This may hev allready been discussed but....

At a quick glance I didnt see this floating around. I read an article on yahoo just now that kind of bothered me. It can be found HERE Now the reason this article bothers me is that it seems to be putting a band-aid on a bullet wound. For those who dont feel like reading the article I will sum it up. Sophos is now recomending that everybody go out and buy a mac. Thier logic is that because there are so many unsecured windows machines nobody writes mal-ware for macs.

Now my own personal opinion is that if the world ran on macs like it currently does on windows there would be just as much trouble.

Quote:

---

from the article "So why not switch to a computer which simply cannot be infected by these threats?"

---

Since when was mac os invulnerable? Can someone in the name of all things good in this world, tell me when Jesus made an OS? Now Im not slaming macs. But thier OS is no less vulnerable than any other OS. I wonder how much of a kickback sophos is making from these statements.
Now that I have vented my spleen a little..... what does everybody else think about it? Not what OS is better but about a company basicaly trying to get people to run away from one problem into the unknown. Tis better to fight the enemey that you known than the enemy that you dont.

Hi ZomBieMann77 it just looks like another resurection of the old "security through obscurity " angle?

You could argue the same case for machines running Linux and Unix IMO.

I think that a key statement was:

Quote:

---

Hackers prefer this type of malicious software, Sophos found, because it can be targeted at a particular group of people to increase the likelihood of tricking users into handing over information.

---

It is really just a pure statistical argument. Say out of a 1000 users there are 850 using Windows, and 500 of the 1000 are competent and the other 500 are stupid, then it makes sense to target Windows users because you have a potential of 425 hits as opposed to 75?

Just my thoughts on it :)

I agree with you whole heartedly nihil. It is security through obsucrity and anybody worth a damn isnt going to recomend that type of security. Its a comfort level as well. Most users who arent in the technical field are intimdated by computers. Telling them they should toss what they have allready learned is not going to help them. Its going to intimidate them more. And just because nobody has bothered to write virii and other malicious software for mac doesnt mean that it can not be done. You get a widespread move to mac and see how long it takes before there are floods of malicious software for it.

Couldn't have said it better, lol.

I mean, if one day all the windows users woke up and patched their systems, and kept them up-to-date, I'd wager that you'd see a marked increase in attacks on MacOS. Of course, given the gross undereducation of the windows user community in regards to security, as well as the "questionable" tactics and methods that Microsoft has incorporated into its update methods, it's not likely that this will ever happen. There will always be a large, uneducated windows userbase, and this is compounded by a large install base of pirated windows - many of which cannot, or will not update for fear of getting busted.

Let's not forget that MacOS is based on a *nix kernel, which makes it far from immune to exploitation. In addition, most mac users that I know are not very security-oriented, as they are coddled by the false sense of security that obscurity brings. Personally, I predict a virus or exploit will hit MacOS in the near future, mearly because of the immense advertising campaign Apple has right now, touting MacOS as a virus and exploit free alternative to Windows.

I could be wrong, but that's my take on it.

576869746568617

OK...so 95% of the worlds computer users switch to MAC OS............you dont think the skiddies\hackers\spyware\virus writers will be on that...........the more macs out there..the more they will be targeted

...........cause thats what everyones gonna be using :rolleyes:

Quote:

---

There will always be a large, uneducated windows userbase,

---

And...there arent gonna a be a large uneducated MAC userbase when all those
windows users switch to macs....

Quote:

---

But thier OS is no less vulnerable than any other OS. I wonder how much of a kickback sophos is making from these statements.

---

ZomBieMann77

Your right.........its not the fricken OS............


Nihil..I think be both agree that humans are lazy fluucks.......thats all there is to it..

doesnt matter what OS.....as long as they can acces the p0rn p0ker sites....they are happy pigs in shite

As I have stated before...I think the ISPs should really crack down on the traffic they allow on thier little black boxes supplied to home users....that pass all traffic through...like a bridge

Yeah there maybe whinning.......

and less wine for me :(

MLF

edit...flucked up the quotes

You mean security through obscurity is a bad thing? ;) And here I was going around replacing all my PCs with Commodor Amigas. :o

What a stupid comment by Sophos...than again it got them press now didnt it?! In that case what brilliant marketing people they have. :rolleyes:

Hey Hey,

You have to take a couple things into account..

Sophos hasn't been a real company in quite a while.... They are media-whores... I used to avidly read their AV Newsletters... now they just suck... They just wanted attention..

The other thing is that yes... Macs are more secure... Not to the point that people like to make them out to be... but they are..

Macs have a lot more security in place on a default install than Windows and in some cases than Linux...

Some examples:

With Windows... as long as I'm an Administrator (or possibly a power user??) I can go to Windows Updates and download the patches and install them...
With Ubuntu... I have to enter my user password in order to see the updates
With OS X... I can see the updates but then have to enter my password in order to install the updates...

Ubuntu and OS X Beat Windows on that one...

Windows XP has telnet and RDP
Ubuntu has ssh and VNC
OS X has ssh, Apple Remote Desktop and VNC

ssh > telnet... and when I enable RDP on Windows.. my user is automatically added... with OS X it isn't... I have no users added and can add a low level account for remote access...

Windows... File sharing is enabled by default
Ubuntu... With my selected install file sharing was enabled by default but no users had access because I had to set a separate password
OS X... File sharing was not enabled by default

Windows... As Administrator / Power User I can install any software I want (essentially)
Ubuntu... To install to certain locations I need to enter my password
OS X... To install a good number of things I need to enter my password..

Again Windows loses...

On the browser side... Active X is a huge problem... go away from Windows and you no longer have that problem...

While you can call it security through obscurity... that's only part of it... Even as people move to macs and more malware is released for Macs... there are fewer vectors of attack (if any) by default... and that's how most people leave their PCs... sure SSH can be vuln.. but I have to enable that... Apple Remote Desktop or VNC could be vuln but again I have to enable that...

I can even lock down my System Preferences (Control Panel) so that a password is needed to change any settings... You can't do that with Windows...

Macs are more secure (especially by default)... It really bothers me when people call it security through obscurity and say that's all it is... because it truly isn't... I work wth Linux, OS X and XP on a daily basis... OS X has some definate advantages both involving security and not...

Peace,
HT

PS... If you want more.. or more details on the security in OS X... I'd be more than happy to discuss it.

Don't forget, passwords themselves are mearly security through obscurity. Once someone finds out your password it's no longer secure. ;)


And as for "Well it's because Windows runs on more computers!"..... OK so why aren't these IIS worms affecting Apache? Apache DOES have more market than Microsoft, yet all the worms seem to affect IIS.

Or, why aren't there more Linux virii? Linux is starting to boom and a lot of servers run UNIX and Linux. That would include the Stock Market which as I heard, runs Solaris and Oracle.... So why no UNIX virii or worms to try these high end targets?

What about SCO? They are just as hated, how come the only attacks for them were DDOS? Are yuo honestly going to tell me you believe it to be because no one wants to take them down? Or is it because by default getting a virii to work in Linux takes more effort than most users have?

hi HTRegz,

you have very good points, and I completely agree with you, but i think you are caught up in the sys admin mindset. A regular user might not even know what SSH is or does. A lot of cracking is done by confusing the user. Confusing a Mac OS system might be more difficult as you have pointed out (you can also override a static arp table in windows, which makes arp spoofing and man in the middle attacks a breeze), but of course everything can be done. I am a believer that people get caught up in the ideology that Mac OS X is completely uncrackable. Sure it might be a safer OS from certain perspectives, but people who know nothing of network security might believe that OS X is God's gift to man kind. The only thing thats more dangerous than an exposed system is a system where the user believes he/she has filled in all the breaches :)

Quote:

---

Originally posted here by White_Eskimo
hi HTRegz,

you have very good points, and I completely agree with you, but i think you are caught up in the sys admin mindset. A regular user might not even know what SSH is or does. A lot of cracking is done by confusing the user. Confusing a Mac OS system might be more difficult as you have pointed out (you can also override a static arp table in windows, which makes arp spoofing and man in the middle attacks a breeze), but of course everything can be done. I am a believer that people get caught up in the ideology that Mac OS X is completely uncrackable. Sure it might be a safer OS from certain perspectives, but people who know nothing of network security might believe that OS X is God's gift to man kind. The only thing thats more dangerous than an exposed system is a system where the user believes he/she has filled in all the breaches :)

---

I agree that SSH is definately a sys admin type thing... However that was added because of the user base that I was addressing... I'm thinking more about the requirement of a password to install something and the ability to lock the control panel... These are things that keep a regular user safer than the Windows environment does...

You're definately right through.... a user who thinks they are perfectly safe because of their OS is in a lot of trouble... I'm just trying to empahasis for the non-Mac users on AO that OS X is definately more secure and more locked down than it's Windows Equivalents...

From a parents perspective (although I'm not a parent) the built in parental controls are also a nice touch in a childs security... especially limiting who they can chat with and who they can email... but yeah... I should go to bed :)

Peace,
HT

HT~ this thread was about the article and the assertions made by a supposed expert in the security field.

"Clueless" is alleged to have said:

Quote:

---

"Because there are so many poorly protected home computers out there running Windows, the hackers haven't had to write Mac versions of their viruses," said Graham Cluely, senior technology consultant at Sophos.

---

I can only interpret that as "obscurity theory". He did NOT imply that it was more difficult, or that malware writers couldn't do it..........................only that they didn't because Windows users presented a more profitable target.....................he was quite clear about the financial motivation though.

Gore, I think that these guys assume that behind every IIS server there is a potentially vulnerable Windows network? As soon as you start using other software, the situation becomes potentially far more complex.

Quote:

---

Or, why aren't there more Linux virii? Linux is starting to boom and a lot of servers run UNIX and Linux. That would include the Stock Market which as I heard, runs Solaris and Oracle.... So why no UNIX virii or worms to try these high end targets?

---

That one is easy :D It is because they don't want to do serious Bubba time. Financial Institutions have staff who are trained not to fall for what home users do. They also employ quite a few security professionals, and many of them are NOT in the IT profession.

Even if you manage to scam a bank employee out of $5 million, you just try getting your hands on the money without getting caught. Also remember that the objective is to hit as many little people as you can for small amounts............... they know that the FEDs aren't interested in anything less than $5000. Hey it is as easy to forge a TJ as it is a $50......................but how would you manage to offload the TJs? ;)

Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

Quote:

---

I wonder how much of a kickback sophos is making from these statements.

---

About as much as the FBI is getting for their incredible statements on the VA laptop.


To sum this up, BSD with a pretty skin can be targeted the same as anyone else. Anybody here remember some slick little browser that came along in the wake of IE vulnerabilities? Yep, amazingly Firefox too had some dirty laundry of their own. Is this really a surprise to anyone here? I mean, has Sophos tricked anyone?

Sophos has just been added to my "Video Professor Credibility" list as in they have as much as the good fellow does at 2am when hucking those awful CDs.

--TH13

WHAT?????? YOU didn't buy his product or try it free to learn Windows ME?? But it works just like a movie!

Quote:

---

Originally posted here by gore
Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

---

Sorry bro but you example here is invalid. That had nothing to do with the OS. It was plain simple social engineering.

Quote:

---

Sophos hasn't been a real company in quite a while.... They are media-whores... I used to avidly read their AV Newsletters... now they just suck... They just wanted attention..

---

You know that, I know that, but someones 80 year old grandmother reading the news before todling off to play her pogo games dont know that. As most of you know I am a former geek squad agent. Now I understand that doesnt give me a lot of credibility because the GS has gotten some negative feelings towards it. But everyday I interacted with people who had read some article just like the one we are discussing here. Suddenly they are experts. Oh and I will admit MOST of the agents I met were idiots. there were a few good ones but for the most part my 6 year old could secure a computer better.

Yea I know :( I just woke up after finally getting to bed at like 12 PM.

Quote:

---

Originally posted here by gore
Banks are easy, you don't attack over the network at all.

A book I have here has a story in it about a guy who's GF worked in a bank and he told her how it would be a funny joke for her to "place about 3 Million Dollars" into his account to show his friend.

After finally agreeing to it, she was told to do it at an exact moment, and then wait 10 minutes or 20 minutes and take it back.

Well, the time came for it, and when she transferred the cash, he was waiting and withdrew it all and left. The Genius of the simplicity kind of grabbed me for a minute.

So that tells me it has at least happened once.

---

Banks are easy??????? Ya with a mask and a gun.

Dude is it a comic book?

No bank would ever allow any one person, let alone someones girlfriend to transfer 3 Million let alone 3 grand to an account without serious scrutiny of the transaction. Anyone as apparently ignorant as this guys alleged G/F would never be given the power to do so. Not even the C.E.0. could perform that type of transfer without a second party being involved.

hehe

Ya man And I have the Bat Boy from the Weekly World News in my garage next to the U.F.O. from Area-51...................




:p

Hey Galdron I have to agree with that, banks have pretty tight internal audit and control. I know that because I audited quite a few when I was with Price Waterhouse. I doubt if an EVP could authorise such a transaction...................I was at the same hotel in Malta a couple of years back, as an EVP of AMEX IBC and he told me he couldn't go above $250,000; and the transaction would have to have been initiated by someone else within the bank.

When I audited AMEX IBC down in the City of London "back then" I had to get the EVP to countersign the backs of my personal cheques I wanted cashing...................like 50 bucks beer money! :D Mind you, my local hicksville bank thought I must be the cat's pyjamas after that!............. like "this guy can get the EVP of a major international banking corporation to authorise his personal cheques" ;)

Where the gap was, was the money market trading:

http://www.bbc.co.uk/crime/caseclosed/nickleeson.shtml

That was the last big one over here (although it was in the Hong Kong branch). Prior to that it was Lloyd's Bank Lugano.................... another case of "rogue trading" on the money markets.

An interesting one was when we went over to decimal currency. This guy in a bank's IT wrote a little subroutine to pick up the extra decimal places from the conversion calculations and skim them into a bogus account he had set up. He was caught by an audit proggy that looked for "impossible transactions" of course all these £0.009876 or watevers showed up like a sore thumb :eek: