Text 10016, 70 rader
Skriven 2006-03-02 17:57:08 av Mike '/m' (1:379/45)
Ärende: Better Mac OS X Security Numbers
========================================
From: Mike '/m' <mike@barkto.com>


http://blogs.zdnet.com/Murphy/?p=542

===
Some things just aren't credible on their face, so when George Ou mined
Secunia's security advisories for vulnerability data to prove that Mac OS X is
less secure than Windows/XP, I had an immediate problem. According to his
research Secunia's security advisories since January 2004 cover about 238
serious Mac OS X vulnerabilities and only 95 Windows/XP ones, and a 2.5:1 ratio
favoring Windows didn't seem reasonable.

Now, in fact, Secunia doesn't issue vulnerability reports, they issue security
advisories - 37 of them with respect to Mac OS X and 151 with respect to
Windows/XP (Home and Professional only), during the period.

Since those numbers show a 4:1 ratio in Apple's favor - the opposite of what
George found - I'm guessing he got his result by looked inside each advisory to
count the CVEs it mentioned. In doing that he would have fallen into a simple
trap: Apple's policy, and therefore Secunia's, is to mention all the software
affected by a vulnerability while Microsoft's is to mention only the product
the vulnerability is in. Thus, for example, advisory 16449 lists 40 CVEs for
one actual Mac OS vulnerability in a piece of commonly called code while
advisory 16210 lists only one CVE, but affects every Windows OS and integrated
product released since ME.

Count the CVEs and this works out as about 40:1 against Apple, count actual
vulnerabilities and it's closer to 23:1 against Microsoft - and that, of
course, is a big part of how 37:151 advisories in Apple's favor got turned into
238:95 vulnerabilities in Microsoft's favor.

Unfortunately that's not the worst problem with the analysis. The biggest
problem is that he invites the reader to draw a wholly erroneous conclusion
from his numbers: that Mac OS is less secure than Windows/XP. The reality is
that a vulnerability without an exploit doesn't threaten anyone's security.
What we need to count to decide which OS is more secure, is actual exploits,
not the potential for them. For an attack to be realized the attacker has to go
through two phases:


 1) find a software or other vulnerability

 2) conceptualise, build, and deliver a working attack.

In the x86 world that second step is pretty easy, and indeed many
vulnerabilities have given rise to multiple exploits - but that hasn't been
true of MacOS. Metasploit, for example lists only five PPC payloads for MacOS X
remote attacks -and that's since its introduction.

There have been other exploits for MacOS X, but they've mostly been typical
Unix exploits: meaning that you need a legal login to get started and the
exploit is aimed at raising your permission levels. That's traditional for an
attacker in a multi-user environment, but absurd for a MacOS X desktop machine
for which the only legal user has full control already.

In Wintel's case virtually every vulnerability is exploitable; that's why there
are thousands of successful attacks and why we see a daily parade of new
viruses, worms, or other threats. Now it may be that George is being prescient
here because step two gets a lot easier with Apple's move to x86 - so next
year's numbers may be very different- but to this point the simple reality is
that almost no MacOS X users have ever been affected by viruses or worms -
while virtually every Windows/XP user wastes at least some time on this every
day.
===

  /m

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)