Researchers give Leopard security low marks

But does it matter when hackers don't bother attacking Macs?

Security features that Apple Inc. added to Leopard look great on paper, but in practice most are half-baked or useless, experts said Wednesday. And none of those features, good or bad, will make a whit of difference in how safe Mac users are when they hit the Internet.

"I do think that this is the most significant update in the OS X line when it comes to security," said Rich Mogull, a security consultant and former Gartner Inc. analyst. "But Apple didn't finish the job. There's a lot of room for improvement here."

Apple touts more than a dozen new security features and tools in Leopard, from anti-exploit memory randomization and an application defense dubbed sandboxing, to a guest account for shared machines and tighter control over input managers, long-abused operating system components that could be used by hackers to jack Macs. But with an exception here and maybe there, any crowing by users that Mac OS X 10.5 is more secure is premature.

For the most part, Mogull sees the new features as laying the groundwork for serious work down the road. He gave only a few -- such as the new restrictions on input managers -- rave reviews. "The changes in input manager are huge," said Mogull. "It shows that Apple is willing to reduce functionality to increase security. It's never done that before.

"Great, great move," he said.

Input managers, code originally intended to provide accessibility and internationalization functionality to Mac programs, have morphed into plug-ins created by scores of third-party developers. And they're a straight street to the operating system that hackers could drive as easily as legitimate programmers, said Thomas Ptacek, a researcher at Matasano.

"Almost all plug-ins abuse input managers," said Ptacek, who agreed with Mogull and tagged Leopard's lock-down as a smart move. "They've been used by the good guys, but they could also be a really bad way for attackers to backdoor a Mac. Fortunately, Leopard's made it a lot harder to install them."

Other moves by Apple on security, said Ptacek, include Leopard's new sandboxing, which let the company's developers restrict applications' actions, such as what network access they're allowed or what other programs they can communicate with. While applauding the effort -- "sandboxes are better in some ways than what Vista provides," he said -- Apple's follow-through was dismal. "Almost nothing you care about is sandboxed," Ptacek argued, pointing out that Safari, iChat and Mail, the three applications most often exposed to malware, or used as an attack vector, are not sandboxed.

Nor has Apple documented the feature. "You can't officially use this API to secure your own code [and] we can't read their code or specifications to test whether it's secure," Ptacek said.

Mogull, meanwhile, pegged an application not even on Leopard's list as the best thing in the new operating system for security. "The most material to security is Time Machine," he said, talking about Leopard's new automated backup and restore software. "IT security always talks about confidentiality, integrity and availability [of data]. Time Machines really makes backup, the availability part of that, accessible to any user, even my mom."

But those few bright spots are overwhelmed by features Mogull and Ptacek called "a mess" or "easily breakable."

Start with the memory randomization feature Apple dubs Library Randomization, both said. Although in theory it can block or at least hinder many of the current exploits -- because hackers need to know exactly where to inject their code to corrupt memory or get their exploit to run -- Apple's implementation is weak at best. Ptacek tagged it as the Leopard security feature that's most hype and least helpful. "This first incarnation is easily breakable," he said. "It might as well not even be there. But it let Apple tick off the feature when it's compared to Vista."

Mogull dismissed Leopard's memory randomization as well, but saved his best shot for the new operating system's firewall. "It's a mess," he said, rattling off a slew of problems. By default, Leopard installs with the firewall disabled, a practice that leaves users unprotected. It's also a step back from Tiger's firewall, he said, because it's both less flexible and more confusing. And after some preliminary testing, Mogull remains unconvinced it even works like it's supposed to.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?