Hello everyone,
Here's the piece from MacUser showing what Mac experts think of the
so-called "hack" reported the other day.
OS X 'hack' claim denied 10:57AM
A system administrator at the University of Wisconsin has described
yesterday's report by an Australian website that OS X had been
hacked within 30 minutes as 'woefully inaccurate'.
Dave Schroeder said that rather than hack the machine, all that the
hacker, 'gwerdna', had done was gain escalated privileges on the
target Mac, where he already had a user account. Gwerdna won a
competition to see which user could gain root privileges on the Mac
in the shortest time.
'It's unfortunate that the initial coverage was so journalistically
poor and sensationalistic on what might otherwise have been an
article about an interesting local vulnerability,' Schroeder said.
'Instead, it chose to leave people with the impression that a Mac
OS X machine can be "hacked" just by doing nothing more that being
on the Internet. That is patently false.'
Schroeder acknowledged that OS X is vulnerable, like any operating
system, but insisted that, 'the general architecture and design
philosophy of Mac OS X, in addition to usage of open source
components for most network-accessible services that receive
intense peer scrutiny from the community, make Mac OS X a very
secure operating system.'
He added that almost all consumer Macs will not give any external
local account access, nor have any ports open, and many will also
be behind personal router/firewall devices.
To test this, Schroeder has setup his own competition, with one
simple objective, to alter the Web page at http://
test.doit.wisc.edu/. The page is hosted on a PowerPC Mac mini
running Mac OS X 10.4.5 with Security Update 2006-001, has two
local accounts and has ssh and http open, which as he points out is
a lot more than most Mac OS X machines will ever have open.
Schroeder said although there have been serious vulnerabilities in
OS X, to date most have relied on typical trojan social engineering
tactics, not genuine vulnerabilities; any vulnerabilities that are
reported to Apple are fixed promptly.
'Apple does a fairly good job with regard to security, and has
greatly improved its reporting processes after pressure from
institutional Mac OS X users: Apple is responsive to security
concerns with Mac OS X, which is one of the most important pieces
of the security picture,' he said.
Simon Aughton
MacUser newsletter 8th March 2006
