OS X – Safe, yet horribly insecure • Hacker News Board

Re: OS X – Safe, yet horribly insecure

#41

Post by vogonj » Sat, Jun 25, 2011, 8:58 PM UTC

olliesaunders wrote: post #34

5teev wrote: post #12

> A lot of OS X users seem to have this idea that Apple hired only the best of the best when it came to programmers while Microsoft hired the cheapest and barely adequately skilled... Is this really a commonly held belief? I've never encountered anyone expressing this opinion.

It’s possible some people might believe that, perhaps not HN readers But the quality of the management plays a very important role in the quality of the end result: Apples has Jobs and Microsoft has Ballmer. So Microsoft is at a disadvantage human-resource-wise.

As an engineer (though admittedly one at Microsoft), Steve Jobs seems like he'd be a /horrible/ boss. All appearances suggest that he doesn't care about good engineering, but rather that he cares about good user experience, damn the torpedoes.

Re: OS X – Safe, yet horribly insecure

#42

Post by gojomo » Sat, Jun 25, 2011, 8:59 PM UTC

ralfd wrote: post #17

comex wrote: post #5

Although it's not officially documented, Snow Leopard's sandbox is already quite capable and easier to use than the norm; it's nonsensical to list "sandboxing" and "mandatory access controls" as wins for other operating systems. Lion will make it mandatory for all App Store apps and add features like a secure open dialog (where the OS handles the open dialog and gives the app access to only user-selected files) and a…

I want an optional feature which only allows the OS to execute MacAppStore programs. This would be "grandparent proof" and would prevent trivial kinds of social engineering used by MacDefender (which targeted clueless users).

I'd be very likely to buy this for my mother or recommend it to others who need a simple and safe environment.

With a bit more polish, a Linux locked to a rigorously maintained package repository could also fill this niche.

Re: OS X – Safe, yet horribly insecure

#43

Post by X-Istence » Sat, Jun 25, 2011, 9:03 PM UTC

nwmcsween wrote: post #32

api wrote: post #28

"The Unix Design is significantly less granular than Windows..." That's why it's more secure. Complexity means you don't know what's going on. Complexity means you will forget something. Complexity means there's more likely to be a way to squeeze through, more likely to be a bug, more likely to be a little thing that is forgotten. This is also a problem with complex cryptographic APIs, overly complicated things like…

Unix by far is not secure. Access control via unix permissions is a mess, this is why we have selinux, apparmor, smack... The whole 'complexity' argument is moot todays unix with selinux, chrooting, jails, apparmor is much more complex than say a capability based security.

ACL's are not even close to what selinux, apparmor, and smack are trying to accomplish.

Re: OS X – Safe, yet horribly insecure

#44

Post by vogonj » Sat, Jun 25, 2011, 9:03 PM UTC

zdw wrote: post #2

They often share vulnerabilities with core libraries in other UNIX like systems with samba and java being two examples. Good thing that Lion jettisons both (Samba for going GPLv3, and Java is non-core download) The firewall functionality in OS X is impressive, but hardly utilized. The underlying technology is ipfw Also changed in Lion, which now uses OpenBSD's pf. Apple doesn't make much more use of it though. It has…

The point he was trying to get across is that Apple shares attack surface with other Unix operating system vendors, which -- given his assessment of them as derelict in resolving vulnerabilities -- increases the harm their users are exposed to while Apple is sitting on fixes that other vendors have already written and deployed.

No piece of software is synonymous with insecurity -- except, perhaps, Sendmail. ;)

Re: OS X – Safe, yet horribly insecure

#45

Post by Hawramani » Sat, Jun 25, 2011, 9:05 PM UTC

nwmcsween wrote: post #32

api wrote: post #28

"The Unix Design is significantly less granular than Windows..." That's why it's more secure. Complexity means you don't know what's going on. Complexity means you will forget something. Complexity means there's more likely to be a way to squeeze through, more likely to be a bug, more likely to be a little thing that is forgotten. This is also a problem with complex cryptographic APIs, overly complicated things like…

Unix by far is not secure. Access control via unix permissions is a mess, this is why we have selinux, apparmor, smack... The whole 'complexity' argument is moot todays unix with selinux, chrooting, jails, apparmor is much more complex than say a capability based security.

Can you mention specific issues with Unix permission management that Windows solves?

Re: OS X – Safe, yet horribly insecure

#46

Post by X-Istence » Sat, Jun 25, 2011, 9:06 PM UTC

davidu wrote: post #37

This is actually just the tip of the iceberg for OS X vulnerabilities. On the enterprise side, it's much much worse. AFP is heinous. Their kerberos implementations are painful. They actually have checkboxes in OS X server config screens that say: "Prevent man in the middle attacks? Yes or No?"

I don't know any enterprise installations of Mac OS X Server that use AFP.

As for kerberos, that is painful on any platform. At the moment at work I am trying to figure out why Mac OS X takes 10 minutes to connect to a Windows Server 2003 based file share, all I see with Wireshark is a bunch of Kerberos stuff being thrown around, whereas Windows clients connect without issues, but without ever attempting to use Kerberos.

Re: OS X – Safe, yet horribly insecure

#47

Post by X-Istence » Sat, Jun 25, 2011, 9:07 PM UTC

16s wrote: post #33

One point I would add is that by default, Macs have Perl, Python and Ruby (I think). So it's easy to script malware or write portable tools. I'm not suggesting that these languages are insecure or should not be installed, only that a malware designer can pretty much count on having them available to use. This may make Mac/Linux cross-platform malware easier as well.

Those applications aren't launched or available from the outside. If the user runs/double clicks on something it is already game over. Social engineering attacks are never going away so long as humans are humans and want to see Anna Kournikova naked.

Re: OS X – Safe, yet horribly insecure

#48

Post by ugh » Sat, Jun 25, 2011, 9:11 PM UTC

ralfd wrote: post #17

comex wrote: post #5

Although it's not officially documented, Snow Leopard's sandbox is already quite capable and easier to use than the norm; it's nonsensical to list "sandboxing" and "mandatory access controls" as wins for other operating systems. Lion will make it mandatory for all App Store apps and add features like a secure open dialog (where the OS handles the open dialog and gives the app access to only user-selected files) and a…

I want an optional feature which only allows the OS to execute MacAppStore programs. This would be "grandparent proof" and would prevent trivial kinds of social engineering used by MacDefender (which targeted clueless users).

You can turn on parental controls and select which apps a user can execute, either per checkbox or (if they are from the App Store) based on age ratings.

Parental controls will, however, disable installing apps for the user completely. They get a prompt asking for the admin password. As far as I can see there is no way to enable users to only install apps from the app store. By the way, there is such an option in iOS.

I don't think anyone ever complained about them adding options to the parental controls, so Apple could absolutly add an option to install only App Store apps to the parental controls.

Re: OS X – Safe, yet horribly insecure

#49

Post by vogonj » Sat, Jun 25, 2011, 9:12 PM UTC

X-Istence wrote: post #46

davidu wrote: post #37

This is actually just the tip of the iceberg for OS X vulnerabilities. On the enterprise side, it's much much worse. AFP is heinous. Their kerberos implementations are painful. They actually have checkboxes in OS X server config screens that say: "Prevent man in the middle attacks? Yes or No?"

I don't know any enterprise installations of Mac OS X Server that use AFP. As for kerberos, that is painful on any platform. At the moment at work I am trying to figure out why Mac OS X takes 10 minutes to connect to a Windows Server 2003 based file share, all I see with Wireshark is a bunch of Kerberos stuff being thrown around, whereas Windows clients connect without issues, but without ever attempting to use Kerbe…

your Windows clients are probably using NTLM (or NTLMv2), Microsoft's old, terrible auth protocol that the Windows team eventually abandoned for Kerberos. there are policy settings you can change to force Kerberos; I'd suggest Googling to see if you can find them, and see if it breaks your Windows clients as bad as your OS X clients seem to be.

Re: OS X – Safe, yet horribly insecure

#50

Post by X-Istence » Sat, Jun 25, 2011, 9:17 PM UTC

vogonj wrote: post #49

X-Istence wrote: post #46

Earlier quoted context omitted.

I don't know any enterprise installations of Mac OS X Server that use AFP. As for kerberos, that is painful on any platform. At the moment at work I am trying to figure out why Mac OS X takes 10 minutes to connect to a Windows Server 2003 based file share, all I see with Wireshark is a bunch of Kerberos stuff being thrown around, whereas Windows clients connect without issues, but without ever attempting to use Kerbe…

your Windows clients are probably using NTLM (or NTLMv2), Microsoft's old, terrible auth protocol that the Windows team eventually abandoned for Kerberos. there are policy settings you can change to force Kerberos; I'd suggest Googling to see if you can find them, and see if it breaks your Windows clients as bad as your OS X clients seem to be.

I had not thought about that, would OS X fall back to using that in case Kerberos doesn't function? Thanks for the suggestion!