Security exploits and market share

[overclockedtech]

I totally agree with your points on why market share does not matter.  The system design and flaws are what make these exploits appears in the wild.

[EverNumb]

I don't entirely agree with you that market share is a totally invalid argument. However, just saying market share then expecting to win an argument is rather lazy. I think market share does matter when you consider what businesses that would have valuable personal information would run.

I think that it does matter that you would find a windows OS (and others such as Unix) running business computers that hold personal information... but perhaps not many instances of an Apple OS.

[EverNumb]

My point is that marketshare does matter in that it increases the value of an exploit for windows over OS X because the windows exploit is more likely give you access to a computer that would give you valuable personal information.

Now as for OS X being more secure than Windows. Yeah I can see that since up until Vista the MS didn't give much lipservice to the dangers of using the administrator account all the time. I'm sure the majority of Vista users use the administrator account anyways.

[EverNumb]

Now a concerning trend is that as Operating Systems become more secure people will take advantages of application weaknesses.

I'm sure you're aware of the browser and OS combinations that were highlighted by the recent pwn2own. In this arena it seems that neither OS X or Windows is particularly secure at the moment.

[mrbit10]

actually that is a way in, but the system can sandbox the port as they are already beginning to do. Quicktime and safari are two OSX examples of that

[mrbit10]

Well, I cannot disagree that a windows system has more value than say unix or linux system but an exploit has to be pre-existing within the system not a hack to trick a human. OSX has vulnerabilities, and you can go to secunia and see FreeBSD security vulnerabilities as well as OSX.

[EverNumb]

I was wondering if (hypothetically speaking) Apple had some market share in the business OS market and a good share of business machines that had valuable was running some variation of the Apple OS; do you think that we would see a concerted effort to find flaws in that OS?

How successful would those attempts be?

how possible would it be that more higher risk flaws be found in your opinion?

[mrbit10]

well that actually already goes on, if you see secunia, they track what is call proof of concepts and possible holes in the system. The exploit has to exist to be hacked unless brute force is used which is almost never as it does not have a great success rate. However, they would go a much easier route, why mess with system hacks when you could simply trick a human being into downloading your hack bypassing the security?

[mrbit10]

well, we are talking about system exploits, not human exploits. Testing a computer vs a human for information in other words. Windows did have its issues via the system where the human did not have to be fooled, that has nothing to do with market share - is my point

[WipeClub]

Ok, I see the distinction between system exploits and exploits that take advantage of human error.

I can see that OS X being based Unix probably made it more secure than XP prior to SP3 and perhaps even with SP3.

Nils, one of the prize winners of pwn2own, has stated that he thought that Vista was harder to exploit through a browser than OS X

I'm thinking that Snow Leopard will make that less true. One hopes that Win7 and the new Mac OS will both be more secure.

[EverNumb]

Interesting points. Thanks for the thoughtful replies.

One detail about the pwn2own contest I didn't mention was that the browser Chrome wasn't broken into. This may be because it is very secure or that there has not been a real effort to find flaws in it. If it is the former it might be worth switching over to it.

[drumcodes]

and yeah , my comments are meant more for other ppl viewing this vid , not u explictly MrBit, i think ur familiar enough with all this ;) keep up the good work.

[drumcodes]

also, even current versions of MacOSX and acompanying apps in it is much better .... last few years Mac is first to crack on Pwn2Own competitions, Safari remotely exploitalble on OSX in under 2 secs :P (gg Apple), only one that didnt crack is Firefox on windows if i remember

[mrbit10]

i am aware of the Proof of concepts and safari is a huge problem so was ichat and quicktime the last two being closed.

[drumcodes]

also saying "MacOSX" and "security" in same sentence, shows horrid amount of plain ingnorance , few years back mac osx was still exploitable with Aleph1's tut which is more than 20(!) years old, which makes all Apple drone talk about security ridiculous , but w/e , not like mac-heads will ever be free of RDF surrounding Jobs & co. :P

[drumcodes]

i would like to say that as for number of built in protections Windows Vista ca compare only to things like OpenBSD and others, imho Microsoft has really taken security into account ever since days of winxp SP2 where the whole thing was compiled with buffer-overflow switches, making the download itself bigger, but also safer , i think that was sort of turning point for MSFT , and till this day i can really say im pleased with their effort with security implementations

[Lycidas84]

Thank you so much. Windows advocates* love to bring market share into the debate, and I always found it hard to argue against that point without getting caught up in tech details. Now, with the information you've given us, especially the historical evidence, it has become much easier.

I've seen many of your videos now and they are all very educational. Thanks again for investing your time and effort into this.

*as in "Mac/Linux/whatever haters", not as in "satisfied MS costumer".

[IamtheVOICE123]

And it basically makes your argument a little bit bunked in specific area's if you just focus on security exploits, and OS history within exploits without knowing much of change of the history of hackers.

[mrbit10]

the point is system architecture, not social engineered hacks, the difference being a computer vs a human. not much anyone can do with human faulted exploits. but see the annotations for questions, MS has proven that the system plays a larger role so far in the life of Vista vs its predecessors

[IamtheVOICE123]

Yes that is true but at the beginning your point of it was that using market share for the reason why hacker's hack specific types of computer's based on OS's is completely bunked. Yet showing how hacker's first formed and so forth and how their tactic's usually change especially when new security is put in and whatnot makes the point more valid. Although I would like to hear how much about Hacker history you know about. I may do a series but when I have more subscribers to reach.

[mrbit10]

Then you misunderstand, my point is system exploits "meaning the integrity of the system design only" vs market share is bunk. Of course you have to adapt but not much for windows, take the recent worm, it is as old as Win2k exploiting the same network service. That was my point.

[IamtheVOICE123]

Ah ok very well then, I understand if thats the case. What I don't seem to get is why are their articles like this exactly though?

ht tp:// switchtoamac. com/site/why-are-there-no-viru­ses-for-mac-os-x. html

I mean is this apple doing this or is it just the fan boy's who clearly do not understand that when it comes to the digital information put out on the web that their is the old philosophy of hackers: If it has encryption it can be hacked, if it has code it can be infected...

[mrbit10]

that site i would say to them, OS 8 & 9 had smaller share but more exploits. OS X has exploits, i gave them in the vid. The word virus is loosely used today and I would encourage virus protection against social engineered viruses, for sure of which i did state in my vid about user being protective. That said, it is clear that OSs can be compered in system only how vulnerable their security system design is. I know that MS changed its thinking after the blaster worm via the RPC exploit.

[IamtheVOICE123]

Yah truth be told I was never actually a victim of that worm. Oh sure I would get the occasionally really nasty trojan or malware that wouldn't go away till i reinstalled my OS; but I haven't had those in like ages, been like about 3-4 years since the last one I got.

When it comes down to it, most of the threats nowadays are through downloads and scripts, which is why no-script was invented. People need to learn about computers in my eyes instead of being ignorant.

[mrbit10]

I would not say I am an expert, but i do know the facts in that of weakness in system security and I have followed since the days of spreading via floppys and so on. But the bottom line is this, if the hack is for glory, usually the tougher the more prestigious vs opp cost of numbers BUT if it is for profit, than any hacker that sells themselves short in fooling a human by sticking to one OS, needs to find another hobby.

[IamtheVOICE123]

Furthermore there are also instances where people's computer's are taken and turned into server's by hacker's without the person ever knowing it. In the reality tactics change with hackers. Their is a justification of market share if you look at the FBI survey's of what a hacker target's and how it differs from the tactics change in 2003 and the tactics used between 1991-2001.

[mrbit10]

Servers, hmmm Apache owns that market and has far less exploits than IIS.

[IamtheVOICE123]

LMAO! What I was talking about was specific people's desktops being hacked and turned into a server without them knowing it. One of the main reasons why server's are hardly exploited is because the people who build, make and use server's are not only as powerful in computing as most elite hacker's, they would have self written protection software that you can't get out on the market. Oh sure a few attacks slip out once or twice a year but that's about it.

[mrbit10]

ah, ok, but you need to read the questions at the beginning.

[IamtheVOICE123]

I did really but I also linked it to what you were also stating and that is where I got confused.

[IamtheVOICE123]

I understand what your stating but in the end you have to really look at the various change in the design on how hacker's actually change tactics. Back in the day's of when commercial computer's were being owned (like apple for example) hacker's exploited security breaches and usually those breaches corresponded with the current rank of the hacker. But that stopped in about 2003 when they decided to change their tactics by hitting the most computer's available.

[mrbit10]

you mean profit oriented hacks, then you have to ask yourself why as a hacker would you cut yourself short, most of the profit oriented hacks are social engineered hacks that really are medium neutral, they could be done by phone, mail what have you as the end target is the level of caution of the user, thus this vid is about the system not the human.

[IamtheVOICE123]

True but then again profile oriented hacks are somewhat rare and ended up dying out in late 90s. lmao! it's kinda interesting when you go back into the history of hacker victims and think "godamn, i'm glad hacker's changed tactic's now."

Imagine the havoc of a pissed off at the world hacker could do by using profile oriented hacks on anyone he could find. Kinda makes me glad I don't have any hacker enemies.

[IamtheVOICE123]

Oh and about profit oriented hacks I was talking about profile oriented hacks. But to adjust that. In the reality by target the people that use a common OS that has a dominate market share is that that OS will always have the most valuable information to steal.

[mrbit10]

explain profile as to what information? Then answer this, if os x were as week as OS 8 & 9 with millions of users that profile information which I would assume leads to profit would not get hacked?

[IamtheVOICE123]

Oh no. Profile hacking isn't something to do with stealing information. It as generally used by hacker's in the late 80s to mid 90s. Basically if you ever watched the movie "Hackers" it would give you a general idea of what I mean. But in common sense, if a hacker was pissed at you enough, he would make your specific life a hell hole. Glad I was too young to be a target.

[mrbit10]

cut yourself short as in to why leave out any os.

[IamtheVOICE123]

Well the point is this. Is then when you talk about hacker's and hacking an OS and whatnot; the most prudent form is to take on the systems that most people use. If you try to hack any OS you will need to learn a lot of OS's security information, how to exploit it and so forth. And by then a new OS would be out and security patches released and so forth. That's the main reason why.

[mrbit10]

there in lies my point for profit level hacking is really only tied to social engineered, hacks, the system depth is not as prevalent with this type of hack.  So you have to answer as to use your form of knowledge per OS how is say Slapper, or codeRed worms profitable? They were not. Social hacks are and can be deployed with minimum effort for the system, but maximum effort in fooling the human.

[ThingsontheWeb]

;) LOL

[ThingsontheWeb]

Wow. Never saw this video before and I read all the posts, 5/5 Great!

I think OS 10 would be much more secure in a work environment. But " in a office environment, it would be distracting, unless you get rid of ILife, Isight, Msn Msg, music, and games.

Would Apple do it?

No - Let's hope Linux has some balls

[BBDD07]

I understand what you are saying but I disagree if market shares don't have any thing to do with it then why does apple now recommand anti virus software

[therevivedone]

Great video. I really enjoy watching the technical videos you produce as apposed to the more general and consumer based videos others produce. I do like both types of video but you are really the only person who goes to the more detailed end. Keep it up!

[MacOwnage]

I find it kinda ironic, that when I was watching the video, there was an ad for anti-spyware software below it. haha.

[IknewitWin7]

I've read all the posts on this topic, and loved the responses.

Mr. Bit,

Great topic for debate. You should re-open the "set OS X free" topic again. Now that is a topic we all can talk about.

[svtcontour]

5. I believe that MS is a target because it is the so called greedy company so part of the break-ins might be out of hate. There have been hacked Linux servers for sure. I've been at least to 2-3 sites (one was a forum) where they got hacked. That could just be crappy administration but it does happen. Never seen a massive site hacked though.

6. Vista represent a smaller number of users vs XP. Path of least resistance. Still a step in the right direction with the UAC thing. That I agree.

[svtcontour]

3. An exploit has to be followed by the production of software that will protect the system or something to be sold and that requires software development and money. I believe most viruses come from companies that actually make the antivirus - yup conspiracy theory. Anyway if they sink money in development, they'd get it back and then some by the huge crowd that would need to buy the fix.

4. I cant really comment. I've been at 4 companies as IT and none have had hacked servers yet.

[svtcontour]

#1 - Cant say I ever recall the Apple II overlapping MSDOS machines for long. When I had my 286, Apple II was not really THAT popular. I dont even remember viruses or malware until I got my 386 and even then it was rare.

2. Are you sure OS8 and 9 had a lot of viruses? I worked at a training lab from the time of OS 7.5.3 to OS9 and none of the machines ever got a single virus - and yes they were online. Students surfed a lot of porn but thats it.LOL.

[svtcontour]

Infact, I truely believe that if all of a sudden overnight OSX or Linux became super popular and hackers and malware writers focused on them, they would be less prepared than MS to deal with it and may suffer more - at least in the short run while they figure out how to fix the security issues. This is just a guess but I believe it.

[mrbit10]

i am about to stream.

[timg455]

Less motivated maybe, but I don't know about less prepared.

[svtcontour]

Hmm ok fair enough because we dont know how prepared they are :)

[svtcontour]

Infact the fastest hack in an organized event that invites users to do so was the 30 second job done on the Macbook Air. Doent mean OSX is bad or MS is better, but it means that no system is foolproof and not even close. Anyone REALLY wanting to get in, will do so.

[mrbit10]

nor did I say that, i gave plenty of example via OS X.

[svtcontour]

Sorry, I just used OSX because it was a smaller number. Didnt mean to single it out but its less popular than MS OS's so it was used for the example.

[blacksteel25]

You can't totally throw out market share especially when Malware and spyware has a direct coalition to it, to make money.

[mrbit10]

those are usually based on social ploys and do not really require exploits or system weaknesses, simply the weakness of the person and if that is the case and it is for money, then why sell yourself short by picking only one OS. Again social ploys have nothing to do with the OS and thus market share should not matter, make money on all of them, it only requires deceiving the person.

[svtcontour]

mrbit10, there have been a number of tests where a windows, linux and Mac machine were put with invitations to have them get hacked and in none of the tests I found did the windows box get hacked into first. I'll see if I can find you some of the examples I wrote.

That for me says it all. When a system is configured and maintained properly, be it windows or other, it should be pretty solid. Windows is not actually easy to break into when configured by someone who knows what they are doing.

[mrbit10]

I have seen many of these tests and reports where windows is tested and credited, but as with anything, the reality was something different, even now with the latest worm that got past the UAC. History has shown something different and while MS has improved, it cannot simply be ignored especially for the history of linux and the years of OS X.

[svtcontour]

Yes but honestly, nobody is going to bother writing a worm for OSX. Just like how a suicide bomber is not going to run into a building containing 100 people when there is another one beside that has 1000 people.

It cannot be denied that the focus will be towards the larger crowd. This applies to everything.

A honda civic is going to have more attention with regards to performance parts than a saab turbo...no reason other than popularity. Attention goes to where the #'s are.

[mrbit10]

ok did you read the questions at the beginning of the vid, i believe 6 of them, please answer them, i am curious as i find it hard to blame market share considering all.

[svtcontour]

I didnt read them to be honest - just watched the video through. I will go look now :)

[tyranis1]

Although your points are well validated the thing that pop into my mind time and time again with this video is that if people want to find exploits they will find them. Which goes right back to market share because all it takes is someone with the right skill and the determination with a goal to effect as many PC's as possible which the only way to accomplish this goal is by choosing the most user OS which so happens to be Windows.If OSX was the popular OS it would be faced with more exploits.

[TalesOfWar]

I find it quite ammusing how people say OS X will get more and more viruses and exploits as it's market share rises. It's gone from around 7% to 20% in the last 4 years and it's still going strong with very few exploits and viruses. If people's market share argument is to be believed then we should have seen 13% more exploits and viruses for OS X over the last few years, but the fact is, we've NOT.

[IknewitWin7]

show me where it has 20% market share

[dragonballjiujitsu]

The fact remains that Microsoft is still the biggest target. That in itself is not why it has so many exploits, Its why they are found.

If every person who spends their time trying to find exploits for Windows suddenly turn their full attention to OS X , I'll bet we would see thousands of "new" exploits for OS X almost over night. Not near as many as Windows, but far more to be sure.

[mrbit10]

WOw, so you feel that OSX is not secure? If market share is the reason, why then furing the Apple II did MS DOS have more exploits when it had less market share than Apple? Why then when Apple got sloppy as with OS 8 & 9 had a plethora of viruses with smaller market share as compared to now. Could it possibly be that the system ease IE design is the culprit?

[dragonballjiujitsu]

No, I feel that OS X is very secure when compared to Windows.

I also think the architecture of the OS is the main reason for its security. But to think market share has nothing at all to do with it is one sided flawed thinking.

[bombkangaroo]

I also occupy the middle ground here. I'm quite sure that more resources would be put into finding exploits in OS X if the grass suddenly got a lot greener on that side.

While I don't believe the number of successful attacks would rival those on Windows machines I suspect they would increase with the value of what compromised machines could potentially yield.

Nowadays things are a bit different to the days of DOS. Breaching security is a much bigger business than it once was.

[bombkangaroo]

We've passed a point where organised criminals have become interested in this activity because of the potential yields from compromised systems.

Some of them even make their money from renting out botnets for DDoS attacks.

[mrbit10]

Hey thanks for the comment. So the context is profit? My question then would be if this is a social ploy, usually that does not require a system exploit vs an uniformed user of which I have no defense, but then isn't everyone fair game across all OSs, since the ease of the attack is human based rather than the system?

[bombkangaroo]

Like you say, the hackers spread themselves out, so they're not going to rely solely on social ploys to get their botnets, they'll use any means at their disposal, within reason, to get at people's computers.

I'm not saying that vulnerabilities will magically appear because of market share, but I would expect to see some correlation with the amount of effort people put into hacking, and therefore the amount of success they have.

[SPTSuperSprinter156]

(3)

You then go on to say how the root user in OS X is locked down, and this helps to protect the kernel. That's complete garbage. If the system is fundamentally insecure at kernel level [which *nix based systems are], you cannot recoup some of that security at a higher level. If the kernel is insecure, no amount of 'user lockdown' will change the fact that it is a flawed system.

I'm sorry, but I got bored after 8:30. You basically just started mumbling.

[mrbit10]

Your logic is not following here, you just stated that the system is insecure "fundamentally" and therefore already breached, it is the opposite if the root user is locked down in through DAC/MAC services the kernel is protected, what is then your argument? Certainly a social engineered ploy could get someone to grant access, but this video is about system design and system exploits that are not user driven.

[SPTSuperSprinter156]

(2) You then go on to talk about how Windows has evolved, particularly on the NT side of it, and how many 'exploits were preserved'.

Evidently, you have a real misunderstanding of how Windows works. The NT kernel is totally different from the 9x kernel, and features a tamperproof reference monitor. Unfortunately I can't say the same for Mac OS, which relies on the outdated Unix kernel.

Also, viruses and security exploits are not the same. You cannot patch a virus.

Give up?

[mrbit10]

I have a full understanding of NT, i used to work with them from 96 onward. MS changed direction for cost and legacy while keeping much of the written structure. Example, NT was RISC and POSIX compliant and supported OpenGL through SGI as its main front. They changed most models for the sake of compatibility to help bring in 95 systems so that the user base would not get cut off, how do you pretend to preserve legacy? OS X outdayted, I see, yes UNIX is outdated, sure if you say so.

[dragonballjiujitsu]

Although I agree that architecture is Windows main flaw, you can't ignore the fact that the tallest nail gets hit. Over 90% of the world is Windows, therefore most hackers, crackers, and virus makers spend there time making exploits for Windows.

If OS X or Linux had over 90% of the market share, most of these guys would spend their time making code for these operating systems.

As OS X becomes more popular, more exploits will be made for it. Does that mean the architecture has changed?

[mrbit10]

I think what most people miss is that you cannot make an exploit it has to pre-exist, but things like social engineered malware which require no exploit can certainly spread and reach more via the market share. That said 90% market share does not mean there are more hackers and all working against windows. The reality is that true hackers are very small and number and cross-platform.

[dragonballjiujitsu]

"That said 90% market share does not mean there are more hackers and all working against windows"

Um, yes it does. Most true hackers use some version of Linux and they spend most of their time hacking Windows boxes.

[mrbit10]

1. using linux is already cross-platform capable meaning that it is not native to windows. Do not count copy cats, 1 exploit is the exploit.

2. The numbers do not increase in hackers because of windows, UNIX has been around far longer and had its share but never the amount of windows as windows left itself open.

3. OS 9 had smaller market share and a plethora of exploits and viruses.

[SPTSuperSprinter156]

dragonball, the reason people target Windows is because by bringing large groups of Windows systems down, you would end up making headlines to say the least. Business would be affected all over the place.

What's the best you can do by killing a Mac? Perhaps ruining someone's next college project or making the little girl downstairs cry, that's what.

As I've said before, any serious business user who relies on a Mac should be laughed out the door. iLife, anyone? How about an iMovie?

[mrbit10]

actually that is not correct, if you exploit say an RPC service as is many the weakness in Windows over the years especially with buffer overrun, you could take down an exponential amount of Macs, if the exploit existed, and what better way for all the anger against Mac then to break it and then claim it.

[mrbit10]

Now I will agree for money schemes which are social engineered ploys and do not really require a hack target windows to make the most money, but this vid is about exploits, the major failures of MS as with CodeRed and win.32 and so on.

[SPTSuperSprinter156]

(1) Your theory is totally flawed.

You say that market share has nothing to do with exploits discovered, that's total rubbish. The more market share a system has, the more people are trying to find ways to get into it. Windows dominates the corporate world, many organisations rely on it. Banks, legal institutions, the police, etc.

I can't say the same for Apple Macs, not to mention the fact that if someone came into my organisation sporting 'iLife'... I'd laugh them out of the door.

[mrbit10]

By your logic, then everyone has a mastering of hacking skills, that is rubbish, therefore numbers do not mean a thing. The real number of skill hackers is quite small and they are all cross-platform coders, if you truly understand hacking you will not what i mean in terms of true exploit hunting vs social engineered schemes that require no exploit.

[GlockNinja]

Isn't the arcitecture (flaw) of Windows its best feature? I mean because Windows is such an easy OS to program for even though a lot of it is negative programs like viruses, isn't it what made it more mainstream than the closed OS from Apple?

[Jedibron]

Actually Apple is a lot more open with devs on their OS than MS is.

[mrbit10]

Easier to program???? Who said that?

[mrbit10]

OS X closed???? No you mean Windows is closed, OS X's kernel and microkernel can be downloaded, in all the years I have programmed for MS, i have never had any open code relating to the OS internals.

[brtidwell55]

There is no such thing as a perfectly secure OS, but some are better than others. Design matters. Its a fact of life that Windows OSs have a less robust security design than Unix/Linux OSs.

[IknewitWin7]

I don't think any OS is free of security breaches, and the more users buy a certain OS, then that OS will be more subject to attack because you can exploit it on a bigger scale. Now we are seeing websites, like youtube, being hacked into more and more, and that's my ultimate fear. No matter what OS you use if you online bank gets hacked you're screwed.

[IknewitWin7]

How would that explain the problem people are seeing with Linux in Brazil? More and more companies are using Linux in South America and they are finding more and more attacks on their servers. They don't see the virus issue like here in the US wih Windows, but still have their security issues.

[mrbit10]

Attacks on servers happens all the time, how successful the attacks are is the question. Everyone has security issues, no OS is perfect as I gave examples. But if you insist that market share is the culprit, then what is the use of security design? All i hear is Windows has 90% market share and cannot survive it, so why even try? The reality is that true hacker numbers are small and are all cross-platform. The 90% number does not mean a thing, it is not 90% hackers.

[IknewitWin7]

But that's what I mean, market share and attacks will increase proportionally. How successful they are will depend on what kind of security they are running on their servers. If Apple owned 90% of the market share, do you still believe that there would be more attacks on Windows because it's vulnerable? People want to attack masses to have a better chance of exploiting a user who might download a file that is malicious, rather than how insecure the OS is.

[mrbit10]

If the attack is not successful then there is no problem, as with the slapper worm vs codered. If it is not successful job done. Take the UAC, Vista has cut down attacks hugely, have all the hackers gone away???

[mrbit10]

*Cut down successful attacks / exploits!

[mrbit10]

The masses argument is for social engineered ploys which really do not need an exploit and no OS can stop a user who insists on downloading a file. I did not cover that, as MS history of massive take downs stem from its problems with RPC and other services.

[IknewitWin7]

You are saying that if Apple owned 90% market share, that hackers would not be successful? Hackers and security is like the chicken and the egg. No one knows which came first, and they will always be here. So they wouldn't be successful at hacking OSX? I'm sure if Apple owned market share they would see more of it, that's all I'm saying. Is OS X more secure than Windows, probably, but that wouldn't stop them, they want the masses, they don't care how hard or how long it would take to break in.

[mrbit10]

Well wait, i believe that OSX will have mistakes made, perhaps as blantant as MS's but is it not the number of system exploits tied to the exploits successfully exploited? Would the variable of X amount of exploits limit the amount exploited? So if system X has less exploits than system Y is one going to have less or not? Bottom line is that there has already been success in hacking OS X, i listed a few of them, but none as harmful as say MS's RPC mistakes.

[IknewitWin7]

If I were a hacker, and wanted to steal info from people, would I attack the weak?, or attack the information I want? The information I want is not mom down the street, it's the masses. I'm not saying Windows is more secure at all, I think Linux and OS X is much more secure no matter how many people use them, but the more people who use OS X, will proportionally make more hackers try to hack OS X. As long as there is someone who can make an OS secure, there's another one who can hack in to it.

[mrbit10]

Well wait, hacker numbers do not really grow in that logic. Copycats can but by that time the patch is out and then the error becomes user level for failure to install. If the hack is not really hack via tech exploit but more for a social ploy as to get some ones money, that is hard to beat, but does not make sense to just hit windows, social ploys work on all OSs and telephones, email, regular mail and so on, so if the motive is profit just going after windows does not make sense.

[mrbit10]

To answer your question, logically a social ploy has an expiration time for return so Macs have millions of users the actual margins of gain would be the same before security is implemented if the quest is money. But if it is for like the RPC take down of MS, i has a hacker would go for the weaker as it uses less of my resources and more time to find more of the same weaknesses.

[IknewitWin7]

I completely respect you MrBit, but this statement makes me think you are gullible. It would be easier to steal money from an old lady walking down the street, but true thief's go after banks. Market share is because most businesses use Windows (US), and will be subject to more successful attacks, as would OS X, if they were givin the motivation.

[mrbit10]

Well in this exploit scheme there is no profit in the RPC take down, usually that lies with identity theft and phishing where everyone is fair game, system exploits are meaningless with these kinds of attacks and market share does not make sense when all targets are profit, why limit one self?

[mrbit10]

No worries, respect given back, but if we are talking about number I would say that there are more of the simpler crimes than big bank takes downs thus paralleling computers, can we say the majority % is truly the bank robbers or the street muggings?

[IknewitWin7]

I see you updated your vid. I'm not referring to the hack who can break into the pentagon for bragging rights. I'm referring to the hackers in China who DO NOT want recognition, they just want the information. The information is on computers that run the OS that most companies use to store it. OS X would get hacked if it had the information they wanted. I refer to China, not to disrespect any Chinese Americans, they just have a reputation of stealing technology.

[mrbit10]

Be more specific here, china wants identities for example or the actual intellectual property of company info stored on the computer or the property of the OS? In either case I would say then UNIX should be the biggest target, in all my years in computers encryption is always used and the big guns usually use UNIX in the server world vs IIS, thus the market share their would favor non-microsoft systems.

[IknewitWin7]

K, I'll be more specific. China steals technologies from fast up growing company name A, to duplicate the manufacturing of company A's idea there in China, to reproduce all over the world. I'm not talking about fake Nike's. Big stuff, they will exploit any OS with market share

[mrbit10]

Well I would say the server market is not ruled by MS. Since this is business they are after the servers(DB info) and available ports incoming, BUT if they use a social ploy again all are fair game and why deny gain for being selective on an os when the only defense is human rather than the system? So again in servers and enterprise windows does not rule but yet it gets fare more exploits than its competition.

[IknewitWin7]

Company A uses market share computers, cause they're cheaper. Company A gets hacked. Why? Microsoft? no Who ever owns market share will ...eventuality get hacked into, with no mdeia coverage.

[mrbit10]

wait, price does not dictate market share and many times MS is far more expensive then Linux. Heck even IBM can price point MS and for many Qs over the years win and lose some, but the business market in terms of stored information is not dominated by MS so the market share argument is lopsided.

[IknewitWin7]

Price doesn't dictate market share? *sigh*

How many computers are in your home?

How many at work x number of companies in the US/ROW.

Company's have financial discussions. If Mac OS X was released, Apple stock would explode, for example.

[mrbit10]

I do a lot of server work for companies and they choose based on function, reliability and many other reasons. I mean Sun, IBM, HP vs Dell would have no hope. I cannot concur that price wins the day and if it did Linux would win, MS cannot beat the price in Business for server stored info. In either case, Windows is not the market share winner in that demographic even if I were to say MS has 52% and the rest 48% the exploit ratio does not jibe.

[IknewitWin7]

you left out Novell :(

Are we talking clients, or servers?

Clients will get exploited if they are the target of hackers. Windows is doomed, 4 now, I wish OS X was the company standard.

1. Less trips to your coworkers office

2. To prove my point.

[mrbit10]

sorry, yes Novell is duly noted. :) Yes you can hack a client but usually that is done through a social ploy which is not OS specific but the servers where the info is likely stored is not MS dominated, thank the lord.

[IknewitWin7]

But they can emulate through a user.

You can insert OS A, OS A has a leaker.

"for hackers, and thief's, the market share is the target, and will always be the target. Yes, in my opinion market share has a very bad influence on windows security.

[mrbit10]

Ok MS is not the cheapest in many applications, but this is moot to debate cheapness. In the business server market, MS does not rule but yet they get more exploits. If you are after a client machine really the way in with all things equal having the usual business security protection, it would likely be a social ploy to trick the person into giving up info, even then depending on the location storage which is likely a server MS again does not rule the share.

[mrbit10]

by the way I enjoy the conversation, thanks for being civil. :) As for making it more secure than the opposite statement you made, Vista would state the contrary, they have reduced the amount of system exploits but the hackers have not gone away.

[IknewitWin7]

well a debate is a debate, this will never end. Nice Video like always, 5/5

[mrbit10]

My position is not to say OS X, UNIX and LInux are not breakable or have not been broken, that would be a lie. This vid follows up how MS made the mistakes by creating a larger list of X exploits than its competition. Example would be when Apple had more market share with Apple II vs MS DOS, but DOS had more exploits.

[mrbit10]

A larger list and riskier and more damaging list especially with RPC.

[azaas]

Amazing video!!!! 5/5 on presenting the full picture :D The fact that you give facts and not biased opinions makes your credibility to rise on a whole other level than the one i'm used to seeing on youtube!!!!

Keep up those amazing videos man -_*

ps: i got one small request...Can you plz make a video talking about open CL and if and how could that ever affect snow leopard's security. btw i think we're safe but having your opinion on that would be awesome :D thx in advance :)

[blacksteel25]

I've always believed and though this...

You can have the best computer security in the world, but it only takes one person to mess it up.

[iharrison30]

Fantastic video Mr Bit, as with all your videos, extremely intuitive and educational. I always learn something new when I watch one of your videos which is always a good thing. To expand ones knowledge, and from such a mentor, is thirst quenching of the knowledgeable type.

[blacksteel25]

Hey Mrbit I did read that Windows 7 drivers are going to be sandboxed. I wonder if that's going to help at least a little with Security since some virus's can attach to certain drivers.

I kind of feel that Malware and spyware, not Virus's will be of greater concern to Mac's as they gain marketshare. Some Mac only Malware I've read about even got root access because it would install a key logger.

[mindblast187]

You have good points. Especially the part about user error. I've used windows all my life and never gotten a virus.

Although opening automatic email attachements could of caused me a problem.

Overall, I'd say windows isn't as dumbass proof.

[SPTSuperSprinter156]

And on the contrary, by being 'more dumbass proof', Mac OS has much less freedom than Windows.

Not to mention its performance is absolutely terrible compared to Windows.

[JGalva88]

How can you say OS X's performance is terrible compared to Windows. Thats one of the dumbest things I've ever heard when talking windows and OS X.

[SPTSuperSprinter156]

Perhaps the fact that Mac OS X ran slower on my 1.8GHz C2D Mac Mini with 1GB of RAM than Windows Vista [with Aero enabled] on my 1.2GHz single core netbook with 1GB of RAM?

Not to mention the fact that Vista's visuals are way more impressive than OS X's and they run a ton smoother on this.

Macs are nice and all, and they look and run nice enough if you have enough cash for its gargantuan requirements, but I don't fancy paying out the arse for turd polish, and I'm glad I didn't get another.

[JGalva88]

I don't really believe that your netbook runs faster than your mac mini.

[mrbit10]

How does OS X have less freedom, i have been coding for over 14 years, i have yet to see an open kernel for MS, much less any of it middle tiers, however I can download OS X's kernel and Microkerenel. Freedom, right.

[JGalva88]

thats sounds like thats as much free as it can get lol. You proved him wrong with that one.

[masterd151]

Finally you touch on this side of the topic.