Just saw the news headline on the right OS X hacked in 30 minutes

Firstly, as the article mentions there is an OS X hardening guide.

Secondly, any website worth its salt runs on a sacrificial box where if security is compromised nothing much can happen (protected from internal network and no non-public files) and can be re-imaged quickly.

Thirdly, any web software is hackable (but you don't hear how IIS is compromised do you)

Finally, if you have hardware access to a Mac then you can get the data....just boot from an install CD and change the root password.

Sigh....sometimes I love the media attention Apple is getting these days....sometimes I hate it.

Bartron

Compared to the 2min 30sec it would take to get an XP box.

Without any reference at all to how it was done, it may as well be fake. I'm not saying it's not possible, but why bother making a statement like that without any facts?

or less if you boot into safe mode

Yeah but what ZDNet fails to mention is that the hacker was given a local account and as such the exploit was a local privilege escalation, not an external.

I myself tend to treat anything coming from ZDNet with a grain of salt.

THe University of Wisconsin has given an explanation to this hack and even put up their own Mac mini to be defaced. As of the writing of this post it's still secure.

http://test.doit.wisc.edu/

There have been a lot of these alleged breakins.

I find the reaction of various sites to OS X (and Linux for that matter) fascinating.

One must remember that the whole existence of lot of vendors is based on treating the symptoms NOT the cause of problems. If trojans, viruses etc were removed, the income sources of many companies would vanish.

So, it is in their interest to say: "everybody is vulnerable" - don't get OS X, Linux, whatever - you will still be vulnerable.

At the same time, a quick look at the packets coming to the edge of my networks shows a vast amount of bad traffic, nearly all aimed at Windows.

Reality check: If OS X was really that vulnerable, where are the examples of actual exploits? If it was doable, someone would have done it just for bragging rights, if not to sell "security" software.

Security for OS X for ordinary users is simple:

o Enable the firewall
o Turn off all services (this is the default anyway)
o If you must turn on a service (like file sharing) for home use, make sure your edge firewall blocks external traffic to that port

If you really are doing server-type things (such as remote file sharing, web) get up to speed on security fast! Vulnerabilities here are still few and far between for Apache for example. However, I would be wary of file sharing.

And by the way, if you run Office 2004, MS kindly opens a port for you! Go figure..... these guys will never get it. Hopefully, of course, your edge firewall will protect you.

Good posts Feeze and Damian.

Honestly, giving a hacker access as a local user?!

What a load of crap! (i will be checking my jpeg downloads a little closer though... )

Pardon my ignorance - but what is an "edge firewall"?

Sorry a compaq take 10min to boot :P


You mentioned viewing incommin packets how do you view that and whether they are directed towards your mac or not?

Also how do you view which ports are open and how to clsoe them?

Gone in 30 minutes!

ROTFL That is GOLD! Fully sick gold!

I like in that article they say if you get hold of the boot cds you can change anything.

Well no shit, but I would still like to see the snottey 14 year old get hold of my boot cds here in melbourne.


EDIT: I really want to shoot the person who made that post sound like another "gone in 60 seconds" car movie.

Unfortunately, Mac OS X, if left on an open network, is not secure. There have been cases of machines being compromised from the internet without any trace as to how it was done using "undocumented" vulnerabilities.

Sad to say, that ZDNet artical is spot-on.

No it's not currawong.
Read the top news item on the right of the front page.

Yep, I though something was seriously fishy about the lack of information in that ZDNet article. It's sad to see people spreading FUD like that....