Safety in numbers
Retraction (4/25): As Paul Glover points out in the commentary, there’s good reason to think this list isn’t accurate. (I’m not saying it isn’t; I’m saying it very well may not be.) Stupid me for not researching it further. My apologies.
I’ve always assumed, thanks to the media (among others), that Windows was a much more vulnerable operating system than Unix-based ones (e.g., Mac OS X, Linux flavors, etc.). Of course, I argued that it’s fairly simple to protect your system; there’s plenty of good and free anti-virus and anti-Trojan and anti-whatever software.
But that was still the conventional wisdom. After all, Windows users have become familiar with Microsoft’s never-ending updates and patches.
Funny thing. It turns out that perception and reality are two different things.
According to the good folks at US-CERT, the U.S. Computer Emergency Readiness Team (the people on the front lines of protecting systems from hackers, crackers, data thieves, and so on), in 2005:
There were 5198 reported vulnerabilities: 812 Windows operating system vulnerabilities; 2328 Unix/Linux operating vulnerabilities; and 2058 Multiple operating system vulnerabilities.
The deuce you say. Why, yes — there were more than two and a half times as many vulnerabilities in Unix-varient systems than in Windows. You can read the list yourself.
Not surprisingly, the list of Windows vulnerabilities stemming from Microsoft products is long. But perhaps this snippet from the Unix list will surprise you:
# Apple Mac OS X AppleFileServer Remote Denial of Service
# Apple Mac OS X ‘at’ Utility Information Disclosure
# Apple Mac OS X ‘at’ Utility Information Disclosure (Updated)
# Apple Mac OS X Default Pseudo-Terminal Permission
# Apple Mac OS X Finder ‘DS_Store’ Insecure File Creation
# Apple Mac OS X Font Book Font Collection Buffer Overflow
# Apple Mac OS X Java Update
# Apple Mac OS X Kernel searchfs() Buffer Overflow
# Apple Mac OS X Multiple Arbitrary Code Execution Vulnerabilities
# Apple Mac OS X Multiple Vulnerabilities
# Apple Mac OS X Multiple Vulnerabilities
# Apple Mac OS X Multiple Vulnerabilities
# Apple Mac OS X Multiple Vulnerabilities
# Apple Mac OS X Multiple Vulnerabilities (Updated)
# Apple Mac OS X Multiple Vulnerabilities (Updated)
# Apple Mac OS X NetInfo Setup Tool Buffer Overflow
# Apple Mac OS X NetInfo Setup Tool Buffer Overflow (Updated)
# Apple Mac OS X ‘parse_machfile()’ Denial of Service
# Apple Mac OS X Perl Privilege Dropping
# Apple Mac OS X Security Update
# Apple Mac OS X Security Update
# Apple Mac OS X Security Update
# Apple Mac OS X Vulnerabilities
# Apple MacOS X Vulnerabilities
# Apple Mail EMail Message ID Header Information Disclosure
# Apple QuickTime Quartz Composer File Information Disclosure
# Apple QuickTime Quartz Composer File Information Disclosure (Updated)
# Apple Safari Data URI Memory Corruption
# Apple Safari Dialog Box Origin Spoofing
# Apple Safari IDN Implementation URL Spoof
# Apple Safari IDN Implementation URL Spoof (Updated)
# Apple Safari Input Validation
# Apple Safari Input Validation (Updated)
# Apple Safari Open Windows Injection (Updated)
# Apple Safari Web Browser HTTPS Denial of Service
# Apple Safari Web Browser JavaScript Remote Denial of Service
Translation: Don’t believe everything you hear.
--billm-- says:
Give it up already! You are not going to convince anyone that OS X is more vunerable than Windows. Why dont you do a comparison of the Windows and Apple problems and then publish your list.
Obviously, Microsoft is paying you far too much. If they arent, then you obviously have something against Apple.
I still challenge you to use an OS X based Mac for 1 year. Then we shall see what you think. Of course, I doubt you would accept the challenge. (If you choose to, let me know. You know where to find me.)