Month: May 2011

Mac OS X is soooo secure that Apple has designed the default setting in the Safari browser to allow “safe files” to download and execute automatically, making it super easy for the “MacGuard” successor to the “MacDefender” malware (that Apple has finally responded to) to install itself on OS X machines running in an admin account session… which an enormous number of Mac users–like Windows users–do.

I guess Apple bought into their own “OS X is secure” propaganda, because when Safari installs on Windows machines it, like all the other mature browsers–and even Internet Exploder *heh*–defaults to asking if the user is sure about downloading a file and warns it could be dangerous.

Oh, but that’s for Windows machines. Have to maintain the fiction of Mac invulnerability, so not gonna do that on OS X machines, no matter how it might endanger the users.

Dumb move, Apple. It’s already caught you with your pants down and until you admit your users need at least a warning, and get the word out widely in your user base, it’s gonna keep biting you on your bare ass.

It is going to be amusing to watch the slow awakening of folks who’ve accused anyone who pointed out the tiniest lil flaw in the Apple fantasy world of “hate speech” or worse when, little by little, their little fantasy world crumbles beneath their feet.

BTW, which OS was hacked first in the Pwn2Own meet recently? Hmmm? 😉 5 Seconds to fail.

On a most basic level the attack exploited Apple’s weak memory protections in OS X Snow Leopard. Microsoft, more popular and more commonly attacked, includes two critical types of memory protection — data execution prevention and robust address space layout optimization (ASLR) — both of which attempt to prevent memory injection attacks. By contrast, Snow Leopard only supports ASLR and the implementation is badly botched according to hackers.

The attack also exploited poor coding in Apple’s branch of WebKit, which features many bugs and security flaws. While Apple’s WebKit branch, which powers its Safari browser, shares a certain amount of code with Google’s WebKit browser Chrome, Google has added much more robust security layers and is less buggy.

Just sayin’.

In past years the contest has been dominated by OS X hacking/security pro Charlie Miller. So it was nice to see a fresh face for a change, though the MacBook was still the first to fall — as usual. Mr. Miller sums up OS X security the best, with his famous remark, “Mac OS X is like living in a farmhouse in the country with no locks, and Windows is living in a house with bars on the windows in the bad part of town.”

Now, before anyone accuses me of “hating on Apple” please note that I’m just stating facts here, ‘K? Apple has deliberately misled folks for years about the security of OS X (not the “the MacBook was still the first to fall — as usual” comment above) and stonewalled AppleCare subscribers with, essentially, “Screw you” when asked for help with the “MacDefender” malware issue, so Apple deserves a swift kick in the ass, as far as I’m concerned. I’ve delivered a few M$’s way from time to time, and it’s only fair that when Apple acts evil that it gets some mud in its eye.

While my Wonder Woman, Son&Heir and I are using the nearest available public WiFi (“Family Night” at the Library! *heh*), I’m taking time to post some schadenfreude-laden “nanny-nanny-boo-boo” in the MacWarz! category:

---

Waiting on the class action lawsuit based on the “Mac Defender” malware and its more robust and sneaky successor(s?) Why? Because Apple misled naive users. They said, specifically, that no user intervention is necessary to protect users from malware.

From http://www.apple.com/why-mac/better-os/

Safeguard your data. By doing nothing.

With virtually no effort on your part, Mac OS X defends against viruses and other malicious applications, or malware. For example, it thwarts hackers through a technique called “sandboxing” — restricting what actions programs can perform on your Mac, what files they can access, and what other programs they can launch. Other automatic security features include Library Randomization, which prevents malicious commands from finding their targets, and Execute Disable, which protects the memory in your Mac from attacks.
Download with peace of mind.

Innocent-looking files downloaded over the Internet may contain dangerous malware in disguise. That’s why files you download using Safari, Mail, and iChat are screened to determine if they contain applications. If they do, Mac OS X alerts you, then warns you the first time you open one.

Stay up to date, automatically.

When a potential security threat arises, Apple responds quickly by providing software updates and security enhancements you can download automatically and install with a click. So you’re not tasked with tracking down updates yourself and installing all of them one by one.
Protect what’s important.

Mac OS X makes it easy to stay safe online, whether you’re checking your bank account, sending confidential email, or sharing files with friends and coworkers. Features such as Password Assistant help you lock out identity thieves who are after personal data, while built-in encryption technologies protect your private information and communications. Safari also uses antiphishing technology to protect you from fraudulent websites. If you visit a suspicious site, Safari disables the page and displays an alert warning you about its suspect nature.

Of course, none of this prevented Mac users by the droves from installing the “Mac Defender” malware, and the new procedures reluctantly posted by Apple to remove it and prevent its installation (last week Apple was simply telling AppleCare users who called, “Screw You”) WILL NOT WORK with the new version of the malware that has already been seen in the wild. Neither will all the supposed security features touted above. Go to the ZDNet article linked above for more.