A hackers perspective - Windows much more secure than Mac

A very interesting ZDNet article explaining why Browser security is really determined by the underlying OS...

http://blogs.zdnet.com/security/?p=2941

Excerpt:

"It’s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don’t do. Hacking into Macs is so much easier. You don’t have to jump through hoops and deal with all the anti-exploit mitigations you’d find in Windows.

It’s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn’t have anti-exploit stuff built into it."

Wow, that is a very interesting article.  I will be sure to keep this in my back pocket when a Mac junkie talks about how the Macs are so much more secure than Windows. 

It has long been my experience that Macs suffer less hacking and security violations because, frankly, the hackers don't waste their time with them.

One of the major objectives for a hacker is the thrill. Combine that with the fact that most members of the delinqent persuasion are stereotypically lazy, and it starts to make sense that a hacker is going to focus on the biggest target in order to obtain the biggest bang for the buck. That equates to targeting a windows operating system rather than a Mac OS.

When you change a hacker's focus from one of entertainment to that of financial gain, where do you suppose the largest percentage of financial information is stored? Does the hacker write a script for a PC or a Mac?

Finally, if you put yourself in the shoes of an up-and-coming hacker, what OS target would support the biggest library of tools and resources for your hacking education? Windows or Mac?

Again, in my opinion, the Mac OS is not necessarilly more secure, but rather an unattractive target.

I know that if I were a hacker, I would certainly try to target a larger audience.  Our area is comprised mostly of Windows users.  There are no places that repair or sell Macs.  The few Mac users are quick to point out how great it is to not have to protect their systems from hackers and viruses.  I keep telling them that someday, they will eat their words.   

I think the point is that today's hackers predominantly target the surfing habits of people, and exploit computers and people through the interface of the web browser (rather than the OS), meaning Mac users are more exposed to threats if they use Facebook and other places where these exploits propagate - Unfortunately the concept of operating system "security by obscurity" (Mac's not being a target by virtue of being less popular) no longer applies... nowadays it's the person behind the computer who is targeted; not the computer itself - and if it's a Mac running Firefox, it's more open to these exploits than Windows running Firefox.

Don 

Let's not lose sight of the fact that Microsoft products, when improperly configured (as they usually come out of the box) are horrible with security.

However, the biggest contributor to hackers is the bad computing habits of the planet.

shipley.c:

Let's not lose sight of the fact that Microsoft products, when improperly configured (as they usually come out of the box) are horrible with security

True - But in fairness they are nowadays much better than they were in the pre XP SP3 days, and remain leaps and bounds ahead of Macintosh (as discussed above, Mac just don't seem to factor base OS securities as something people would want ??)

I prefer linux to either one.

donc:

True - But in fairness they are nowadays much better than they were in the pre XP SP3 days, and remain leaps and bounds ahead of Macintosh (as discussed above, Mac just don't seem to factor base OS securities as something people would want ??)

I disagree with some of this.  Mac has plenty of security in it - its just different than Windows security.  All the hacker proves is that when vulnerabilities and bugs in browsers are found ,they are easier to exploit.  He doesn't go into the rest of the security model and where Macs might be tougher to gain control of.

Yes, Windows is better than it has been, but in my opinion better isn't good enough.  Hello Conficker/Downadup.  11 million infections and counting.

shipley.c:

I disagree with some of this.  Mac has plenty of security in it - its just different than Windows security.  All the hacker proves is that when vulnerabilities and bugs in browsers are found ,they are easier to exploit.

Sorry Chris - It was in fact a  fully patched MacBook running Apple’s own native Safari browser (not any third-party browser).

To quote: “It took a couple of seconds. They clicked on the link and I took control of the machine,” Miller said moments after his accomplishment [ full article ]. I know some people are passionate about certain brands of computers but this one is pretty tough to ignore...

Yes - I hear you.  It also happens with Windows machines.  I'm not overly passionate about Mac, I don't even have one.  I'm just saying the article doesn't look at all of the security features of a Mac.  Its just looking at browser vulnerabilities - which is the most common attack vector today.  He didn't talk about trying to hack through anything else.  I'm just saying there's more than one way to skin a cat, and it appears the Mac is more vulnerable with browsers.

This security argument is like arguing which of of the two men is "stronger".

One guy can do 1000 push ups. The other guy is a Shaolin monk who can pull a truck with his xxxxxxx.  [inappropriate body part removed by admin]

There are way too many factors to involved to make this an easy call.

One of the biggest XP flaws by design was that everything ran with administrator priviledges. MS patching that "feature" up in Vista went a long ways.

Linux rocks. I would rate OS X a close second.