toggle

AAPL Stock: 497.67 ( -11.79 )

MacNN News

'Month of Apple Bugs' to begin January 1st

updated 10:50 am EST, Wed December 20, 2006

'Month of Apple Bugs'

The anonymous security researcher who identifies himself only by his online alias of 'LMH' has vowed to begin a 'Month of Apple Bugs' following his 'Month of Kernel Bugs,' which took place last month. Beginning January 1st, 2007 the researcher and his partner Kevin Finisterre -- another security expert who has reported several Mac OS X security holes to Apple -- will publish one security flaw per day in Mac OS X or in Apple's own applications for the month of January, according to one Washington Post blogger. The anonymous researcher refused to provide affected vendors advance notice prior to posting the kernel bugs on his website in November, and has vowed to do the same during the month of Apple bugs. "Right now, many OS X users still think their system is bulletproof," LMH said in an interview via instant message. "Some people are interested on making it look that way."

by MacNN Staff

(30)

TAGS :

troubleshooting

Share the Article

Facebook Twitter Delious Slash Dot Digg

toggle

Comments

bsaxton
Fresh-Faced Recruit

Joined: Jan 2000

0

12/20, 11:30am | report spam | close Reply |
That's nice...

...maybe this guy would like to also publish lists of holes in national national security systems... you know, teach the government a lesson...

bobolicious
Fresh-Faced Recruit

Joined: Aug 2002

0

12/20, 11:31am | report spam | close Reply |
How destructive...

...a methodology is that...?

No I don't think my mac is bulletproof - far from it - but there is a sense that few care...

While I applaud the effort to identify issues & pressure for quick fixes it would seem making them public domain with NO advance warning would only serve to encourage malice & degrade the general mac community security perhaps drastically in the short term...

Please give the vendors a chance to provide fixes before announcing such bugs & potentially making computer use a needlessly more dangerous & exasperating experience than it already can be for many...

And yes I use a firewalled router, encrypted wifi, nightly backups, don't open unknown emails, remote host my website & have my firewalls on...

jonbwfc1
Fresh-Faced Recruit

Joined: Nov 2003

0

12/20, 11:35am | report spam | close Reply |
Hmm..

""Right now, many OS X users still think their system is bulletproof," LMH said in an interview via instant message. "Some people are interested on making it look that way.""

And there are an equally large (possibly larger) number of people who would stand to make a lot of money should Mac OS users be panicked into buying the same anti-virus/spamware etc. apps that windows users have to.

Interesting thing anonymity isn't it? Means you're never vulnerable to being accused of having an ulterior motive.

Jon

Tim_s
Fresh-Faced Recruit

Joined: Jul 2006

0

12/20, 11:36am | report spam | close Reply |
maybe..

he should send them to Apple first, then if nothing is done about in a reasonable amount of time, then release the bugs in hopes of getting Apple's attention.

I like the fact that there are people with the know-how to find problems, but not notifying the company first smacks of childishness. Maybe if they publish fixes along with the bugs, it would be better.

I'm not a violent person, but some people need to be slapped in the face for acting out like this.

technocoy
Fresh-Faced Recruit

Joined: Oct 2002

0

12/20, 11:38am | report spam | close Reply |
this still...

irks me, since this guy pushes the publicity in order to give people a bad impression of OS X... In that he's failing the public since it hides the fact that OS X is still the FAR better and secure OS when compared to certain other offerings.

Maybe someone should do a blog, 30,000 bugs in Windows in a month, and post 1000 bugs a day for a month.

Seriously, the guy slams OS X under the guise of making things better for the consumer.

If that was his intention he would at least do the responsible thing and announce these flaws to the vendors before he shouts it out to the world of eager PC users anxious to attack OS X to "show us uppity Mac users".

Get a brain. moron.

Monstermind
Junior Member

Joined: May 2000

0

12/20, 11:54am | report spam | close Reply |
Interested ON?

Just sayin'.

::maroma::
Addicted to MacNN

Joined: Jan 2002

0

12/20, 11:59am | report spam | close Reply |
lame

this guy is lame. he's doing this for his own advancement. if he were truly interested in helping people he wouldn't punish Apple or any other company he's doing this to by not giving them the info he has so they can fix it promptly. instead he's making it into a big production where he's the center of attention, even though he's staying "anonymous".

i would have much more respect if he would at least give the companies the info before publishing it on his site. he's a loser with too much time on his hands.

ricardogf
Fresh-Faced Recruit

Joined: Jan 2003

0

12/20, 12:07pm | report spam | close Reply |
Yawn

This nerd hacker was discredited before, and will be discredited once more...his "findings" were little more than vapor, and his anonymity is just a sick sign of his unwillingness to show up as a man...

In other words, he is just another wannabe "hacker" with no positive agenda...and he is bordering on illegal activities just for his own fake publicity and the benefit of the moronic Windows community. Ridiculous.

Gepard
Fresh-Faced Recruit

Joined: Sep 2000

0

12/20, 12:19pm | report spam | close Reply |
One comment

Here is a comment on the previous interview with the guy that was published on November 11 here http://blogs.securiteam.com/index.php/archives/730 ================ Wait, is this the guy who discovered, that the FreeBSD mount(8) man page, which explicitly says that �It is possible for a corrupted file system to cause a crash�, is, in fact, right, and then published an advisory about something that is already known, documented and not related to security (http://projects.info-pull.com/mokb/MOKB-03-11-2006.html)? Wow. Impressive. Comment by trasz � November 12, 2006 ========================

ADeweyan
Fresh-Faced Recruit

Joined: Mar 2004

0

12/20, 12:46pm | report spam | close Reply |
Bulletproof?

Apart from wishing the use of term "Bulletproof" when describing anything other than vests or glass was banned, I don't think many Mac users actually think that's the case -- and no knowledgeable Mac users.

MORE "Bulletproof" than a certain other easily-exploited operating system, maybe, but not by any means immune to attack or exploit.

The only people I hear talking about this are PC'ers who have taken offense at the idea that regular people can actually enjoy their computer if the OS treats them with dignity.

It's a classic move of the offended -- posit a straw man with an impossibly extreme point of view, then demonstrat how impossible that point of view is.

paulc
Junior Member

Joined: Aug 2000

0

12/20, 12:48pm | report spam | close Reply |
Ha!

Look at the comments posted to get an idea how complacent Mac users are! Deny, deny.

I kinda agree with tim_s, Apple should be given a reasonable amount of time. However, my general impression is they do NOT respond in a timely manner to such issues being brought to their attention. Both security issues and serious deal-breaker bugs in their software DO get ignored or possibly put into development for next year.

davidlfoster
Fresh-Faced Recruit

Joined: Dec 2005

0

12/20, 02:06pm | report spam | close Reply |
Accountable?

Shouldn't LMH be held accountable for essentially writing a manual (or at least a map) for would-be or want-a-be malicious hackers? It seems similar to me as someone who spends most of the day checking the doors of a residential community and then posting a list of the residences where residents accidently left their doors unlocked! The correct thing would be to let those residents know their doors are unlocked first. What is this jerk trying to accomplish? Nothing good I say.

Jonaziz
Fresh-Faced Recruit

Joined: Jul 2006

0

12/20, 02:07pm | report spam | close Reply |
re: ha!

I don't see any "Deny, dent" here. I see people saying that it's stupid for someone to try to attack something with no proactive intention. The guy obviously isn't doing this to help Apple, he's simply in it for the 'glory' of finding something wrong. If he were to contact the software providers before he posted lists so that they could correct it, it would be different.

In that fact we can see that he is more interested in causing trouble than helping the OS get better.

CT Mac User
Fresh-Faced Recruit

Joined: Jul 2003

0

12/20, 03:05pm | report spam | close Reply |
Check This Link

http://www.securityfocus.com/columnists/389

For info about Kevin Finisterre, founder of security startup Digital Munition, who created the three recent versions of the InqTana worm to raise awareness of security in Apple's OS X.

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

12/20, 03:08pm | report spam | close Reply |
Comments

this irks me, since this guy pushes the publicity in order to give people a bad impression of OS X... In that he's failing the public since it hides the fact that OS X is still the FAR better and secure OS when compared to certain other offerings.

Right, because if it weren't for this one guy, everyone would know that Windows has huge security holes. But, nope, everyone thinks its the most secure ever, because their attention is being averted by this guy. Or, maybe, he's just trying to show people that Windows isn't the only insecure OS.

The only people I hear talking about this are PC'ers who have taken offense at the idea that regular people can actually enjoy their computer if the OS treats them with dignity.

Yeah, except for that "Mac" guy in the Apple ad, who says Macs don't have to worry about viruses or spyware. But, beyond him, its all the PCers. (And how the h*** does OS X treat users with dignity, and Windows doesn't???)

I like the fact that there are people with the know-how to find problems, but not notifying the company first smacks of childishness. Maybe if they publish fixes along with the bugs, it would be better.

Some would say that more knowledge the better. If one person finds a hole, who's to say others with bad reps haven't discovered it and already have threats in the wild. If you knew all the open security issues in Windows, would you maybe look at and say "Meh, I don't want to use that!" or perhaps "Wow, look at that issue, maybe I want to turn on my firewall".

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

12/20, 03:17pm | report spam | close Reply |
More...

Shouldn't LMH be held accountable for essentially writing a manual (or at least a map) for would-be or want-a-be malicious hackers? It seems similar to me as someone who spends most of the day checking the doors of a residential community and then posting a list of the residences where residents accidently left their doors unlocked! The correct thing would be to let those residents know their doors are unlocked first. What is this jerk trying to accomplish? Nothing good I say.

What kind of accountability? There's no law that says you can't tell everyone that Fred down the street leaves his doors unlocked. Some would say that if you just told them, they'd ignore the information. But if everyone knows you leave your doors unlocked, you might be more likely to lock them in the future.

I don't see any "Deny, dent" here. I see people saying that it's stupid for someone to try to attack something with no proactive intention. The guy obviously isn't doing this to help Apple, he's simply in it for the 'glory' of finding something wrong...

Why should it be his job to help Apple? I don't see too many here proclaiming this type of fervor when there's Windows attacks or new security holes found. Ah, but then that's that pit bull MS, and they deserve it, while Apple should be treated as a friendly puppy.

In that fact we can see that he is more interested in causing trouble than helping the OS get better.

Hey, guess what? Virus writers are also interested in nothing but causing trouble. Should we just pretend they don't exist?

And with all the denouncement here, you'd think people were concerned he was actually going to find real problems and then there'd be viruses or trojans or worms floating around in no time. Shouldn't you all wait and find out what his 'bugs' are? I mean, when you find out they're all of the mythical "doing such and such can cause a crash that could cause privilege escalation with a properly crafted file......" and then you'll have to spend all your time again saying "Gee, call me when someone actually crafts that file...."

whackjob
Fresh-Faced Recruit

Joined: Aug 2005

0

12/20, 03:23pm | report spam | close Reply |
wrong

I don't thimk may OSX is bullet proof but compared to the alternative it probably is better.

But the bottom line is it's not and I think most users know this.

gregarios
Fresh-Faced Recruit

Joined: Jun 2005

0

12/20, 04:19pm | report spam | close Reply |
Hmmmm

Lets find out if HE is bullet-proof too! ;-)

jpellino
Fresh-Faced Recruit

Joined: Oct 1999

0

12/20, 04:35pm | report spam | close Reply |
all show, no go.

If this guy was for real, he'd do the right thing - go thru the proper channels, get these fixed, and be done with it. "Anonymous security researcher" is apparently French for "I can't stand the light of day but I need to feel important."

chadpengar
Fresh-Faced Recruit

Joined: Oct 2001

0

12/20, 05:28pm | report spam | close Reply |
let's see his "bugs"

Let's see his bug list. Let's see if any of them are "viruses" or "spyware."

And "testudo". If you knew that your neighbor left his doors unlocked, and you went and broadcast that to the world, you might be held legally liable as an accessory to any crime that led from that. IANAL and IANALAIDPOOTV but would be willing to wager you could open yourself to legal liability.

Clive
Mac Enthusiast

Joined: Jan 2001

0

12/20, 05:48pm | report spam | close Reply |
Well, just perhaps�

Apple already knows about these bugs, and just decides they aren�t worthy of time and effort - or at least they have other priorities.

I say, let him post the bugs, then duck out of the way.

technocoy
Fresh-Faced Recruit

Joined: Oct 2002

0

12/20, 06:25pm | report spam | close Reply |
wow, testudo

i love the way you grab the parts of the post that allow you to make some kind of argument out of it.

you totally leave out the fact that nearly no one is objecting to him finding holes, it's his moral compass thats off...

regardless of how I or anyone feels about him attacking the mac to get his attention fix, it's about the fact that he doesn't do the responsible thing and report them to the companies so that they can fix them.

Everyone expects security flaws to pop up, i don't know if you could right an adaptable OS with thousands of compatibility tangents that would be watertight from the getgo if ever, really.

If you are bitching that the system is broke and you make it your whole job to sit and seek out ways a system can be exploited in "theoretical" way's but then you just rub it in their face instead of reporting it, well then, you are doing yourself, the company, and all the consumers of that product a disservice.

In conclusion, the s****** shouldn't get his kudos for what he's doing..

if he was listing vulnerabilities and submitting them on a daily basis, he'd be of more help, and therefore deserving of said kudos.

I have no problem with an unbiased person bringing light to these things to try and get them fixed, but being an a** about it and trying to make it sound like OS X is hole ridden is a little over the top. I think if it was REALLY that hole ridden someone would have slapped us with quite a few more viruses, etc by now. period.

markjam
Fresh-Faced Recruit

Joined: Jun 2005

0

12/20, 07:05pm | report spam | close Reply |
The facts

I don't believe the Mac is bulletproof (it would be nearly impossible to write an OS that was without sacrificing the customizability and general-purpose nature that is expected of a modern OS--complexity breeds errors). However, I do know that there has never been a successful, in-the-wild virus or spyware application released for Mac OS X. In fact, to my knowledge, the only viruses ever written for OS X have been proof-of-concept only.

When the Apple ads claim that Macs don't have to worry about spyware or viruses, they aren't just blowing smoke. I don't believe the claim is that it is impossible to write such malware, but that none has ever been successfully written; up to this point, no Mac has had to worry about them. Contrast this to the tens of thousands of such programs written and successfully released in the Windows world.

slider
Mac Elite

Joined: Oct 1999

0

12/20, 07:09pm | report spam | close Reply |
Bug up his....

Social nitwit!

McDave
Fresh-Faced Recruit

Joined: Jun 2006

0

12/20, 07:19pm | report spam | close Reply |
OSX...

...will never be 'bulletproof' we just choose to live in a neighbourhood without guns.

What are the odds this guy's a dealer?

McD

LouZer
Fresh-Faced Recruit

Joined: Nov 2000

0

12/21, 12:20am | report spam | close Reply |
Re: well,

Apple already knows about these bugs, and just decides they aren�t worthy of time and effort - or at least they have other priorities.

Apple apparently believes there's lots of bugs that aren't worth the effort, considering the poor state of several pieces of their software (exactly when, Apple, will you find it worthy of your time to fix the freakin' finder! And why did iTunes 7 go out as crappy as it was initially??)

And its amazing how people seem to say that most people know OS X isn't without bugs, but fear that these announcements would cause mac users to think it has bugs? Or that the only people who find security holes are 'good' people, and the virus writers are just idiots waiting for someone else to find the problems, and without this guy, we'd have nothing to worry about.

Peter753
Forum Regular

Joined: Sep 2001

0

12/21, 01:37am | report spam | close Reply |
This man

Has an extremely tiny p****.

ibugv4
Fresh-Faced Recruit

Joined: Jun 2003

0

12/21, 11:39am | report spam | close Reply |
Insecure? what?

The OS is safe. If you think you're under attack you should probably be seeing a therapist. Until apple breaks 25% marketshare we'll never see truly harmful viruses -- not trojans that need your admin password to do harm.

rahrens
Fresh-Faced Recruit

Joined: Aug 2006

0

12/21, 03:26pm | report spam | close Reply |
re: what?

ibug4,

What you are postulating is security through obscurity, which has been proven to be wrong.

There have been vulnerabilities exposed in the past that have had the potential for true disaster if not plugged. The recent security update, for instance. It is also proof that Apple can, and does, respond very fast when it sees a credible threat - code submitted Dec 5, and update issued two weeks later!

This guy's threats need to be taken seriously, whatever his motivations may be. I personally think he's out for more publicity, maybe even material for a book, but that doesn't mean he doesn't have some security holes to publicize.

I'm taking a 'wait and see' approach to this. I'll be watching Apple as much as the other guy.

gskibum3
Fresh-Faced Recruit

Joined: Nov 2006

0

12/28, 02:08pm | report spam | close Reply |
To Our Token Flame Fanner

Testudio, exactly how many Macs have successfully been compromised in the real world? Now estimate how many Windows systems have been compromised. Rounding the latter to the nearest million will suffice.

Show More Comments

Login Here

toggle

Network Headlines

02/15	Sony completes Ericsson stake buyout...
02/15	Apple upgrades iBookstore with screenshots...
02/15	Congress asks Apple to answer questions...
02/15	FLA head describes Foxconn plants as...
02/15	Apple asks to sue bankrupt Kodak in...

Show All

02/15	Sony completes Ericsson stake buyout...
02/15	Congress asks Apple to answer questions...
02/15	FLA head describes Foxconn plants as...
02/15	Apple asks to sue bankrupt Kodak in...
02/15	Apple voluntarily pulls iPads from...

Show All

02/15	Apple upgrades iBookstore with screenshots...
02/15	Congress asks Apple to answer questions...
02/14	Apple attempting to disrupt Siri hacks...
02/14	Readability iOS app delayed, Android...
02/13	Apple launches 2012 back-to-school...

Show All

02/15	Monster iCarPlay Wireless FM Transmitter...
02/14	Refurb. 16GB iPhone 4, now only $259...
02/13	Refurb. Flip UltraHD Pocket Digital...
02/10	$380 off refurbished 2.8GHz Mac Pro...
02/09	iHome Dual Alarm Clock for Apple iPod...

Show All

toggle

'Month of Apple Bugs' to begin January 1st

updated 10:50 am EST, Wed December 20, 2006

'Month of Apple Bugs'

Related Articles

Recent Articles

That's nice...

How destructive...

Hmm..

maybe..

this still...

Interested ON?

lame

Yawn

One comment

Bulletproof?

Ha!

Accountable?

re: ha!

Check This Link

Comments

More...

wrong

Hmmmm

all show, no go.

let's see his "bugs"

Well, just perhaps�

wow, testudo

The facts

Bug up his....

OSX...

Re: well,

This man

Insecure? what?

re: what?

To Our Token Flame Fanner

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace