How safe are apples?

JustPassingBy

Blacksheep1979 wrote: »

I'm sorry, are you stupid?

I was hoping to make it through today without being gratuitously insulted.

Originally Posted by JustPassingBy
Services are attacked by worms. Any system is vulnerable. The solution is to keep the it up-to-date. Then you are safe.

Blacksheep1979 wrote:

Why are there updates? Ooooh because there are vulnerabilities.

I do not know why you repeated what I said above

Also read about the pwnToOwn comp and you'll find all computers were fully patched and the contestants had to think up new, not previously existing exploits. So how come people manage that on a fully patched system if you are safe?

I'm bemused by the comments on site you gave the link to. They verge on the hysterical. The news appears to be that a vulnerability has been discovered in a browser. I will leave aside the complete lack of detail on how severe it is and merely say - so what! Anyone on any platform who expects bug free applications is expecting too much.

So where do we go from there. Well, the software gets to be fixed. And now you are safe again.

Brian.

Blacksheep1979

I'm just slightly confused that despite the evidence and what I think is a sound argument (that as exploits are found - proof of this being security updates) you claim that apple systems are 'safe'. What happens to people who don't update immediately, the time period between discovery and fix? etc

On the insulting you part, I was asking a question - it is only your own ignorance which is insulting you.

JustPassingBy

Blacksheep1979 wrote: »

I'm just slightly confused that despite the evidence and what I think is a sound argument (that as exploits are found - proof of this being security updates) you claim that apple systems are 'safe'.

You're equating 'safe' with 'no flaws'. Human beings attempt to make things as safe as possible and then build on that. It's when they don't respond to security or safety concerns promptly that you should start to worry.

What happens to people who don't update immediately, the time period between discovery and fix? etc

Probably nothing. There is a wide variety of software in use and the exploit may only target a small subset of the population. How many computers on the net? A thousand million? Even if it's were something like an effective worm (and those are rare) you have time to update and become safe. Provided your vendor provides responds quickly, of course.

But if there are some affected, hard luck. Somebody's got to first. And if they are running as root or using out-of-date software with known issues your sympathy for them may be reduced.

Incidentally, I've not made any reference to Apple. What I've said applies on any platform.

On the insulting you part, I was asking a question - it is only your own ignorance which is insulting you.

You'll probably want a third go so I'll leave space here.





Brian.

PROLIANT

They are prone to brusing if you drop them....

jmc160

JustPassingBy wrote: »

No it's not, but it would have been useful to know we are talking about the same two pieces of malware.

First hit:

http://www.scmagazine.com/uk/news/article/541952/second-mac-virus-wild/

That's a worm, not a virus. It exploits a vulnerability in a service.

Second hit:

http://blogs.msdn.com/nadyne/archive/2006/02/15/533022.aspx

That's a trojan. It doesn't spread and has to be run by root.

Worms, trojans and rootkits are a concern, not viruses.

There hasn't been a decent worm attack for ages but having software up-to-date works works wonders as a defence. You can't do much about trojans if someone is careless enough to install an run an unknown software as root.

So we are back to precisely zero viruses.

Brian.

Sorry, but worms, trojans and rootkits aren't a 'concern', they're major threats.

I mean come on, now you're just being pedantic! Besides, in the real world, the term "virus" is used more generically to describe any number of different types of unwanted intrusion or malware.

Face it, the argument's lost.

JustPassingBy

jmc160 wrote: »

Sorry, but worms, trojans and rootkits aren't a 'concern', they're major threats.

They offer a minimal threat to a well secured machine.

I mean come on, now you're just being pedantic! Besides, in the real world, the term "virus" is used more generically to describe any number of different types of unwanted intrusion or malware.

That's quite common, unfortunately. But imprecision in the use of language is all around us and contributes to allowing advertising and anti-virus companies to bamboozle us. I'd prefer not to follow their lead.

A trojan, for example, has to be executed by a user whereas a worm requires a network for its transmission. That's not a trivial difference. For a start it points to the different measures which need to be taken to defend against each threat.

Face it, the argument's lost.

Naming one virus which works on a unix-based OS. That's all it takes to destroy the argument. Just one.

Brian.

jmc160

JustPassingBy wrote: »

Naming one virus which works on a unix-based OS. That's all it takes to destroy the argument. Just one.

Brian.

So will providing references that prove a Mac is impenetrable.

The original question, as I read it, was never about viruses specifically, it was about generally how safe a Mac really is. You seem to have just latched on to one little loophole in the debate and clung to it for dear life.

So if we look at it in terms of not just viruses, but threats, then the proof has been provided in post 49... by you!

superscaper

OSF.8759, Staog, Bliss

There's three.

Here's a report on looking at increasing malware on unix based systems: http://www.viruslist.com/en/analysis?pubid=184625030

Blacksheep1979

JustPassingBy wrote: »

They offer a minimal threat to a well secured machine.

Which apples obviously aren't if a fully patched one can have code remotely executed within 2 mins...

JustPassingBy wrote: »

Naming one virus which works on a unix-based OS. That's all it takes to destroy the argument. Just one.

Brian.

I supposed you are going to go down the pedants route of claiming you asked for one and superscaper named three...


Just because the apple os is BASED on free bsd doesn't mean it has all the same strengths and weaknesses - the mac fell in 2mins, the windows machine in 2 days, the linux one wasn't properly penetrated. I think the facts speak for themselves but whether they get past those fingers and into your ears is questionable.

JustPassingBy

superscaper wrote: »

OSF.8759, Staog, Bliss

OSF.8759

From http://www.viruslist.com:

'The virus infects all the files in the current directory, but avoids infecting files with file names ending with "ps".'

and

'If run from a root account the virus will also attempt to infect the files from the "/bin" system directory. In all cases no more than 201 files are infected in one run.'

Has be run. Doesn't spread. Can't cross system boundaries. Can't spread between machines. A user can't place it in /bin. Not a virus.

Staog

From http://mirror.sweon.net/madchat/vxdevl/vxsrc/Linux/Linux.Staog/Linux.Staog.asm

# | yo ho.. welcome to yet another attempt at the |
# | impossible and improbable. This virus is a fully |
# | resident linux elf infector. It will infect files |
# | on execute regardless of who executed them. |
# | It achieves this by hacking root via 3 separate |
# | exploits and installing itself in the kernel. It leaves |
# | no trace of itself in drop files or other noticable |
# | locations but contains no stealth of any type. |
# | |
# | This is not a script virus. It is written in 100% |
# | at&t style asm. To compile: |
# | |
# | gcc vircode.s -o vircode |
# | strip vircode |
# | |
# | The filesize should be 4744 bytes. If not put the filesize |
# | in the .long at 'filesize:' and recompile and strip. |
# | Then execute to install. After installation the |
# | generated binary will automatically be deleted. |
# | |
# | For some reason this virus will only work on ELF machines |
# | running the 1.2.13 kernel.

Written in 1996. Kernel 1.2.13 only!! Proof of concept code. Not known in the wild (which is not surprising, given the kernel version)! Has to be run. Doesn't spread. You'd have to make a massive effort to get it going. Bob the Builder could do better. Not a virus. Classify as a trojan but who cares.

Bliss

http://math-www.uni-paderborn.de/~axel/bliss/

is as good a place to visit as any. Alan Cox says it's trojan with worm-like characteristics. Who am I to disagree with him? Anyway, a user running it cannot damage the system or other users' files. Proof of concept code.

Here's a report on looking at increasing malware on unix based systems: http://www.viruslist.com/en/analysis?pubid=184625030

I was wondering what to do about bedtime reading.

Brian.