News, info, and opinion by Mac users, for Mac users.

March 30, 2007

security

OS vulnerability “study”

Posted Mar. 30, ’07, 7:35 AM PT by Derik DeLong
Category | Security

Firewall sign Like GI Joe says, when it comes to security, knowing is half the battle. With that said, I read OmniNerd’s 2006 Operating System Vulnerability Summary. The goal is to document the number of remote access vulnerabilities there were in Windows XP, Server 2003, Vista Ultimate, Mac OS 9, OSX Tiger, OSX Tiger server, FreeBSD 6.2, Solaris 10, Fedora Core 6, Slackware 11, SuSE Enterprise 10 and Ubuntu 6.10. The other used Nmap to scan for open services while Nessus provided vulnerability information. It’s a rather long article and well documented, but make several critical mistakes that end in the following conclusion:

As far as “straight-out-of-box” conditions go, both Microsoft’s Windows and Apple’s OS X are ripe with remotely accessible vulnerabilities.

By “straight-out-of-box”, he means “after-I-turned-on-every-service-that-I-could-find”. By ripe, he means 2 supposed vulnerabilities in the client and 7 in server. First of all, any user behind a NAT router is shielded from these attacks. Second, users (that don’t know what they’re doing) don’t generally turn on every service they can find just for kicks. Windows was susceptible, genuinely out of box (using an XP install prior to SP2).

Second, none of these exploits were actually verified. The author took the word of Nessus as gospel. I’m not saying it’s necessarily incorrect, but the fact is, we don’t know. If one is going to make a conclusion about the state of security for things, you best verify the results.

It’s interesting to see the general state of Windows, OS X, and the other various flavors of Unix, but I’m unconvinced this article is an accurate representation of that state.


1 Comments

John said:

I find this article to be full of FUD! OSX straight out of the box is more secure than any Windows box could ever be. It has been proven time and time again. How many real life viruses are on OSX. Let us count them. 0,nada,zip,zilch,none.
How many real world real breakins to an OSX machine have there ever been in it's six year history? Let us count them. 0,nada,zip,zilch,none.
Malware/spyware?
0,nada,zip,zilch,none.
So now tell me how secure or equal is Windows of any kind? FUD! Pure and simple.

March 30, 2007 11:00 AM

Leave a comment

 



Visit other IDG sites: