MacOSX DeepSight Report

Quando Steve Jobs dice che sta per rilasciare Vista 2.0, mi fa morire dal ridere.
Questo documento e' semplicemente spassoso.

Alcuni paragrafi presi dalla sezione "OSX security technologies and preventive measures":

Rigurardo il canary: Since OS X is a BSD-based operating system, ProPolice functionality should be accessible to Apple and will hopefully be enabled by default in OS X applications at some point. (Implementato in XP SP2 per tutte le librerie di sistema)

Riguardo ASLR: Currently, like most releases of Windows, OS X contains no memory randomization and also distributes precompiled binaries. This poses a significant risk where worms are concerned, since a single exploit could work across multiple systems and possibly operating system releases. (ASLR e' stato implementanto in Windows Vista)

Riguardo il flag NX dei nuovi processori: So far, it would appear that OS X implements this non-executable memory feature only within stack memory. At the time of writing, the researcher KF has already demonstrated that this feature can be trivially circumvented. (NX e' stato implementato in XP SP2)

L'articolo conclude con:

• Critical vulnerabilities are being discovered on a regular basis.
• Exploits for these flaws are being actively developed and released to the public.
• Post-compromise tools are being researched and released.
• Self-propagating malicious code is being created for the platform, although it is still in its infancy.

Praticamente se il MacOs non e' un focolaio di virus e worms, e' solamente perche' non se lo caga nessuno.

Morale della favola: caro Steve, magari invece di lavorare a MacOsVista2.0, non sarebbe il caso di cominciare da MacOsXp1.0?

Evvai con il flaming!