|
|
04-11-2007, 05:14 PM
|
|
Regular
Group: Regulars
Location: Brisbane, Queensland
|
The Mac OS X Leopard firewall failed every test.
A windoze user emailed this to me -
Quote:
Security experts knock spots off Mac OS X Leopard firewall
Even when you turn it on it's no good
By John Leyden ? More by this author
Published Friday 2nd November 2007 19:24 GMT
Everything you need to know about Virtualization at The Register's eSymposium
It's been a rocky week for security-conscious Mac fans. A rare appearance of a Trojan targeting Mac fans made it out onto the net and the release of Apple's much vaunted Leopard operating system was marred by security concerns about its firewall.
Reports of Leopard installs hanging at boot, behaviour compared by some to the Blue Screen of Death of Windows notoriety, didn't help either. An unsupported add-on extension for a Logitech mouse drive has emerged as the main suspect behind that stability issue.
[Munched]
Much has been made of the Trojan, dubbed RSPlug-A, after it was found on several porn websites. To get infected, users have to give explicit permission for the malware, which poses as a codec, to run. The firewall issue, by contrast, affects all users upgrading to Leopard - not just those hunting for free skin flicks.
Users upgrading to Leopard found the built-in firewall deactivated when they upgraded from Tiger, the previous version of Mac OS X. This removes an important defence against hacker attacks and a removes a way to prevent Mac computers infected by a worm from spreading infection. Admittedly, this is a unlikely risk, but the failing of the firewall is a surprise, given that improved security was an Apple design goal for Leopard.
A review by Heise Security found issues with the firewall run deeper than simply been turned off by default. Even after activation the technology has a number of shortcomings.
Setting a poor example
Heise notes that, in contrast to the Windows firewall, the Leopard firewall does not include a setting to allow a distinction to be made between trusted corporate networks and riskier environments, such as Wi-Fi hotspots.
If a user selected "Block all incoming connections" the firewall reportedly blocks most ports and services, but not all. Potential hackers might be able to communicate with system services such as a time server and (possibly and more seriously) with the NetBIOS name server, according to Heise. Adding to the problems, Leopard bundles older versions of three-party open source tools known to contain security bugs.
Heise's overall verdict is damning. "The Mac OS X Leopard firewall failed every test. It is not activated by default and, even when activated, it does not behave as expected. Network connections to non-authorised services can still be established and even under the most restrictive setting, 'Block all incoming connections', it allows access to system services from the internet," it concludes
"Apple is showing here a casual attitude with regard to security questions which strongly recalls that of Microsoft four years ago," it adds.
Ouch.
Other researchers have criticised Leopard's firewall, albeit to a lesser extent than Heise. Security blogger Rich Mogull reckons the firewall is a mess but he takes issue with a key Heise finding. He agrees that with "stealth mode" enabled on the firewall services show up in port scans. Crucially, however, they cant actually be used.
In fairness it's worth pointing out that Leopard's firewall in less than a week old. Glitches and security bugs accompany every major operating system upgrade, not just those from Apple.
Windows Firewall was long present in XP, but never activated by default until Service Pack 2, after the Sasser and Nimda worm outbreaks had concentrated minds at Redmond.
Let's hope it won't take a similar such incident to spur Apple into action. ®
|
|
|
|
|
|
|
|
|
04-11-2007, 05:56 PM
|
|
Regular
Group: Regulars
Location: nhulunbuy
|
most of it is scaremongering by those who will profit most from the fear they generate.
they have a vested interest in talking up issues with macs, especially with their growing market share.
|
|
|
|
|
|
|
|
04-11-2007, 06:06 PM
|
|
Regular
Group: Regulars
Location: Sydney
|
Well, if some ports weren't left open, various things would fail as soon as firewall was turned on, like file sharing and bonjour.
__________________
"Every act of creation is first of all an act of destruction." - Pablo Picasso
|
|
|
|
|
|
|
|
04-11-2007, 06:08 PM
|
|
NSLog(@"%@", [self customTitle]);
Group: Regulars
Location: Melbourne
|
Quote:
Originally Posted by Galumay
most of it is scaremongering by those who will profit most from the fear they generate.
they have a vested interest in talking up issues with macs, especially with their growing market share.
|
I disagree - I think that Apple are actually seriously lax about security with OSX. It will probably take an actual work or virus for them to get their shit together.
(BTW I agree that a lot of scaremongering is done - particularly by... ahem... Symantec)
__________________
"A company must go out and find what the customer wants ... The need is not for, say, half a million ¼-inch drill bits. The needs is that there are ten million ¼-inch holes that need to be drilled." - Robert Noyce
"Algorithms that forget their history are doomed to repeat it" - Artificial Intelligence, A Modern Approach (Russel & Norvig)
|
|
|
|
|
|
|
|
04-11-2007, 06:57 PM
|
|
Regular
Group: Regulars
Location: nhulunbuy
|
Quote:
Originally Posted by forgie
I disagree - I think that Apple are actually seriously lax about security with OSX.
|
oh they probably are, but so am i - dont run any firewalls or anti-virus. i am quite happy with just NAT on my router. so far i have got away with it for years and i dont have anything critical that would be affected in the unlikely case of something happening anyway.
i refuse to succumb to the paranoia! |
|
|
|
|
|
|
|
04-11-2007, 08:32 PM
|
|
all your InGeniuses are belong to me
Group: Regulars
Location: BrisVegas/KL
|
Quote:
Originally Posted by Rodney9
A windoze user emailed this to me -
|
Probably hoping that Mac users suffer like he/she may do 
This is a good read if you want to know more about the security features in Leopard...
http://www.matasano.com/log/981/a-ro...rity-features/
and if you want to see what ports your Mac has open at the moment (mine only has one that I will fix up soon!!)...
http://www.speedguide.net/portscan.php
__________________
15" MacBook Pro C2D 2.6Ghz 6Gb RAM, 200GB 7200 HDD, 512 VRAM & 23" Cinema Display
3g iPod 30GB & 4g iPod photo 60GB & 512Mb shuffle & 2g shuffle & iPod touch 8GB & 3G iPhone 16Gb
|
|
|
|
|
|
|
|
04-11-2007, 11:22 PM
|
|
Merry Pagan Sun God's day
Group: Administrators
Location: Fukuoka, Japan (originally Canberra)
|
The purpose of a firewall is to prevent connections to certain things. Preventing connections to your Mac is pointless for 2 reasons:
1. You're probably connecting to the internet from behind a modem/router anyway, which has the same effect.
2. Even if someone/something could connect, there's nothing they can do, as there are no security issues they could exploit.
This article is all nonsense based on the days when Windows WAS insecure when connected to the internet. Not many years ago connecting a Windows box directly to the internet left it open to invasion. Macs have NEVER been open to intrusion this way.
|
|
|
|
|
|
|
|
05-11-2007, 03:42 AM
|
|
Regular
Group: Regulars
Location: Sydney
|
Currawong, while that is mostly true, you are forgetting something. One of the purposes of a firewall is to block off a machine incase any exploits are found and used before a security update comes out.
Of course the difference between security and paranoia is often very slim these days.
__________________
"Every act of creation is first of all an act of destruction." - Pablo Picasso
|
|
|
|
|
|
|
|
