SANS notes sharp increase in Mac OS X flaws

01.05.2006
Just because you use a Macintosh, don't think you're any more secure than a Wintel user.

A sharp increase in the number of flaws being discovered in Mac OS X suggests that the Apple Computer Inc. operating system may soon be every bit as prone to malicious attacks as Windows systems, according to a report from the SANS Institute, a Bethesda, Md.-based security training and research firm.

Mac OS X still remains safer than Windows because its relatively small installed base is a less attractive target for malicious hackers than Windows systems. But the number of flaws being discovered in the operating system is leaving its reputation as a secure alternative to Windows "in tatters," according to the semiannual update to the SANS Top 20 list of Internet vulnerabilities.

"Users often feel invincible when they have their shiny silver-colored Apple and they are surfing the Web with it," said Ed Skodis, a director at SANS. That may be a mistake, he said, because "there's a significant amount of research going on for security vulnerabilities in the Mac OS."

About 52 vulnerabilities were discovered in Mac OS X in 2005; 17 have been uncovered so far this year, said Amol Sarwate, manager of the vulnerability management lab at Qualys Inc., a Redwood Shores, Calif.-based security service provider.

The number of vulnerabilities reported last year was more than twice the number from 2004, when 24 flaws were discovered, Sarwate said. Out the flaws uncovered last year and so far in 2006, at least a third were considered critical, Sarwate said. During the past few months, users of Apple's Safari Web browser also faced their first zero-day attack, which is an attack targeted at unpatched vulnerabilities.