GEEKONOMICS

Apple: The Grueling Spotlight of Popularity

Apple delivers record monster security update

Becoming wildly popular has benefits; it also has repercussions. According to a Computerworld article:

Apple [yesterday] patched 92 vulnerabilities, a third of them critical, in a record update to its Leopard and Snow Leopard operating systems.

"The sheer number, it's almost so daunting that you don't even want to look," said Andrew Storms, director of security operations at nCircle Network Security.

On the contrary, we need to take a look; a very hard look. The grueling spotlight of popularity makes blemishes all too conspicuous in software products, but by then, it is too late: customers become unwitting targets for cyber attackers. As Apple increased in popularity, so did its customer's exposure - specifically, latent security defects that jeopardized Apple's loyal followers. The graph below illustrates the rise of disclosed vulnerabilities in Apple products compared to market share. 

  

The 2004 to 2005 time frame shows a marked increase in number of disclosed vulnerabilities as Apple market share improved from 3.4 percent to 4.35 percent. When market share reached 7.3 percent in 2007, disclosed vulnerabilities skyrocketed by 268 percent (from 2004). This suggests that security is not part of the popularity contest; that is, a drastically increasing number of vulnerabilities did not negatively impact Apple's market share. Security is highly decoupled from other competitive pressures and thus software manufacturers can largely ignore software security without fearing customer backlash. 

Of course, strong opposition exists to employing software vulnerabilities as a measure of security. Still others argue that it is not number of vulnerabilities, but number of exploits that matter most. Both arguments have some merit. But vulnerabilities give cyber attackers an unacceptable advantage. Vulnerabilities are indicative of poorly written, poorly designed software. Vulnerabilities signal attackers which in turn invites more attackers to search for other vulnerabilities the software manufacturer failed to detect before releasing the product. Vulnerabilities jeopardize customers. Period.

Perfect software is not possible, but it could be suggested that buyers tolerate far too much imperfection, and discover the degree of imperfection far too late to sufficiently counter risks to themselves or significantly alter the behaviors of software manufacturers that introduce those risks in the first place. 

 

Apple: iPhone, a Weapon of Mass Disruption

As reported by ComputerWorld on July 29th, Apple stated in arguments made to the U.S. Copyright Office that unauthorized modification to the iPhone’s software, known as “jailbreaking,” could potentially crash a mobile phone network’s transmission towers.

Seriously? Individuals messing with the iPhone OS could potentially DoS cell towers?

Is this an attacker’s dream or what?

Or is Apple as delusional as an American Idol contestant?

It is ironic that Apple, the company that celebrates the superiority of its security over Microsoft, should unwittingly create a Weapon of Mass Disruption in a sleek, sexy package called the iPhone.
According to ComputerWorld:

“In short, taking control of the [iPhone] software would be much the equivalent of getting inside the firewall of a corporate computer -- to potentially catastrophic result," Apple said. Apple went on to say that if several phones were modified...it could cause a transmission tower to malfunction or kick phones off the network. Also, operator limits on data transmission could be circumvented, allowing a hacker to conduct a denial-of-service attack and crash the tower.

And what is our response?

Vigilantly police the 30 million or so iPhone users so that one of them doesn’t intentionally (or unintentionally) blind entire mobile cells? Or perhaps Apple should rethink its security design?

Apple: A Call for Investigation

Ira Winkler posted a pointed and thoughtful article on ComputerWorld:

It's time for the FTC to investigate Mac security

To quote:

...Apple gives people the false impression that they don't have to worry about security if they use a Mac. And perhaps because the company is invested in fostering that impression, Apple is grossly negligent in fixing problems. The proof-of-concept code [mentioned earlier in the article] is proof that Apple has not provided a fix for a vulnerability that was identified six months ago. There is no excuse for that.

Apple has exuberantly criticized Microsoft for the security vulnerabilities of its products. The fact is, though, that that criticism is grossly misplaced. For its part, Microsoft has been extremely disciplined in ignoring Apple's advertisements.

The current Mac commercials specifically imply that Windows PCs are vulnerable to viruses and Macs are not. I can't disagree that PCs are frequent victims of viruses and other attacks, but so are Macs. In fact, the first viruses targeted Macs. Apple itself recommended in December 2008 that users buy antivirus software. It quickly recanted that statement, though, presumably for marketing purposes.

It certainly could not have been for real security reasons. A ZDNet summary of 2007 vulnerabilities showed that there were five times more vulnerabilities for Mac OS than for all types of Windows PC operating systems.

How can Apple get away with this blatant disregard for security? I have come to the conclusion that ...the FTC must investigate Apple's advertising claims with regard to security...

Please read the full article.

Apple: Pragmatism Should Trump Romanticism

Two recent posts on Apple security deserve attention:

• Is Apple Feeling the Security Pinch? (BNET, May 14, 2009)

• Prediction: Apple will recomend security software (CNET News, May 6, 2009)

To quote the first article (Feeling the Pinch):

...Apple has long encouraged a mythological image of perfection by presenting products as self-contained black boxes that should be, as much as possible, wholly a product of Apple. But the image has been cracking of late, and the company’s own actions show tacit, if not explicit, acknowledgment.

When it comes to security, Apple certainly has its defenders who largely argue for the company’s effectiveness by pointing to what hasn’t happened. For example, I recently had an email exchange with a technology journalist who has never had a security problem with Macs. However, up to that point, he had also never used antivirus software on his system. Nothing showed up when he finally did, but I saw this as an example of selective attention. That feature is a big one among a class of Apple loyalists (and I’m not putting said unnamed journalist into this camp) that I call Defenders of the One True Technology, or DOTTies — a term hardly limited to Apple-devotees..

But even if the Appe DOTTies are reluctant to look at external evidence, they might pay attention to Apple’s recent activities. A big one earlier this week was Apple Patch Day, which included 67 Mac OS X and Safari vulnerabilities...[and hired] Ivan Krstic a big name in security who developed the Bitfrost system at age 21.

Apple recognizes its own security weaknesses, even if the DOTTies don’t. ...Apple knows it needs more attention to security as it gains market share in various areas, even if it won’t [publicly] say so. Apple will just buy some company or product, incorporate it, and pretend that it was there all the time.

To quote the second article (Prediction):

Within the next 18 months, Apple will begin recommending that Macintosh users install Internet security software on all systems...Now I realize that this statement is blasphemy to dedicated Mac users, so let me start with a few qualifying statements. I am not comparing Mac OS with Windows, or Apple with Microsoft, and my prediction should not be interpreted as an attack on Apple, its developers, or the security of its code.

The truth is that all sophisticated software contains vulnerabilities and Mac-based malicious code is nothing new...The company and Macintosh users should not fight this trend--doing so would only increase risk and help cybercriminals.

Senior citizens often hark back to a time when people left their house unlocked and left their car keys in the ignition. Now they lock their doors for safety. Apple, along with Mac users, should prepare for a similar transition. Given the state of cybersecurity today, pragmatism should trump romanticism.

Well stated.

Now, if only Apple could make security as sexy and sleek as their products...that would be innovative.

Apple: Down in 10 seconds

Why Legendary Boxing Manager Don King Should Promote Apple

Charlie Miller, who famously hacked an Apple Mac in less than two minutes last year, recently exploited a fully patched Apple Mac in less than 10 seconds at this year's PWN2OWN contest.

Researcher cracks Mac in 10 seconds at PWN2OWN, wins $5K

To quote:

"I can't talk about the details of the vulnerability, but it was a Mac, fully patched, with Safari, fully patched," said Miller Wednesday not long after he had won the prize. "It probably took 5 or 10 seconds." He confirmed that he had researched and written the exploit before he arrived at the challenge...

"It was great," said Miller when asked how it felt to successfully defend his title. "But I was really nervous for some reason this time. Maybe it was because there were more people around. Lucky [the exploit] was idiot-proof, because if I had had to think about it, I don't know if I'd had anything."

An idiot-proof knock out in 10 seconds. Ouch. That does not bode well for current or furture Apple users. But this reminds me of something quite similar...now what was it? Ah yes.

Apple posted a record net quarterly profit in Q1 2009 of $1.61 billion. Only professional boxers get paid such ridiculous sums of money to end up on the mat within 10 seconds of the first round. Don King should strongly consider managing Apple at the next PWN2OWN contest.

A note to readers: Would any reader out there consider creating an image of Don King's famous hair atop an Apple logo? I will happily post it here.

Apple: Cracking Under Increasing Marketshare

At the SOURCE Boston conference, Dino Dai Zovi, an independent security professional, called Mac OS X, "one of the easiest operating systems to crack." He went on to state, "Steve Jobs' fairy dust only protects against the most naive attackers...Writing exploits for [Microsoft] Vista is hard work. Writing exploits for Mac is a lot of fun."

Full story is here: Serious holes in Mac OS X memory, researcher shows.

To quote:

Dai Zovi said the Mac OS X operating system lacks sufficient memory corruption defense features built into its internal coding. For years Macintosh users have remained shielded by attackers who targeted Microsoft Windows, in an attempt to steal passwords, account information or other sensitive data from its massive user base. But Apple's growing market share is gaining attention in the hacking community, Dai Zovi said.

When clear, observable, and reliable signals about software security are not available to the market, consumers have little more to go on than vacuous, un-provable assertions by software manufacturers. In Dai Zovi's words, these assertions, specifically Apple's assertions, are "fairy dust." As a result, secure software remains undersupplied, and inconsistently distributed across the market. By the time consumers find out the assertions were false, it is already too late.

This is the unfortunate truth for Apple's consumers: their primary defense from mainstream cyber attacks was Apple's relative market obscurity.

This scenario should serve as a reminder that no software product is inherently "more secure" than another software product without an objective statement of assurance. Without such a statement, and without clear, observable, and reliable signals communicated to consumers about that statement, software manufacturers are free to sprinkle fairy dust on our dreaming brows.

 

Apple: The New Petri Dish

Once upon a time, Apple could gloat with Mephistophilian glee at Microsoft, whose operating systems and applications where all but a veritable Petri dish for viruses, worms, and malware. No longer. According to an Information Week article:

Apple has always boasted that "Mac OS X isn't plagued by constant attacks from viruses and malware" because its operating system was "designed with security in mind."

But about two weeks ago, Apple updated an old note on its support Web site advising its customers to use more than one antivirus application to make their computers more secure, affirming a longstanding divergence between its marketing and its technical concerns.

Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult," the note explained.

It goes to show that most assertions about security by software manufacturers are cheap and easy to make because there are few negative consequences to software manufacturers when they're shown to be wrong again and again and again. Apple's announcement will hardly hurt the software maker's sales. Unfortunately, it was obscurity - not security - that made Apple appear more secure than other software manufacturers, which Apple buyers will learn too late.

It is a shame that an innovative company like Apple appears - by encouraging the use of anti-virus - to be making the same mistakes and using the same mistaken etiology of cyber security as other software manufacturers. So much for innovation. Software is simply not crashworthy - it cannot withstand the relatively simple (some might say, "stupid") mistakes of users, let alone the malicious actions of cyber attackers. Relying on anti-virus at this point in time is an errand for the foolish. [AusCERT]

Once again, the onus of cyber security will be placed on software buyers - this time on Apple users - to "behave properly," whether it be installing and keeping anti-virus up to date, practicing safe surfing habits, or following best practices regarding configuration.  This has not stemmed the tide of cyber crime or cyber espionage yet and will not likely do so in the future (even with "perfect" behavior). Woe to Apple buyers, ye owners of the new Petri dish.

But before the hackles of my colleagues are raised too greatly, behavior modification is indeed an important part of cyber security. However, without a concomitant delegation of, and accountability for, software assurance to software manufacturers, behavior modification alone will not reverse the anemic state of cyber security around the world. Software must be crashworthy. Period. Full stop. It is simply not sufficient (or sane) to expect 500 million software buyers to habitually refrain from clicking on "suspicious" hyperlinks, abstain from visiting questionable web sites, or to comply with Byzantine configuration requirements (as well as frenetic patching cycles).

Let us hope Apple brings its famous innovative ability into the world of cyber security. So far, it doesn't look good.