Leopard security analysis

In spite of Apple's efforts, Mac OS X Leopard is not fundamentally better for security than Tiger, several security experts suggest. Thomas Ptacek of Matasano Security writes that Leopard's new security features, though an improvement, still leave unnecessary gaps open. Library Randomization is meant to solve problems such as buffer overflow attacks, by preventing hackers from knowing where to place a code in memory; the equivalent of this in Windows Vista is Address Space Load Randomization. Ptacek complains, however, that Apple has not randomized as many OS components as it should have, and specifically the Dynamic Link Library.

Leopard also implements a concept called "sandboxing," which restricts what functions can be performed from certain areas even if a computer is hacked. Ptacek notes that Apple has not applied sandboxes to the most vulnerable programs in the OS, such as web browsers, mail clients or instant messaging apps. Another security specialist, Dino Dai Zovi, points to Leopard's Quick Look preview feature, which could be used launch malicious software, but is only quarantined against network access. "Increasingly these days IM, email and web surfing are where most of the attacks are coming from, not directly on your network," says Zovi.

Independent consultant Rich Mogull criticizes Leopard's firewall implementation, saying that it is not what it should have been. Controlling access to individual services is "very complicated and very hard to get the right settings," according to Mogull. Moreover, upon installing Leopard, he found that his firewall had been disabled despite its presence being a default setting.

Ptacek observes that it is good Leopard has extra security before the Mac OS becomes a target of major worms or viruses, but he believes there is still much left to accomplish. "I like the direction they're headed," he comments, "I'm just saying that they've got a long way to go to catch up with Microsoft."

by MacNN Staff