitimate transactions harder, and chances are it won't affect those trying to commit fraud since they have a wide variety of things to try while tellers don't (eg fake id in this case). In this specific case, anyone coming into the branch is on security cameras inside and out. TV shows, the Internet and technology make it increasingly easier to match up the footage with real people. And the bank doesn't bear the full costs of any investigation since they are passed off to the police/FBI. If you ran the bank would you add a dollar in expenses and one minute per transaction that has a 10% chance of catching fraud, and fraud occurs one in every 25,000 transactions? Would you have the same measures in every branch across the country or have their expense and severity proportional to the amount of fraud that does actually happen at any location? Despite what we see in films and TV shows, bank robbery is pitiful way to not make money: http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbing-Banks-Really-Doesnt-Pay.aspx http://www.thefiscaltimes.com/Articles/2012/06/11/Why-Robbin... http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-stats-show-lu.html/ http://crimeblog.dallasnews.com/2009/04/new-bank-robbery-sta...

encoderer 14y ago

I have no idea if this is related, but just now I attempted to purchase an app on the Mac AppStore and, after authenticating, I was given a prompt to re-enter my password and: Improve Apple ID Security - To help ensure the security of your Apple ID, choose three security questions and answers. Just random because I don't have challenge responses on record, or immediate low-hanging fruit in response to this breach?

_djo_ 14y ago
Probably just a result of having no challenge responses on record. I experienced something similar a couple of months ago.