RE: Mac OS X no longer immune to viruses!

-----Original Message-----
From: Michael D. Ober [mailto:"obermd."@.alum.mit.edu.nospam]
Sent: May 4, 2006 9:04 AM
To: Info-VAX@xxxxxxxxxxxx
Subject: Re: Mac OS X no longer immune to viruses!



"Karsten Nyblad" <nospam@xxxxxxxxxxxxx> wrote in message
news:4459cd57$0$60786$157c6196@xxxxxxxxxxxxxxxxxxxxxxxx
Bob Koehler wrote:
In article
<445852b9$0$67263$157c6196@xxxxxxxxxxxxxxxxxxxxx>, Karsten
Nyblad <nospam@xxxxxxxxxxxxx> writes:

Michael D. Ober wrote:

If the MacIntosh becomes more common, it's security by obscurity
security
model will fail.

The same thing could be said about VMS. OS X is based on the MACH
kernel, where most of the processing takes place in
processes that do
not have access to more than they need. VMS is not
superior by design
to OS X when it comes to security. VMS might be better
coded and might
have better coding standards, but it is naive to think
that there are no
security bugs hidden in the millions of lines of code of VMS.


VMS does notrely on security by obscurity. That's FUD.
VMS _is_
superior by design than any UNIX based OS. Sure, there
might be a bug
in there somewhere but it IS the design that makes the
difference.

You did not get my point. OS X does not relay on security
by obscurity
either. Thus it is also FUD to claim that OS X does.


When an OS has as little market share as OS X has had in the
past, for all
practical purposes it is obscure to virus writers. They
simply won't target
it because they can't make as much havoc or steal as much
with it. Thus,
Security By Obscurity.

Mike.


Please .. Lets not be juvenile about this.

"security by obscurity" is another term similar to "legacy" that is
often used by those that are less informed when they want to make
derogatory comments about something they know very little about.

No vendor plans their security by obscurity, so those that state
otherwise are those that fall into the bucket of "less informed".

No vendor makes a platform that is 100% secure - heck, just watch
Mission Impossible II movie. Yes, I know it's a movie, but you can see
my point.

Are some platforms inherently more secure by design?

Absolutely.

Do the platforms that are more secure have the same market share as
those that are less secure by design?

Perhaps not, but design and market share are two different topics, so
please do not mix the two. Stay focussed.

The fact is that there are some platforms that are inherently better
designed from a base security perspective. And while less secure
platforms can be made more secure with additional labour, attachments
and wrapping etc, when kernel or some other base security issues are
constantly being uncovered in that base design, all of the wrappings,
additional effort to retest applications etc need to be re-done after
the patch is applied.

Now, if this security issue on less secure platforms were an occasional
incident, then the impact to Customers would be minimal. However, when
these base security issues become a monthly occurrence
(Windows/Linux/others), then this really is a big opportunity for
hackers as they know that when companies have hundreds of these servers,
the chance of these servers being up to date with patches is slim to
none.

As a recent post indicated, the reason hackers focus on the weaker
platforms is very simple - it is because they can. Being successful and
bragging rights is what drives the hacker community.

An analogy might be to ask the question "why do street crooks attack
corner stores, liquor stores and not go after the bigger banks, casino's
etc?"

Simple - the crooks know they have a much better chance at being
successful attacking less secure targets than a bank or a casino. Of
course, that is not to say the bank or the casino can not be hit, just
that to do this requires a much more sophisticated attack.

HP OpenVMS is like the bigger bank or the casino.

If you want some additional background on this, check out:

http://h71028.www7.hp.com/ERC/downloads/4AA0-2896ENW.pdf

http://h71000.www7.hp.com/openvms/whitepapers/TCS_2004.pdf


Regards

Kerry Main
Senior Consultant
HP Services Canada
Voice: 613-592-4660
Fax: 613-591-4477
kerryDOTmainAThpDOTcom
(remove the DOT's and AT)

OpenVMS - the secure, multi-site OS that just works.
.

Relevant Pages

  • Re: etc/passwd file
    ... it would still be secure. ... >effective form of security. ... the password database was known to all, ... All I can say is if that were the design criteria then they failed miserably. ...
    (comp.security.unix)
  • Re: etc/passwd file
    ... it would still be secure. ... ]>effective form of security. ... ]the password database was known to all, ... ]All I can say is if that were the design criteria then they failed miserably. ...
    (comp.security.unix)
  • An Interview with Gary McGraw, Co-author of Exploiting Software: How to Break Code
    ... about software security. ... having co-authored the classic Building Secure ... which covered the design and implementation of secure code ... an attacker can get an attack payload to execute, ...
    (comp.os.linux)
  • An Interview with Gary McGraw, Co-author of Exploiting Software: How to Break Code
    ... about software security. ... having co-authored the classic Building Secure ... which covered the design and implementation of secure code ... an attacker can get an attack payload to execute, ...
    (comp.os.linux.security)
  • Re: Lille-Strasbourg TGV
    ... providing enough security for a nation that is at war. ... those boarding at Amsterdam to take place on the train. ... have a similar problem at Bruxelles where the secure platforms are north ...
    (uk.railway)