Security researcher Charlie Miller made good on his threat that Apple’s Safari web browser would fall first in this year’s CanSecWest Pwn2Own security challenge. This is the second year in a row that Miller has hacked into a fully-patched MacBook by exploiting a security weakness in Safari. Later in the conference, Internet Explorer 8 and Firefox also fell to attackers, proving that none of the web browsers is particularly more secure than the others. All of them have flaws which can be exploited.
Naturally, the folks at AppleInsider spun the story to imply that Apple’s security (while falling first) is nonetheless vastly superior to everyone else’s. In spite of their inherent bias toward Apple’s products, AppleInsider makes some interesting points. Their article is worth reading. Some of their commentary elicits a response, however.
AppleInsider argues that OS X looks more vulnerable than Linux in security contests because fewer researchers target Linux because it’s “hard work” to find a usable Linux exploit. AppleInsider then goes on to claim that Apple’s use of open source components is what makes OS X appear vulnerable. At first blush, this is a contradiction. If it’s hard work to find an exploit in open source Linux, why would Apple’s use of open source make it easier to exploit OS X? The answer is something AppleInsider conveniently omits: Apple takes longer to update its open source components than typical Linux distributions. Because of this delay, vulnerable versions of open source components remain part of Mac OS X for a while. Known, documented exploits for those components are recorded in bug databases for those open source projects (typically on the Internet where anyone can get to them). Finding a “Mac exploit”, then, is as simple as finding an open source component Apple hasn’t updated yet.
AppleInsider also reports that a study showed there were 678 patches released by Microsoft between 2002 and 2007, while Apple released 815. AppleInsider says that the use of open source enables Apple to “issue more security patches and operating system updates than Microsoft does”, implying that this is a good thing. It’s not necessarily indicative of better security. A counter argument would be that this shows far more bugs in Apple’s products than Microsoft’s, implying more security weaknesses in total, and overall weaker security. That’s not necessarily true, it’s just another way to spin the same data.
AppleInsider did take the opportunity to quote Jeff Jones, the director of Microsoft’s security group, who claimed that contests like Pwn2Own just show security experts what they already know, which is that “any machine can be broken under the right circumstances” and that it’s not worth reading too much into the Pwn2Own results. It’s interesting to see Mac fans quote Microsoft security guys as experts while trashing Microsoft’s product security.
At the end of its post, AppleInsider implies that because Apple didn’t write the open source components of Mac OS X, it’s not fair to count bugs in those components as OS X bugs. It would only be fair, they argue, if you counted bugs in the Windows versions of those same components in Microsoft’s totals. At first glance, this is reasonable, but it doesn’t stand up to scrutiny.
Apple leverages open source software to get OS X functionality to market without the associated development effort and cost. There’s nothing wrong with that. But by including open source software as part of the OS X distribution, they effectively assume responsibility for the bugs in that code just as if they’d written it themselves. If there are any open source components in Windows (none come to mind), then it’s just as appropriate to count bugs in those components as Windows bugs.
A perfect example of a situation where an open source component’s bugs should be included in OS X bug totals and not in Windows bug totals is the Apache web server software. Apple uses Apache in Mac OS X Server. It ships as part of OS X. While there is an Apache for Windows, Microsoft does not include that in Windows distributions, instead bundling its own Internet Information Services (or “IIS”). In this situation, it’s fair to count Apache bugs as Mac OS X Server bugs. Apple had access to the source code, after all, and could in theory have taken the time to comb over it and fix the bugs before releasing Apache as part of OS X. It’s not fair to count Apache bugs as Windows bugs in this case, because Microsoft didn’t include Apache in Windows. (Yes, it may run on Windows and have the same bugs there, but it’s not PART of Windows like it’s part of OS X.) It’s similarly fair to count IIS bugs as Windows bugs (and naturally not as Mac bugs), because that’s part of the Windows distribution as Microsoft shipped it.
In any case, this article is straying from its intended point, which is to say that the CanSecWest Pwn2Own contest should not be taken as an indication that (because Safari on OS X fell first) Apple’s products are “less secure” than Windows or Linux. However, the contest results should serve to Mac fans as a sobering reminder that Mac OS X and Safari are not bulletproof. The products have weaknesses, those weaknesses can be exploited, and while Mac users may have had less historic reason to worry about malware than Windows users, that doesn’t mean they’re immune to it. As Microsoft’s Jeff Jones said, any machine can be broken… even a Mac.