• Explore the magic and the mystery!

    • « HP’s Curious Printer Setup Confounds Devoted Mac User
    The Windows User’s Dilemma: They Hear But Do Not See »

    Newsletter #386 Preview: More Mac Security Monkey Business

    April 23rd, 2007

    One of the lamer suggestions I heard from an instructor at some unmentionable educational institution some years back was that you could boost the number of graduates simply by lowering the standards. At the time, I thought the person who made this foolish statement probably could use a new job, perhaps one at a local fast food restaurant.

    I’ll explain what I’m getting at shortly.

    To begin with, as Apple patches more and more security leaks in Mac OS X, you have to wonder when or if any of them will be exploited. I mean, if you read the nasty details of a typical problem, you can’t help but feel just a little less secure.

    Take the most recent update released this month. Among over two dozen fixes was one that addressed this deficiency: “A memory corruption vulnerability exists in fsck. It is possible to cause fsck to be run automatically on a disk image when it is opened. By enticing a user to open a maliciously-crafted disk image, or to run fsck on any maliciously-crafted UFS filesystem, an attacker could trigger the issue which may lead to an unexpected application termination or arbitrary code execution.”

    All right, we’ve all got to be on the lookout for a “maliciously-crafted UFS filesystem” or a “maliciously-crafted disk image.” Heaven knows what’ll happen.

    On the other hand, has there ever, anywhere, been such an attempt other than in a laboratory?

    Story continued in this week’s Tech Night Owl Newsletter.

    Related Posts:





    This article was posted on Monday, April 23rd, 2007 at 12:42 AM and is filed under News and tagged with: , , , , , , , , , .

    Share
    | Print This Post Print This Post

    2 Responses to “Newsletter #386 Preview: More Mac Security Monkey Business”

    1. KT says:
      April 23, 2007 at 7:26 PM

      >>Wouldn’t an Internet criminal want to be the first to infect that crowd? Consider the ego satisfaction, >>and perhaps the money earned for converting millions and millions of Macs into spam-bots, just as >>Windows boxes are now.

      They aren’t motivated by the glory, not any more, they’re motivated by $ – spam bots, harvesting financial info, credit card numbers, etc. It’s the *ratio* of PCs to Macs that make Macs not worth the investment. And if you consider the number of PC servers to Mac servers (the most vulnerable for bot farms), that number is probably well in excess of 100:1.

      Really, you have to pay someone $10,000 to bother hacking a Mac – not that it’s particulary hard 🙂

      http://blog.washingtonpost.com/securityfix/2007/04/hacker_conference_challenge_ne_1.html?nav=rss_blog

      Reply
    2. Gene Steinberg says:
      April 23, 2007 at 8:01 PM

      >>Wouldn’t an Internet criminal want to be the first to infect that crowd? Consider the ego satisfaction, >>and perhaps the money earned for converting millions and millions of Macs into spam-bots, just as >>Windows boxes are now.

      They aren’t motivated by the glory, not any more, they’re motivated by $ – spam bots, harvesting financial info, credit card numbers, etc. It’s the *ratio* of PCs to Macs that make Macs not worth the investment. And if you consider the number of PC servers to Mac servers (the most vulnerable for bot farms), that number is probably well in excess of 100:1.

      Really, you have to pay someone $10,000 to bother hacking a Mac – not that it’s particulary hard

      http://blog.washingtonpost.com/securityfix/2007/04/hacker_conference_challenge_ne_1.html?nav=rss_blog

      Even then, they had to lower the standards to get anyone to succeed. That hasn’t been widely reported.

      Peace,
      Gene

      Reply

    Leave Your Comment