Which Os Is Secure?

[Guest Reimar]

An interest article about how secure are the different OS's are! Interest may that OS-X isn't that secure as the majority of Mac Users all time predicting! OS-X is the 2. one after all versions of Windows (since Windows 98) together with the most vulnerabilities! Even interesting is that 3. Party Application in windows the most secure at all!!

But read the article:

Mac OS X vs. Linux - Red Hat vs. Windows 98 and Above Including Windows Vista

Microsoft's Windows operating system came on top out of three different alternative platforms including Mac OS X, Linux (Red Hat), and Solaris 8/9/10, in terms of the volume of holes it contains.

Taking into consideration that when it comes down to security vulnerabilities less is actually more, various versions of Windows, from Windows 98 to Windows Vista account for fewer flaws than direct rivals Mac OS X and Linux. Although in the past, Jeff Jones, Security Strategy Director in Microsoft's Trustworthy Computing group, has played the operating system vulnerability counting game and the results were disputed due to his affiliation with the Redmond company, this time around its independent security company Secunia doing all the counting.

"Red Hat was found to have the most number of vulnerabilities (633), with 99% (629 vulnerabilities) due to third-party components. Solaris, which had a total of 252 vulnerabilities, came next and had 80% (201) due to third-party components. Apple Mac OS X came third with 235, 62% (146) of which is due to third-party components. Fourth came Windows with 123, but with only 4% due to third-party software. Last came HP-UX with 75 vulnerabilities, 81% (61) of which are due to third-party software," Secunia revealed.

Well, the fact of the matter is that, with the exception of HP-UX 10.x/11.x which had just 75 security vulnerabilities, although Windows was found to be impacted by only 123 flaws, the vast majority of holes were in the actual operating system namely 118, and only 5 in third-party software. This is not valid for Mac OS X and Linux (Red Hat with the exception of Fedora). Mac OS X was affected directly only by 89 vulnerabilities out of the total 235, while Red Hat by just 4 out of 633. "These figures should not be misinterpreted in any way to determine the "most secure" operating system. A straightforward counting of the number of vulnerabilities should be interpreted merely as that: the number of vulnerabilities affecting a particular operating system," Secunia added.

Source

Edited January 19, 2008 by Reimar

[RKASA]

I ll send the link over to my fav. linux board.  They need to know their using the wrong OS.  

[think_too_mut]

Mainframe OS (MVS, zOs) are secure.

[Deksan]

Eheh .. you good at quoting article but not at understanding them, read the conclusion :

"These figures should not be misinterpreted in any way to determine the "most secure" operating system. A straightforward counting of the number of vulnerabilities should be interpreted merely as that: the number of vulnerabilities affecting a particular operating system," Secunia added.

[Guest Reimar]

Eheh .. you good at quoting article but not at understanding them, read the conclusion :

"These figures should not be misinterpreted in any way to determine the "most secure" operating system. A straightforward counting of the number of vulnerabilities should be interpreted merely as that: the number of vulnerabilities affecting a particular operating system," Secunia added.

Why I do not understand them?

Windows is used by 95% + of all computer while Mac just a bit above 2%!

Counting the vulnerabilities of Windows, all Versions (118) against OS-X (89) shows that the Windows OS for all Versions since Windows 98 are more un-secure than OS-X!

The difference is in Application Software: 5 vulnerabilities in Windows against 146 in OS-X.

It's not the point for me that Windows OS's are more unsecure than OS-X but the point is how much un-secure OS-X is in the real!

And we should keep in mind that we talking from a lot different versions of Windows against a few versions of OS-X!

I do believe the numbers speaking very clear and "straigthforward" that OS-X as OS isn't that much "behind" Windows as the Mac Fan's liking to show at all times!

Are you a Mac Fan?!

[Deksan]

Eheh .. you good at quoting article but not at understanding them, read the conclusion :

"These figures should not be misinterpreted in any way to determine the "most secure" operating system. A straightforward counting of the number of vulnerabilities should be interpreted merely as that: the number of vulnerabilities affecting a particular operating system," Secunia added.

Why I do not understand them?

Windows is used by 95% + of all computer while Mac just a bit above 2%!

Counting the vulnerabilities of Windows, all Versions (118) against OS-X (89) shows that the Windows OS for all Versions since Windows 98 are more un-secure than OS-X!

The difference is in Application Software: 5 vulnerabilities in Windows against 146 in OS-X.

It's not the point for me that Windows OS's are more unsecure than OS-X but the point is how much un-secure OS-X is in the real!

And we should keep in mind that we talking from a lot different versions of Windows against a few versions of OS-X!

I do believe the numbers speaking very clear and "straigthforward" that OS-X as OS isn't that much "behind" Windows as the Mac Fan's liking to show at all times!

Are you a Mac Fan?!

First there is more than one version of macosX so the version count doesnt matters as usually a bug found in one version usually apply to many of the following version.

Secondly the application software ... This is the 3rd party application installed when the os is setup (For example for macosX it s apache / openssh / samba), but for windows I got no idea which one it could be as there is really a few. MacosX do integration of other softwares like redhat does and that s why there is so many 3rd party application bug.

The problem of security is in fact not real, as u state 95% ppl are using microsoft products but i m sure that 95% of the virus are also for those systems. For your data which one you think is the best ? It s like having the choice of two car :

- One that everybody has and many ppl knows how to open the door and steal it

- Or one that few ppl have and few ppl knows how to open

Of course both software will have flaws, but few of those flaws will be exploited when the exploit would target only 2% of the population.

To answer your question, I m no mac fan but i m using the three operating systems everyday (linux / Osx /windows ) so i guess you would agree that I m probably less biased than you are, if you only use one or two of them ?

Finally those kind of posts only generate flame war about operating systems fight which is the eldest troll of all. You can continue to bash osx / linux or whatever and promote windows but at least assume it . Also if ppl wants to use an operating system / computer why should they change ? Because there is flaws ? Or because it does what they are looking for ?

Have fun !!

[Guest Reimar]

First there is more than one version of macosX so the version count doesnt matters as usually a bug found in one version usually apply to many of the following version.

Secondly the application software ... This is the 3rd party application installed when the os is setup (For example for macosX it s apache / openssh / samba), but for windows I got no idea which one it could be as there is really a few. MacosX do integration of other softwares like redhat does and that s why there is so many 3rd party application bug.

The problem of security is in fact not real, as u state 95% ppl are using microsoft products but i m sure that 95% of the virus are also for those systems. For your data which one you think is the best ? It s like having the choice of two car :

- One that everybody has and many ppl knows how to open the door and steal it

- Or one that few ppl have and few ppl knows how to open

Of course both software will have flaws, but few of those flaws will be exploited when the exploit would target only 2% of the population.

To answer your question, I m no mac fan but i m using the three operating systems everyday (linux / Osx /windows ) so i guess you would agree that I m probably less biased than you are, if you only use one or two of them ?

Finally those kind of posts only generate flame war about operating systems fight which is the eldest troll of all. You can continue to bash osx / linux or whatever and promote windows but at least assume it . Also if ppl wants to use an operating system / computer why should they change ? Because there is flaws ? Or because it does what they are looking for ?

Have fun !!

I think you understand me a bit wrong. It's NOT my intension to say this or that is better! I don't mind at all! It just was becaus everytime you can read and listen that the Mac is sooooooooooooooo secure! But what's the real? Even on this forum was some post in the past which was showing that no any virus for Mac!

But if so, why exist an Anti Virus software for an system which isn't getting infected? And that software is availabel since System 6!

I work on several different OS systems include Mas OS and AS 400 and I doing service for that systems with my company too.

The flame you talking about are generated mainly by answers and answering post's and not by the OP itself.

But let me tell you something very clear: I do NOT "bash" any system or "promote" any. Funny that on one hand some Member of TV says I ptomote Mac and an other says I promote Windows! Both isn't true!

And that was my last answer to that fact's!

Cheers.

[nikster]

The Secunia study is irrelevant because it completely ignores the external reality in which the inspected operating systems live. It doesn't have any relevance to the day to day lives of computer users world-wide.

The daily experience is that 100% of all real world threats are out for Windows, and Windows only. In its various flavors.

Hackers don't seem to care about Macs or Linux. We know that that isn't necessarily because it would be impossible to write exploits. There are just not enough Macs and Linux machines out there to warrant writing a virus, when you could just as well write one for Windows and target 95% of the world.

Hackers will turn on Linux / Mac as soon as one of the following happen:

- They run out of Windows exploits, e.g. Windows is suddenly secure.

- Mac / Linux market share exceeds Windows market share

Both are events extremely unlikely to happen, and certainly not happening over the next few years. Until then, all viruses will be written for Windows, and how many security holes are in any given OS will be of academic interest only.

[Guest Reimar]

The Secunia study is irrelevant because it completely ignores the external reality in which the inspected operating systems live. It doesn't have any relevance to the day to day lives of computer users world-wide.

The daily experience is that 100% of all real world threats are out for Windows, and Windows only. In its various flavors.

Hackers don't seem to care about Macs or Linux. We know that that isn't necessarily because it would be impossible to write exploits. There are just not enough Macs and Linux machines out there to warrant writing a virus, when you could just as well write one for Windows and target 95% of the world.

Hackers will turn on Linux / Mac as soon as one of the following happen:

- They run out of Windows exploits, e.g. Windows is suddenly secure.

- Mac / Linux market share exceeds Windows market share

Both are events extremely unlikely to happen, and certainly not happening over the next few years. Until then, all viruses will be written for Windows, and how many security holes are in any given OS will be of academic interest only.

This listen like total ignorance of existing facts while others, like true PC Freaks will clearly tell that's a true Mac Behaviour! Isn't it?

I for my person don't mind because the numbers speaking their own words and it's a fact that statictics, based on true research with existings facts telling nothing else but the truth!

And again the retoric question: Why a Antivirus Software for Mac exist since System 6 and be upadted in short intervalls if there not any threath's exist? Just for Fun? Just need to look at the nimbers and there the truth!

Cheers.

[Richard-BKK]

Security is not so much the concern of the Operating System. So can a bug on a Linux computer be documented and track the progress, but nobody do anything with the bug.

It seems that everybody hates Microsoft, and if, it is on its own a very small problem, everybody with some computer know-how try's to put a crowbar between it to see how they can make Microsoft Windows display its inside wide-open.

I bet, if all this people concentrate on OX-X or even my beloved Linux they would be capable to do more harm...

But then a bug, or software exploit, will not bring so much profit. If I needed to write a software worm which would have effect on major linux distributions I needed to distribute them on a CD-rom to be able to infect most linux computers.

For example, not ever kernel (hard of a OS) is the same, with which version of C-compiler was it compiled and so I need to include the right libraries, and even kernel 2.6.23 from Fedora doesn't have all the same default packages as the kernel 2.6.23 of Ubuntu.

Anyway building a virus, worm, mall-ware, which can infect linux computers to take some advantage of it is maybe 700mb big not something you can attach in a email of hide on a USBstick. All Windows computers running Windows XP Professional or Home or even Basic use the same kernel. So if you can use that one you can take-over the world....

[Richard-BKK]

O and I forget the high Red Hat numbers where if you install all packages included on the DVD's.

That means several servers who do the same thing like 4 http servers, Squid Proxy server, several office applications...etc..etc..

It is therefore more suitable to compare Red Hat Server with MS Windows Server + MS Office Backend server + Microsoft or 3th party Proxy server + Microsoft IIS Server with all extensions (which also include Perl and PHP server capabilities)

So if we compare the security errors now, Red Hat is not standing out that much....

[dsys]

But then a bug, or software exploit, will not bring so much profit. If I needed to write a software worm which would have effect on major linux distributions I needed to distribute them on a CD-rom to be able to infect most linux computers.

Cannot disagree more with this statement..

The current wave of "drive by" website infections are mainly coming for lunix based CMS systems. OK the end game here is to use a windows expolit but the platform for launching the exploit is Linux.

[dog412]

The Secunia study is irrelevant because it completely ignores the external reality in which the inspected operating systems live. It doesn't have any relevance to the day to day lives of computer users world-wide.

The daily experience is that 100% of all real world threats are out for Windows, and Windows only. In its various flavors.

Hackers don't seem to care about Macs or Linux. We know that that isn't necessarily because it would be impossible to write exploits. There are just not enough Macs and Linux machines out there to warrant writing a virus, when you could just as well write one for Windows and target 95% of the world.

Hackers will turn on Linux / Mac as soon as one of the following happen:

- They run out of Windows exploits, e.g. Windows is suddenly secure.

- Mac / Linux market share exceeds Windows market share

Both are events extremely unlikely to happen, and certainly not happening over the next few years. Until then, all viruses will be written for Windows, and how many security holes are in any given OS will be of academic interest only.

This listen like total ignorance of existing facts while others, like true PC Freaks will clearly tell that's a true Mac Behaviour! Isn't it?

I for my person don't mind because the numbers speaking their own words and it's a fact that statictics, based on true research with existings facts telling nothing else but the truth!

And again the retoric question: Why a Antivirus Software for Mac exist since System 6 and be upadted in short intervalls if there not any threath's exist? Just for Fun? Just need to look at the nimbers and there the truth!

Cheers.

in attempt to answer your rhetorical question , no one worth his salt using Mac OSX installs anti-virus. what a third party develops is their business. if you have a problem with a "in the wild" virus infecting your OSX, please be the first one to announce it.

[AlexLah]

Go for Dos 3.2.

Very stable and secure.

[Guest Reimar]

Go for Dos 3.2.

Very stable and secure.

[warfie]

Is this thread about which OS is the most secure or which has the most secure 3rd party applications? if you're going to judge an OS you don't measure the flaws of the 3rd party apps... or, to expand on another posters car analogy, if you're judging a road, do you include the cars on it?

If we look at the figures quoted from the softpedia study, Red Hat is the most secure OS, followed by HP, Solaris, OS-X and lastly Windows...

The applications are a separate issue...

IMHO

[Guest Reimar]

Is this thread about which OS is the most secure or which has the most secure 3rd party applications? if you're going to judge an OS you don't measure the flaws of the 3rd party apps... or, to expand on another posters car analogy, if you're judging a road, do you include the cars on it?

If we look at the figures quoted from the softpedia study, Red Hat is the most secure OS, followed by HP, Solaris, OS-X and lastly Windows...

The applications are a separate issue...

IMHO

If you take a close look, you'll find that both in question. It is even not to "judge" anything just to "see" the difference between the different systems and the amount of threats.

I do believe I had make that clear in some answer before.

Cheers.

[nikster]

in attempt to answer your rhetorical question , no one worth his salt using Mac OSX installs anti-virus. what a third party develops is their business. if you have a problem with a "in the wild" virus infecting your OSX, please be the first one to announce it.

The Mac AV software exists to profit off the weak and fearful. The same people who wear gloves when going on public transportation. As Reimar has shown, their sales angle - we exist, therefor you might need us! - works.

I am indeed totally ignorant of the 0 viruses out there for the Mac. I am very safe in the knowledge to know to change my habits if and when a real Mac virus comes out. Until that time, I am content to do absolutely nothing about my security on Mac OS X. I don't like to waste my time.

I am also willing to go more technical on this - OS X has an inherent Virus protection because you can't write anything to any system directory without the user entering his password for approval. Sort of like Windows Vista's UAC except without all the false alarms. If a website were to install a drive-by virus, not only would it have to find a weakness in the web browser - which would be relatively easy, I think - it would also have to find a way around the system level protection. That provides OS X with two advantages: 1, it's harder to find exploits, and 2, once found, they are easier to patch.

In Vista, that protection is theoretically there but in practice not working because users either turn off UAC or learn to hit the OK button automatically since these dialogs pop up constantly. Users also don't have to enter a password, they just have to click a button.

[nikster]

The Secunia study is irrelevant because it completely ignores the external reality in which the inspected operating systems live. It doesn't have any relevance to the day to day lives of computer users world-wide.

The daily experience is that 100% of all real world threats are out for Windows, and Windows only. In its various flavors.

Hackers don't seem to care about Macs or Linux. We know that that isn't necessarily because it would be impossible to write exploits. There are just not enough Macs and Linux machines out there to warrant writing a virus, when you could just as well write one for Windows and target 95% of the world.

Hackers will turn on Linux / Mac as soon as one of the following happen:

- They run out of Windows exploits, e.g. Windows is suddenly secure.

- Mac / Linux market share exceeds Windows market share

Both are events extremely unlikely to happen, and certainly not happening over the next few years. Until then, all viruses will be written for Windows, and how many security holes are in any given OS will be of academic interest only.

This listen like total ignorance of existing facts while others, like true PC Freaks will clearly tell that's a true Mac Behaviour! Isn't it?

I for my person don't mind because the numbers speaking their own words and it's a fact that statictics, based on true research with existings facts telling nothing else but the truth!

And again the retoric question: Why a Antivirus Software for Mac exist since System 6 and be upadted in short intervalls if there not any threath's exist? Just for Fun? Just need to look at the nimbers and there the truth!

I am willing to treat these vulnerabilities as facts.

Another fact is that there are zero viruses for Macs out there. If one completely ignores this fact, one might install this antivirus software you mention.

[nikster]

I think the basic confusion here is that people mix up vulnerabilities and threats. Yet they are not the same thing.

My parents have a house in the country in Austria, think Heidi-land. Idyllic. Nothing ever happens there. People leave bicycles unlocked on the street. The only security this house has is a small lock on the front door. There is also a spare key hidden under a rock nearby, just in case. If you did a security review, you would find vulnerabilities to no end.

Take on the other hand military barracks in the green zone in Baghdad. They are under tight guard of the most powerful military force in the world - you would hardly find a flaw there in a security review. You are not going to get in unauthorized.

Which house is more secure?

[dave_boo]

Hmm, after seeing how Windows still handles user level acess, I still don't trust them. In a 'real' OS (one designed to be multi-user and therefore was intelligently put together), a single user can not infect the whole of the Operating System by being a complete and utter twit. This is of course with the exception of the root making a major brain fart.

[dsys]

Had a bit of spare time on my hands thought id check out the article in more depth.

In 2007

XP home edition had 27 advisories, 2% remain unpatched [ http://secunia.com/product/16/?task=advisories_2007 ]

XP Pro had 30, again 2% unpatched. [ http://secunia.com/product/22/?task=advisories_2007 ]

OS X had 26 advisories, 23% unpatched. [ http://secunia.com/product/96/?task=advisories_2007 ]

Fedora 7 had 100 advisories, 1% unpatched. [ http://secunia.com/product/15552/?task=advisories_2007 ]

Redhat enterprise desktop v5 had 99 with 0% unpatched [ http://secunia.com/product/13653/?task=advisories_2007 ]

oh and one of the unpatched fedora advisories is SA27847 wich allows user escalated privileges.

It's strange how you can malipulate the figures for your own end.

Edited January 21, 2008 by dsys

[dave_boo]

Had a bit of spare time on my hands thought id check out the article in more depth.

In 2007

XP home edition had 27 advisories, 2% remain unpatched [ http://secunia.com/product/16/?task=advisories_2007 ]

XP Pro had 30, again 2% unpatched. [ http://secunia.com/product/22/?task=advisories_2007 ]

OS X had 26 advisories, 23% unpatched. [ http://secunia.com/product/96/?task=advisories_2007 ]

Fedora 7 had 100 advisories, 1% unpatched. [ http://secunia.com/product/15552/?task=advisories_2007 ]

Redhat enterprise desktop v5 had 99 with 0% unpatched [ http://secunia.com/product/13653/?task=advisories_2007 ]

oh and one of the unpatched fedora advisories is SA27847 wich allows user escalated privileges.

It's strange how you can malipulate the figures for your own end.

It's quite telling that most of the major security vulnerabilities in Fedora require a malicious user to bring about. I'm not professing Linux's total security, but I do feel safer that I'm the only privileged user on my (SuSE) box. Not even the wife nor the guest account, for the rest of the family, could execute that escalation, regardless of the fact that it needs the scanbuttond to work and we don't have a scanner...so no problem.

It takes quite a bit of effort to get privilege escalation in Linux, in fact the bug you listed requires you to actually move it to a whole another directory that would allow it to start with the computer.

[nidge]

I use OS X and i have never had a virus nor any (know) infiltrations by malicious scum. Therefore in my experience and for my needs my system is 100% secure. As nikster already analogised (?) it's the risk level more than statistics. I could leave my computer wide open to attack but if no one cares to try then it's safe.

[nikster]

Had a bit of spare time on my hands thought id check out the article in more depth.

In 2007

XP home edition had 27 advisories, 2% remain unpatched [ http://secunia.com/product/16/?task=advisories_2007 ]

XP Pro had 30, again 2% unpatched. [ http://secunia.com/product/22/?task=advisories_2007 ]

OS X had 26 advisories, 23% unpatched. [ http://secunia.com/product/96/?task=advisories_2007 ]

Fedora 7 had 100 advisories, 1% unpatched. [ http://secunia.com/product/15552/?task=advisories_2007 ]

Redhat enterprise desktop v5 had 99 with 0% unpatched [ http://secunia.com/product/13653/?task=advisories_2007 ]

oh and one of the unpatched fedora advisories is SA27847 wich allows user escalated privileges.

It's strange how you can malipulate the figures for your own end.

It's quite telling that most of the major security vulnerabilities in Fedora require a malicious user to bring about. I'm not professing Linux's total security, but I do feel safer that I'm the only privileged user on my (SuSE) box. Not even the wife nor the guest account, for the rest of the family, could execute that escalation, regardless of the fact that it needs the scanbuttond to work and we don't have a scanner...so no problem.

It takes quite a bit of effort to get privilege escalation in Linux, in fact the bug you listed requires you to actually move it to a whole another directory that would allow it to start with the computer.

I think these reports are created with one or two purposes in mind: 1 - Attracting attention to whoever wrote it (link bait) and 2 - "proving" that MS Windows is secure and getting paid by MS marketing channels somehow.

I went over the above list for OS X and looked at the unpatched known vulnerabilities. There is exactly 1 (!) that can be exploited remotely. Looking at it in detail, it can stop a VPN daemon. Imagine that - somebody could send you a misformed packet and stop your VPN connection! You might have to start it up all over again! The horrors. Yet it's counted towards the total. This exploit is detailed here: http://secunia.com/advisories/27938/

Worse is counting all the local exploits that only users with access to a local machine can do. I mean - who cares? A russian hacker has better things to do than break into my apartment, fire up my laptop, and use a local exploit to gain access. He'd probably take the laptop, that's way easier.

[dsys]

Just a further thought on local user exploits: Do you really need to be sat at the machine to be a local user?

This exploit is in the wild and is very much being used. It relies on escalated "local user" privialges, http://www.cpanel.net/security/notes/random_js_toolkit.html

Edited January 24, 2008 by dsys

[dave_boo]

Just a further thought on local user exploits: Do you really need to be sat at the machine to be a local user?

This exploit is in the wild and is very much being used. It relies on escalated "local user" privialges, http://www.cpanel.net/security/notes/random_js_toolkit.html

Actually, it doesn't rely on escalated priveleges, but rather an interception of a root's password. (It is common to see a short but successful root login via ssh 5-10 minutes before the compromise occurs. ). I'm supposing that the compromised systems were remotely administered via SSH1 and had a Man(monkey)-in-the-Middle Attack. While SSH1 is flawed, it's hard for a webserver to specify for users not to use SSH2 since a few don't have it; but obviously should.

You are absolutely right about not needing to be seated at the machine itself to be a 'local' user. However, you do need to have a log-in, and if you're going to practice lax security measures, irregardless of the platform, you deserve the butt-pounding that a script kiddie's going to give you.

[nikster]

Just a further thought on local user exploits: Do you really need to be sat at the machine to be a local user?

This exploit is in the wild and is very much being used. It relies on escalated "local user" privialges, http://www.cpanel.net/security/notes/random_js_toolkit.html

IMHO privilege escalation is dangerous only once the attacker is in the system. E.g. using a remote exploit to get in, then using the privilege escalation to get around the "please enter your password" dialog the OS will throw up when you try to change system folders.

Here's an interesting overview of OS X security by the security researcher who won the P0wn to own challenge by coming up with a zero day exploit for Safari:

http://daringfireball.net/2007/04/interview_dino_dai_zovi

Note that they guy is using OS X, and not running any AV software