Security: Not the fault of the OS anymore

The headline of the article I've linked below is spot-on. Security isn't about measures taken by the operating system any longer, it's about measures taken by users themselves.

For instance, as an IT professional with a good knowledge of computer security practices, if I wanted to I could work every day with Windows and remain malware-free just by being conscientious about what I do with the computer. Windows is certainly an unstable house of cards in that regard, but if you know how to use it you can be just as safe as anyone else, even without anti-malware software installed.

Even OS X has recently had an outbreak of malware, but it requires unwary users to install unverified software in order to infect machines. I still maintain that it requires a much less watchful eye on system processes to keep a Mac clean, but it is by no means immune.

However, I do take issue with the final paragraphs of the linked article. It's true that Microsoft is still the biggest target, and that very fact makes exploitation more lucrative and therefore more likely to be attempted. However, the underpinnings of the operating system still rely on legacy code with a much more relaxed security model. The Unix architecture on which OS X is based is by far a much more stable design.

Windows isn't attacked day and night merely because it's got larger market share; while that's a contributing factor, it's also got many more exploitable attack vectors. And, as John Gruber has pointed out in the past, OS X isn't "utterly impervious to attack because it’s protected by magic leprechauns." It's just better.

But, to reiterate the main point here, either one is only as secure as its users, who have to be quite a bit more fastidious if they've got a Windows machine on their desk.

When it comes to security, it's the user, not the OS | Macworld

On Predictability

I've been thinking a bit lately, and I've come up with this maxim:

Anything predictable is exploitable.

I'm going to confine this to network traffic at this point, since it's the only application for which I've given this much thought, but I'm willing to bet that it holds true in other areas as well.

Keep in mind that exploitability is not, in itself, a bad thing. A Web browser predicts that an http:// server is running on port 80 and exploits that. With that assumption, most people won't have to know what the previous sentence even means. Sometimes you run across sites where you have to enter "dummydomain.net:8080" in your address bar for servers that aren't using port 80 for Web traffic, but the ability to assume and predict a standard port is good.

On the other hand, exploitation can be bad. In old TCP stacks, the sequence numbers always started with 1 and incremented from there. This ability to predict traffic and forge legitimate responses can allow malicious machines to hijack sessions through what's called a "man-in-the-middle attack." More modern implementations of TCP/IP start the sequence number randomly; this prevents prediction and exploitation.

There are many steps in a chain at which predictability can lead to exploitability when it comes to network security, and not all of them are even technological. Take, for instance, the predictability that some percentage of users will click the link in a spam email message. Given that mass amounts of email can be sent at virtually no charge, and there is always some small percentage that will respond positively, there is still a return on investment that makes spam campaigns profitable. [0]

The same thing applies to cryptography. The only way to have a message encrypted well enough in transit to prevent decryption is to create ciphertext that is as close to pattern-free true randomness as possible. If there's any way to detect patterns, and therefore create predictability, exploitation will soon follow.

I can go on, but I think I'll stop here for now. I think, however, that the ability for prediction to beget exploitation is the driving force behind security these days (not limited to computer security). For instance, it's the regulated unpredictability of financial systems like the stock market that keeps people from reliably exploiting them for their own gain!

I might have more thoughts later, but I just wanted to put this out there while it was on my mind.

[0] "Spamalytics: An Empirical Analysis of Spam Marketing Conversion." Chris Kanich, Christian Kreibich, Kirill Levchenko, Brandon Enright, Geoffrey M. Voelker, Vern Paxson, and Stefan Savage. Communications of the Association for Computing Machinery 52(9):99-107, September 2009.

Hudzee - Hard Drive storage

I just found out about a new hard drive storage case which is actually pretty neat. Most technology enthusiasts and computer professionals have at least a few hard drives just sitting around, full of old data which we're not quite willing to discard just yet. Or maybe it's a new drive you just picked up cheap at a swap meet or rummage sale.

Sure, you can put these bare drives into anti-static bags, but that can get clumsy. It's hard to store a bunch of bagged drives, and it's even harder to figure out what's on each one.

The Hudzee helps you safely store and organize your drives. It's a plastic case with a bit of padding on the inside to keep the drive's delicate components from getting scuffed or scratched. For anyone who regularly deals with hard drives—whether it's storing spares in case of failure, archiving old data, or for transporting large amounts of data via "sneakernet"—these cases are very cool.

I recently ordered a few, and I'm really impressed with how well the drive mechanisms are protected. They're cushioned, but still given plenty of room inside the case to breathe. There's also a window on the outside of the case for labeling, so you can remind yourself of the drive's contents or purpose when it's sitting on the shelf.

I definitely recommend the Hudzee drive case. It's an easy way to keep your data protected, secure, and easy to organize.

$8 each ($65 for 10).

HUDZEE - Keep Your Internal Drives Under Control
(via The Adventures of Systems Boy!)

xkcd... still great

This is from Monday, but despite being a few days old it's still pretty awesome. As usual, the punchline is actually in the mouseover text.



xkcd - Success

Computer Security: Is Windows Worth It?

I recently read an article in USA Today about the measures people take to secure their Windows PCs. Since switching to the Mac a few years ago, I can't help but shudder when I remember the attention I had to pay just to keep the machine running smoothly. Just keeping up with Microsoft's security updates on my wife's Windows laptop (she needed it for work) is difficult.

There are so many options: you can shell out money for anti-malware utilities ("malware" is a term that encompasses all malicious software, from viruses to worms to spyware), or you can find comparable software for free if you know where to look. But even once the software has been installed, you still need to diligently check the Internet for updates; otherwise, your money and/or effort is rendered useless.

And then I look at my Mac. It's a great machine: it does almost anything you would require right out of the box (aside from a few small shareware and donationware products, the only Mac software I've purchased is Microsoft Office), and it's got an inherently better security system than the one found in Windows.

As the linked article testifies, I don't mean to imply that Macs are somehow immune to intrusion. As John Gruber puts it:

The explanation that makes sense is the obvious one: that Mac OS X really is more secure and better designed. Not that it’s totally secure. Not that it’s perfectly designed. Not that it is utterly impervious to attack because it’s protected by magic leprechauns. Just that it’s better.

As disheartened as I am by the state of Windows security, I can say that there really is a better option for the average user. (The fact that it's also a really cool option for advanced users is an added benefit.) Mac OS X really does make a home computer easy to operate, easy to maintain, and-- thanks to its thoughtful design-- pretty darn easy on the eyes as well.


Links mentioned in this post:
As far as PC security, Goldilocks got it just right (USA Today)
Jackass of the Week: Larry Seltzer (Daring Fireball)