XP vs Mac OS X

On Thu, 21 Apr 2005 18:24:30 +0000, Genome wrote:

"Bob Monsen" <rcsurname@comcast.net> wrote in message
news:kZidnVtx7ay-QvrfRVn-uQ@comcast.com...
Guy Macon wrote:
Bob Monsen wrote:


Well, you are right about that, but with regards to root attacks, the
smaller the kernel, the less likely it is for kernel bugs to allow
attacker code to run. That is the most likely means of attack for a
network worm, for example, or a file system exploit: get the kernel to
run the attacker's code somehow.


...which is why QNX is the most bug-free and hardest to attack OS.



Do you have any numbers on this? They don't have much market share.

---
Regards,
Bob Monsen

Don't ask Guy hard questions, he will KillFile you.
LOL!
--
The Pig Bladder from Uranus
 
On Wed, 20 Apr 2005 18:41:36 -0700, Bob Monsen <rcsurname@comcast.net> wrote:

I recall a newspaper story last year regarding Mac OSX, which said their
'first virus' had arrived. I don't really know much more than this. I
don't own an OSX box, so I don't really follow the news about it.
Most people are reluctant to admit getting their technical facts from
newspaper stories.
 
In article
<slrnd6ip5j.lk5.The-Central-Scrutinizer@linux.client.comcast.net>, TCS
<The-Central-Scrutinizer@p.o.b.o.x.com> wrote:

On Wed, 20 Apr 2005 18:41:36 -0700, Bob Monsen <rcsurname@comcast.net> wrote:

I recall a newspaper story last year regarding Mac OSX, which said their
'first virus' had arrived. I don't really know much more than this. I
don't own an OSX box, so I don't really follow the news about it.

Most people are reluctant to admit getting their technical facts from
newspaper stories.
Well, most people never used a Mac.

As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.

If there was one, rest assured it would hit the news big time.
Mac users are not spending any money on protection and as such, are
_very_ interesting to companies like Symantec which are dropping Mac
support.

As a Mac user since '90 I've never seen one, although I've heard of
some benign cases. I have been running OS X since it come out, as a
root, connected 24/7, with only a built in firewall. Never had a
problem.

I was present when a friend of mine was checking his email on a PC. It
took him 20 minutes to verify few messages, wait for all watchdogs to
bless the content, then update virus definitions... That was not fun.

As for security and reliability, in '95 US Army switched its wintel
Apache servers to Macs running OS 9.



j.
 
justin wrote:
In article
slrnd6ip5j.lk5.The-Central-Scrutinizer@linux.client.comcast.net>, TCS
The-Central-Scrutinizer@p.o.b.o.x.com> wrote:


On Wed, 20 Apr 2005 18:41:36 -0700, Bob Monsen <rcsurname@comcast.net> wrote:


I recall a newspaper story last year regarding Mac OSX, which said their
'first virus' had arrived. I don't really know much more than this. I
don't own an OSX box, so I don't really follow the news about it.

Most people are reluctant to admit getting their technical facts from
newspaper stories.



Well, most people never used a Mac.
I have a graveyard of old macs stretching back to 1983, including a Mac
128k (upgraded to a 'fat mac', then to 4MB); a Mac IIx; a powerbook +
dock; an iMac; and, a Clone. (I also have a Newton!).

As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.
This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.

If there was one, rest assured it would hit the news big time.
Mac users are not spending any money on protection and as such, are
_very_ interesting to companies like Symantec which are dropping Mac
support.

As a Mac user since '90 I've never seen one, although I've heard of
some benign cases. I have been running OS X since it come out, as a
root, connected 24/7, with only a built in firewall. Never had a
problem.
I worked at Apple between 1987 and 1993. There were LOTS of mac viruses.
I recall one that got into the QA lab in cupertino. The QA engineers
kept writing bugs against our code that we couldn't reproduce. After
going over to the lab, we determined they had a virus that had infected
every machine in the lab, and that was interfering with the code.

Writing a virus for Mac OS 1-9 is incredibly easy to do, given the
resource manager scheme. There were even hypercard viruses... Excel
macro viruses... email worms... trojan horses...

I was present when a friend of mine was checking his email on a PC. It
took him 20 minutes to verify few messages, wait for all watchdogs to
bless the content, then update virus definitions... That was not fun.
Thankfully, it doesn't take this long anymore.

As for security and reliability, in '95 US Army switched its wintel
Apache servers to Macs running OS 9.
Well, that was a mistake. They should have been using something real,
like UNIX, VMS, or even MVS. OS 9 has practically no security. Any
process can whomp on any other process; the networking is wide open; the
scheduler is cooperative, meaning any process can simply fail to give up
control for arbitrary amounts of time; there is no file system
protection. Even hardware is whackable by any process. Be all that you
can be!

Regards,
Bob Monsen
 
As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.
No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.


If there was one, rest assured it would hit the news big time.
Mac users are not spending any money on protection and as such, are
_very_ interesting to companies like Symantec which are dropping Mac
support.

As a Mac user since '90 I've never seen one, although I've heard of
some benign cases. I have been running OS X since it come out, as a
root, connected 24/7, with only a built in firewall. Never had a
problem.


I worked at Apple between 1987 and 1993. There were LOTS of mac viruses.
I recall one that got into the QA lab in cupertino. The QA engineers
kept writing bugs against our code that we couldn't reproduce. After
going over to the lab, we determined they had a virus that had infected
every machine in the lab, and that was interfering with the code.

Writing a virus for Mac OS 1-9 is incredibly easy to do, given the
resource manager scheme. There were even hypercard viruses... Excel
macro viruses... email worms... trojan horses...
Not over the network. I question your Apple expertise, there is and was
not a single malware in existence that spreads over the network. It is
impossible to hack Mac OS 9 through any network client.

I was present when a friend of mine was checking his email on a PC. It
took him 20 minutes to verify few messages, wait for all watchdogs to
bless the content, then update virus definitions... That was not fun.


Thankfully, it doesn't take this long anymore.
This was two months ago. But you just may be right as Microsoft had
probably issued a few dozen service packs since then.

As for security and reliability, in '95 US Army switched its wintel
Apache servers to Macs running OS 9.


Well, that was a mistake. They should have been using something real,
like UNIX, VMS, or even MVS. OS 9 has practically no security. Any
process can whomp on any other process; the networking is wide open; the
scheduler is cooperative, meaning any process can simply fail to give up
control for arbitrary amounts of time; there is no file system
protection. Even hardware is whackable by any process. Be all that you
can be!

Regards,
Bob Monsen

Not really, most of the above is irrelevant for Mac network security.
Specially since the majority of this thread was MS vs Apple OS _virus_
security.

Unix was designed to run dumb terminals, not intelligent clients.
It is very "whackable" as AOL, White House, Nasdaq, Amazon, MS and many
others have learned in the past. Ask Windows users about all the fun
they have had. Mac users missed the "party". And please, no "market
share" argument fallacy.

j.
 
justin wrote:
As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.



No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.
So you are wrong, there are 'mactrojans'.

WRT the network thing, are you talking about viruses or worms? The word
"virus" is generally used to refer to any malware that can be spread
from system to system. The method of delivery is immaterial. A network
worm is a 'virus' that attacks over the network, without user intervention.

If there was one, rest assured it would hit the news big time.
Mac users are not spending any money on protection and as such, are
_very_ interesting to companies like Symantec which are dropping Mac
support.

As a Mac user since '90 I've never seen one, although I've heard of
some benign cases. I have been running OS X since it come out, as a
root, connected 24/7, with only a built in firewall. Never had a
problem.


I worked at Apple between 1987 and 1993. There were LOTS of mac viruses.
I recall one that got into the QA lab in cupertino. The QA engineers
kept writing bugs against our code that we couldn't reproduce. After
going over to the lab, we determined they had a virus that had infected
every machine in the lab, and that was interfering with the code.

Writing a virus for Mac OS 1-9 is incredibly easy to do, given the
resource manager scheme. There were even hypercard viruses... Excel
macro viruses... email worms... trojan horses...



Not over the network. I question your Apple expertise, there is and was
not a single malware in existence that spreads over the network. It is
impossible to hack Mac OS 9 through any network client.
Sigh. Never say something is impossible.

As far as I know, there aren't any windows viruses that spread
unassisted either. There are ways to attack windows boxes, linux boxes,
and mac boxes over the network, but they are not generally autonomous
malware that spreads from machine to machine (they are not 'worms' or
'viruses'); there are scripts that can walk lists of IP addresses and
try to attack systems. If a system is left in a stupid state, then it's
easy to attack, and possibly gain control over. Windows and unix both
have command line interfaces, and allow remote logins, if enabled. The
lack of a command line interface, and the wierdo appletalk protocols on
macos made that kind of attack more difficult in an IP environment.
Howver, for mac, windows and linux, a simple hardware firewall protects
against this kind of attack. It is also far easier to simply write a
stupid kids game, and embed an ugly attack into it.

If you can trick a mac os9 user into running malware, it can spread
itself by writing into the resource forks of other applications. There
are no controls on this. It can also plant itself into the system
folder, to be started on system startup, rewrite data, and generally do
anything you or the system can do, including formatting your disk, or
watching keystrokes, and opening outbound network connections after you
type in your credit card number.

For OS X, an application that is run under a user id with no root privs
can modify that user's bin directory and profiles, along with any files
that the user has access to. It can open network connections, send
email, and basically do anything that you as a user can do. It may not
be able to open 'well known' sockets for listening, but it doesn't have
to do this; it can open sockets above 1024, and also initiate outbound
connections. I don't know, but I'm guessing it can use the objective C
hooks to watch your keystrokes, and wait for you to type in the root
password (which you have to do with alarming regularity, particularly if
you install software often.)

I was present when a friend of mine was checking his email on a PC. It
took him 20 minutes to verify few messages, wait for all watchdogs to
bless the content, then update virus definitions... That was not fun.


Thankfully, it doesn't take this long anymore.


This was two months ago. But you just may be right as Microsoft had
probably issued a few dozen service packs since then.
Either you are misremembering how long it took, or there is something
seriously wrong with the PC. In either case, it's not much of an
argument against windows.

As for security and reliability, in '95 US Army switched its wintel
Apache servers to Macs running OS 9.


Well, that was a mistake. They should have been using something real,
like UNIX, VMS, or even MVS. OS 9 has practically no security. Any
process can whomp on any other process; the networking is wide open; the
scheduler is cooperative, meaning any process can simply fail to give up
control for arbitrary amounts of time; there is no file system
protection. Even hardware is whackable by any process. Be all that you
can be!

Regards,
Bob Monsen



Not really, most of the above is irrelevant for Mac network security.
Specially since the majority of this thread was MS vs Apple OS _virus_
security.
Again, do you know the distinction between a virus and a worm? Do you
know anything about the Mac, other than how 'cool' it is? Do you know
anything about software reliability? Do you know anything at all about
hardware redundancy? Putting up a mission critical application on a mac
seems like a mistake to me.

Unix was designed to run dumb terminals, not intelligent clients.
It is very "whackable" as AOL, White House, Nasdaq, Amazon, MS and many
others have learned in the past. Ask Windows users about all the fun
they have had. Mac users missed the "party". And please, no "market
share" argument fallacy.
You are just showing off your ignorance. Those websites are using big
multiprocessor solaris (unix) servers, or banks of hundreds of
cooperating linux systems, I'm guessing. The attacks you mention are
mostly DOS attacks, which has nothing to do with the os they are
running, other than it listens for TCP connections. There have been
attacks due to things like a misconfigured apache, or a bug in bind, but
everybody uses unix or linux; nobody who has any real traffic uses MacOS.

I'm glad you missed the party. I was using macos betweenn 1983 and 2002,
both at home and at work, and I didn't get any viruses either. However,
I knew not to run the 'christmas tree' email enclosure; I knew not to
download and run stuff from bbs systems. When I got broadband, I knew
not to allow direct access to my system from the internet. When I had
macs on big intranets at apple and cisco, I knew enough set the file
sharing and remote access passwords to something reasonable. Since I've
been using windows, I've also never gotten a virus. I used XP for 3
years before getting paranoid and installing a virus checker. When I
finally checked it, I had no viruses. I had spyware, but nothing dangerous.

People who are aware enough to simply not click on those silly emails
(or download and run the 'see britany naked' .exe file enclosures on
newsgroups) generally don't get viruses.

---
Bob Monsen
 
On Sun, 24 Apr 2005 20:12:41 -0700, Bob Monsen <rcsurname@comcast.net> wrote:
justin wrote:
As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.



No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.


So you are wrong, there are 'mactrojans'.

WRT the network thing, are you talking about viruses or worms? The word
"virus" is generally used to refer to any malware that can be spread
from system to system. The method of delivery is immaterial. A network
worm is a 'virus' that attacks over the network, without user intervention.
name one macworm running around in the wild. Name one that installs itself
into the Mac operating system without the user logging in as root.

Sigh. Never say something is impossible.

As far as I know, there aren't any windows viruses that spread
unassisted either. There are ways to attack windows boxes, linux boxes,
You're kidding, right? Are you really this misinformed? Bring in a laptop
with klez and you'll have an entire lan infested. All unassisted.

<rest of ignorant garbage snipped>
 
TCS wrote:
On Sun, 24 Apr 2005 20:12:41 -0700, Bob Monsen <rcsurname@comcast.net> wrote:

justin wrote:

As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.



No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.



So you are wrong, there are 'mactrojans'.


WRT the network thing, are you talking about viruses or worms? The word
"virus" is generally used to refer to any malware that can be spread

from system to system. The method of delivery is immaterial. A network

worm is a 'virus' that attacks over the network, without user intervention.


name one macworm running around in the wild. Name one that installs itself
into the Mac operating system without the user logging in as root.
You asked for a virus, I named one. You need root privs to install most
software on Mac OS X. If it tricks you into installing, you'll enter the
root password.

Your dimwit friend Justin implied that there has NEVER been a mac virus.
I pointed out that I've seen lots of them, and I also pointed out how
one could be constructed for either macos or Mac OS X. You snipped that
part.

Sigh. Never say something is impossible.


As far as I know, there aren't any windows viruses that spread
unassisted either. There are ways to attack windows boxes, linux boxes,

You're kidding, right? Are you really this misinformed? Bring in a laptop
with klez and you'll have an entire lan infested. All unassisted.
You are right, I was unaware of that virus. I guess it pays to check the
box on XP that automatically installs software updates.

I looked it up, and all recent versions of Klez requires one to open and
run the attachment. However, there is a variant of Klez that exploited a
vunerability in outlook that automatically opened attachments. That was
apparently patched in 2002.

This vunerability has nothing to do with the OS, however. Outlook is an
application program. The virus transported by email was targeted towards
windows... However, there is a macintosh version of ms outlook. Thus,
it's possible, given microsoft's penchant for using virtual machines and
identical code across hardware bases, that one could use the same
vunerability to write a virus that installs itself on the mac. Nobody
updates outlook for the macintosh, because it hasn't been updated
recently by MS.

However, the real problem for email virus writers is that it's hard to
find a large enough group of macs on a single network to make an email
virus work. Since it spreads using email, it needs to be able to reach
as many systems as it can that it can run on to propagate. Each infected
system has to reach an average of x other systems, with x > 1. If this
doesn't happen, the virus just dies out. A payload designed for the mac
doesn't give it critical mass anywhere except the Apple cupertino campus...
 
On Mon, 25 Apr 2005 08:50:37 -0700, Bob Monsen <rcsurname@comcast.net> wrote:
TCS wrote:
On Sun, 24 Apr 2005 20:12:41 -0700, Bob Monsen <rcsurname@comcast.net> wrote:

justin wrote:

As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit
designed to take over Mac OSX. It's been found on only one system 'in
the wild'.



No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.



So you are wrong, there are 'mactrojans'.


WRT the network thing, are you talking about viruses or worms? The word
"virus" is generally used to refer to any malware that can be spread

from system to system. The method of delivery is immaterial. A network

worm is a 'virus' that attacks over the network, without user intervention.


name one macworm running around in the wild. Name one that installs itself
into the Mac operating system without the user logging in as root.


You asked for a virus, I named one. You need root privs to install most
software on Mac OS X. If it tricks you into installing, you'll enter the
root password.
Liar. It isn't running in the wild. Keep trying.
 
TCS wrote:
You asked for a virus, I named one. You need root privs to install most
software on Mac OS X. If it tricks you into installing, you'll enter the
root password.


Liar. It isn't running in the wild. Keep trying.
Actually, in the context of my original post, it was valid. It's still
valid within that context, I think.

However, as I pointed out in the other post, there must be a 'critial
mass' of machines to set off an email worm. If you assume that 1/10
people are stupid enough to run the enclosure, and that everybody has an
average of 11 people in their address books, then it's easy to see that
the wintel worm will multiply, given that most of the machines it will
encounter are wintel. If, however, the worm doesn't attack wintel
machines, and targets macs, then you have to factor in the fact that
only 1/10 of the desktops are running it. Thus, you need an average of
101 people in everybody's address book to get an infection going, or a
larger percentage of stupid mac users.

As a consequence, the email worm guys either aren't going to target
macs, or can't get one going, simply because the worm can't find enough
food to keep going...
 

Welcome to EDABoard.com

Sponsor

Back
Top