[Ti] Understanding security threats (was Re: Intel Mac Mini?)

[Chris Olson]

On Mar 2, 2006, at 8:35 AM, William Scammell wrote:

> while i'll grant the fact that chris has kept mum on specifics,  
> perhaps there are professional reasons for this. perhaps he works  
> in the security field.

I don't work in the security field.  And I do believe I made a (not  
too unreasonable) offer that anybody who wants to try an exploit  
please email me off-list.  So anybody who's publicly commenting that  
I'm withholding "helpful" information, and who hasn't contacted me  
off-list, is merely using the soapbox for their own purpose.

I also don't think it good policy to publicly post an exploit where  
it can be crawled and indexed by Google in the archives, and a few  
days later be available to every hacker in the universe.  I've also  
made Apple aware of the security vulnerability that yet exists in  
Launch Services.  However reporting such a thing to Apple is like  
talking to a wall with the hopes that somebody on the other side of  
the wall hears what you said.  They don't bother to respond.  They  
won't even bother to patch it until somebody releases it to the wild  
or it gets wide media attention.

I just would like Mac users to be aware that the typical Mac user has  
an illusion of being "immune" from the malware that plagues Windows.   
But it's not because Mac OS X is more secure than, or "superior" to  
Windows in design.  Merely that to develop malware for a Mac you have  
to own a Mac.  The price point for entry to the Mac platform has  
traditionally been high enough so that the average hacker or script  
kiddie doesn't bother with it - they own a cheap PC instead -  
probably running a pirated copy of Windows.

I think the Mac mini may have had somewhat of an effect on that price- 
point problem, and that more people now own Macs.  Including people  
who write malicious code.  I also think that Apple's security  
policies and the speed with which they patch vulnerable software has  
room for improvement.
-- 
Chris

-------------------------
PGP Key:  http://astcomm.net/~chris/PGP_Public_Key/
-------------------------