Your Ad Here
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to paradox in message #8968:
Your argument is that in ten years, not one person has bothered to write and release a virus into the wild for OS X, an OS running on tens of millions of computers and smartphones? Not one person has tried to exploit all those dumbass college kids who buy MacBooks just to fit in with everyone else in their class? Not one "script kiddie" has even tried to bring down OS X just so he could brag to everyone about how he took down Apple's "unbreakable" OS? Not even once in ten years?

That's got to be the dumbest thing I've heard all year. But take heart: the year is still young.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8971/9147 2010-02-20 17:29:10 (-0600)
valkyrie
user #3200
7296 posts
22 karma points
[view profile]
[email user]
subject: re: TOB
in reply to jadefalcon1 in message #8953:
I try to remember that you made the boards public a while back.

Yeeaah. I, for one, wish that hadn't happened.

It makes me extremely happy, however, that I've been as diligent about my online anonymity as I have.



Valkyrie

Memento Mori
message 8972/9147 2010-02-20 18:12:57 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8970:
You missed my point entirely. Once again, viruses are only one of many types of exploits. Correct, OS X does not currently have any viruses in the wild. Not correct would be 'OS X is not vulnerable to any exploits'.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8973/9147 2010-02-20 18:18:47 (-0600)
jadefalcon1
user #21137
6625 posts
21 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8966:
That was kinda the joke, really. Users don't run Solaris. Sysadmins do. Shit, I did at my last job. Fuckin' hated it, too, because I didn't have the time or the resources to learn to admin it properly. With competent admins, Solaris is fucking bulletproof. Good luck finding people who qualify.

~Jade Falcon
[mail][blog][page]
Genital warts: Ribbed for her pleasure!
message 8974/9147 2010-02-21 00:05:13 (-0600)
jadefalcon1
user #21137
6625 posts
21 karma points
[view profile]
[email user]
subject: re: TOB
in reply to valkyrie in message #8972:
On the one hand, yes, I wish that hadn't been done. On the other, we must admit it was a false sense of security anyway. If somebody wanted to lurk content, it was a free anonymous signup away.

I have been somewhat less than perfectly diligent in that regard. I'm sure it wouldn't take too much footwork to track me down.

~Jade Falcon
[mail][blog][page]
Genital warts: Ribbed for her pleasure!
message 8975/9147 2010-02-21 00:06:36 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8973:
Can you name any OS X exploits that require no user action and/or physical access to the computer in order to take advantage of them? Because I don't know of any.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8976/9147 2010-02-21 00:32:06 (-0600)
what
user #14182
1711 posts
12 karma points
[view profile]
[email user]
subject: re: TOB
in reply to valkyrie in message #8972:
YEAP. I had a persistent 'fan' online for many years and I have everything locked up tight. I'm beginning to slip, though. The photos are creeping in.

Lay down in the aisle and flail
message 8977/9147 2010-02-21 00:48:33 (-0600)
dilanium
user #48133
3223 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to valkyrie in message #8972:
meh I've had such a presence online I doubt it would be hard at all to find me.

*shrug*

message 8978/9147 2010-02-21 02:45:25 (-0600)
jadefalcon1
user #21137
6625 posts
21 karma points
[view profile]
[email user]
subject: re: TOB
in reply to dilanium in message #8978:
While that may indeed be true, bear in mind that you're also more physically difficult to get to, especially in view of where the majority of Internet users are.

~Jade Falcon
[mail][blog][page]
Genital warts: Ribbed for her pleasure!
message 8979/9147 2010-02-21 02:47:36 (-0600)
dilanium
user #48133
3223 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to jadefalcon1 in message #8979:
I would have said the same thing when I lived in Ohio.

And I had a stalker when I was 18, but I'm still meh about it.

message 8980/9147 2010-02-21 11:14:47 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to jadefalcon1 in message #8979:
I'm now the second and third result on a Google search for my name, largely because of writing for TUAW and my twitter page. I got hit with the whole "your anonymity is gone" thing when a TUAW fan in NZ actually looked me up in the phone book and called my house at eight in the morning. Creepy as hell.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8981/9147 2010-02-21 12:44:57 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8976:
Er, yeah, I can find a list of them. Give me a little bit.

Hint -- check out the last 3 browser exploit conferences, the OS X machines fell first.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8982/9147 2010-02-21 13:04:03 (-0600)
jadefalcon1
user #21137
6625 posts
21 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8981:
Yeah, that'd be pretty creepy.

~Jade Falcon
[mail][blog][page]
Genital warts: Ribbed for her pleasure!
message 8983/9147 2010-02-21 13:51:23 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8982:
Yeah, I remember those. And once again, the exploits required either user action or physical access to the machine in order to work.

I want you to find me a Windows-like exploit that works on OS X. One where I plug in an infected USB drive or download an infected file, the virus/trojan/worm/whatever installs automatically without my permission or knowledge, and it starts working its mojo in the background without me knowing about it until either A) system performance goes to shit, B) anti-virus software finds it, or C) my credit card balance is suddenly hundreds of dollars higher than it should be.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8984/9147 2010-02-21 13:51:37 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8984:
Oh, and as a corollary to everything in the last post: also find me an exploit that's been found "in the wild", not some proof-of-concept thing at a developer conference.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8985/9147 2010-02-21 13:54:16 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8985:
"To help me prove my point, only find me instances that conform to this narrow band of circumstances."

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8986/9147 2010-02-21 14:12:02 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8986:
Let me clarify the above:

* The Windows style exploit you're looking for generally doesn't happen on OS X. Autoplay is no longer allowed in OS X, though it's not really allowed in Windows 7 either.
* Downloading a file without explicitly telling Windows to 'Run' it will not autoinfect your system. Stupid people will always be a security problem, and that can happen

So, no, I cannot satisfy your requirements to your narrow band.

I can tell you, though, that network-level exploits can happen, via running services such as SSH or AFP or by browsing to certain pages in Safari. I can tell you that files can be downloaded, and when run, will fuck up your system. No system is perfect. Windows started off terrible, and has actually gotten better. Mac OS started out perfect, because OS 9 made it painfully obvious when shit was going down. It has gotten easier to attack, simply because it's a multi-user service-oriented OS now.

I'm not saying Windows is great. I'm not saying OS X is shit. But to say that the OS cannot be penetrated in the wild is foolish.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8987/9147 2010-02-21 14:56:39 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8987:
I never said it can't be penetrated in the wild. But it hasn't been. Not in a decade of operation on millions of machines. And the original point of the conversation was this is not because of "obscurity". People like to think that if someday OS X gets a market share above a certain number, that'll flip some magic switch somewhere, and suddenly virus writers will get light bulbs over their heads and say, "Oh yeah! Macs exist! Forgot all about those!" That argument is bullshit. Whether the market share is 5% or 9%, the idea that in ten years not one single person has even tried to exploit OS X's security in the wild is stupidly naive.

Again, I'll cite history: the Classic Mac OS was definitely susceptible to viruses (I remember my high school's computer lab got hammered by the Michelangelo virus in the early 90s). There was even a Mac-specific antivirus program called "Disinfectant" or something like that. The Classic OS was even more "obscure" in terms of market share than OS X is: yet OS X doesn't even suffer the same security difficulties of its predecessor, much less those of Windows.

"Security by obscurity" is a cop-out argument espoused by Windows apologists who have no idea what actually makes an OS secure. Windows wasn't designed with security in mind when it was first created, so it's spent the past 20+ years trying to plug holes in a leaky boat. OS X was designed with security as one of its defining features, which makes it far more difficult to exploit than Windows.

A better analogy than "security by obscurity" is this: Windows is the equivalent of an apartment complex in the Bronx. It gets broken into on a regular basis, because the locks on the doors suck, the windows don't have any bars on them, and people leave their shit lying around in plain sight behind doors secured with flimsy, decades-old chain locks. In short, it's an easy target. Simple to break into, and even if the building superintendent outfits the doors with better locks, you can always break in through a window or tunnel under the rotting floorboards instead. OS X, by comparison, is a bank vault. You can still break into it, but you need specialised equipment, you need know-how, you need to be able to take down the security guards, keep the teller from tripping the silent alarm, etc. There's 91 shitty, unsecured apartment complexes in this corner of the Bronx, versus nine banks with heavily guarded vaults having doors built out of three-foot-thick stainless steel. As a criminal, which one are you going to go for?



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8988/9147 2010-02-21 15:41:57 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8988:
"But it hasn't been. Not in a decade of operation on millions of machines."

Uh, no, it has. Just because it was shown at a conference doesn't mean it didn't happen. People have tried to exploit OS X's security. It has happened. Do your research before you spout off before I start calling you a fanboy again.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8989/9147 2010-02-21 16:38:46 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8989:
Proof of concept exploit at a conference ≠ exploit in the wild, you ignorant slut.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8990/9147 2010-02-21 17:04:34 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8990:
sigh. note that most of these have been patched, which was the point i made much earlier.

Secunia Advisories: 2009
Secunia Advisories: 2010
Safari allowed root access via plugin system
Safari/IE allowed execution of arbitrary scripts via a web page
Malformed image vulnerability causing exploit on mount

The last three all had live, working bullshit in the wild.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8991/9147 2010-02-21 17:29:27 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8991:
Exploits discovered by security experts, reported, and subsequently patched by the vendor are a hell of a long way off from exploits developed and used by cyber-criminals to compromise someone's system, which is what people are generally talking about when they talk about a "virus".

One of the main differences between OS X and Windows security is OS X exploits like the three you mentioned are found by security experts, then patched; Windows exploits are found by malware writers, taken advantage of, discovered after the fact by companies like Norton, then left wide open for months until Microsoft unleashes its latest bout of Patch Tuesday.

In the past ten years, I know of exactly one successful attack against OS X that the average user could conceivably encounter that was in the wild before security experts found it and stomped it. It involved a trojan embedded in a pirated copy of iWork that somebody downloaded via a torrent. The trojan supposedly supplied a remote location with the user's network location and awaited further instructions. In order for the trojan to be installed, it required the user to input an admin password to install an otherwise apparently normal-looking program apparently sourced from Apple. When people caught on, the trojan maker changed tactics and embedded it in pirated copies of Adobe CS4 instead. Pretty ingenious, but like I said, the only successful attack against OS X that I'm aware of in billions of man-hours of operation (which only infected 20,000 machines at most, caused little to no damage, and was trivial to remove), and in an entirely different class than the thousands of self-propagating malware programs that plague Windows.

I stand by my original statement: there are no viruses for OS X, there have not been any for the entire life of the OS, and the reason for that has nothing to do with the supposed "obscurity" of OS X.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8992/9147 2010-02-21 18:11:52 (-0600)
morbidskittle187
user #56288
2320 posts
15 karma points
[view profile]
[email user]
subject: lolol
Note to self: Never post on any boards when geeks are debating about computers. :P



--------------
I know a lot about cars, man. I can look at any car's headlights and tell you exactly which way it's coming. - Mitch Hedberg
message 8993/9147 2010-02-21 19:16:37 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8992:
Most, in the high 99 percent, are exploits that are determined by a security expert, and exploited in the wild. You keep refining your argument to make yourself sound correct. Because an exploit is published, it's no longer an exploit?

Your information on how McAfee and Microsoft deal with patches are at least five years old. It's the equivalent of me laughing about one mouse button.

Arguing with you is like arguing with a Republican. I refute your statement, you refine it to fit your limited view.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8994/9147 2010-02-21 19:22:33 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8992:
FURTHERMORE, this goes back to the original argument. There is proof that OS X is susceptible to exploits, and there may be some open that are available for smacking around. The primary reason why malware exists for Windows is to create botnets to hit other sites.

1) Why expend effort on 5.5% of the market, when you can go after the other 93% or so?
2) Why go for the small amount of that 5.5% that aren't running the latest edition of the OS?
3) Why not go for the larger market segment filled with people who are unaware of how to keep their system up to date?

Your other argument, where the kajillions of iPhones make OS X a better target, I give you this. Symbian OS has a kajillion times more, but isn't being attacked. It isn't particularly secure, either. The primary reason, as above, is to create botnets. Botnets are not very efficient or useful over cellular networks, or tied to a limited-usefulness battery. iPhone's OS X edition is locked down even tighter than OS X, where each application is rerooted into its own sandbox, and has to fight for file access. It's the same reason why you just don't see a lot of exploiting of Windows Mobile, despite the pre-iPhone marketshare.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8995/9147 2010-02-21 19:27:58 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8994:
What exactly have you refuted?

Where are the viruses for OS X? Where's the malware? Where are the worms? Where's the trojans, plural?

What dark, dusky corner of the internet do I have to visit in order for my MacBook Pro to be compromised in any way (other than phishing, because that's platform agnostic)?

Who has a flash drive they can plug into a USB slot on my Mac that will silently and invisibly load a program to log my keystrokes, snatch my credit card info, and run over my dog?

Where are the cadres of Russian mafia cyber-criminals in Vladivostok basements remotely hijacking iMacs in Peoria, Illinois?

Where are the Mac botnets?

Why, in eight years of me using OS X without ever running any sort of anti-virus protection whatsoever, without even running the OS X firewall, without taking any special security measures whatsoever, why in eight years of surfing anywhere I want with impunity, on multiple machines, on multiple iterations of the OS, for tens of thousands of hours on hundreds of thousands of webpages, has my system never once been compromised in any fashion whatsoever? Same question, but substitute my wife? Same question, but substitute every single one of my Mac-using friends? Same question, but substitute every single Mac user I've ever met or heard of?

Fucking riddle me that, Batman.

Arguing with you is like arguing with my mother-in-law. I refute your statement, you say the same dumb shit over and over again, hoping to transform fiction into truth via repetition.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8996/9147 2010-02-21 19:45:39 (-0600)
kai
user #16500
5423 posts
18 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8995:
FURTHERMORE, you're just reiterating the same retarded "security by obscurity" argument that I've already lifted my leg over and pissed on several times. Since it's apparent you're just skimming and not actually reading, I'll break it down just as simply as you have.

1. If OS X market share being so tiny is the reason there's no viruses for it, how come there were viruses for System 7, which had an even smaller market share?

2. If OS X market share is 5 - 9%, why doesn't OS X have 5 - 9% of the viruses?

3. In answer to the above, if you honestly believe that no one in ten years has even bothered trying to write a virus for OS X, which is the crux of the entire "security by obscurity" argument, you are high.

Saying no one tries to break into OS X because it accounts for so little of the market is no better than saying no one bothers trying to steal BMWs because there are Toyotas and Fords all over the place.



Kai Hamuti.

[ lj ] [ NZ Gallery ]
message 8997/9147 2010-02-21 19:57:55 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to kai in message #8997:
Holy shit, you don't read.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 8998/9147 2010-02-21 20:44:23 (-0600)
jadefalcon1
user #21137
6625 posts
21 karma points
[view profile]
[email user]
subject: re: TOB
in reply to outzider in message #8998:
Dude. Give up. Fanboi applies. Just be done with it.

~Jade Falcon
[mail][blog][page]
Genital warts: Ribbed for her pleasure!
message 8999/9147 2010-02-21 20:53:08 (-0600)
outzider
user #1
3868 posts
17 karma points
[view profile]
[email user]
subject: re: TOB
in reply to jadefalcon1 in message #8999:
Point.

Is it a bad thing when the US beats Canada at hockey?

FUCK NO IT IS NOT.

//////// oZ //////// [blog] [lj] [things i hate about you]
"When your opponent is drowning, throw the son of a bitch an anvil." - James Carville
message 9000/9147 2010-02-21 21:00:24 (-0600)
username: password: