Security pro: Windows easier to 0wn

TalkBack 26 of 73:

Next »

« Previous

• Thread View
• Flat View

Re: Thanks

I'm sorry to say you still misunderstand the table. Companies like Immunity aren't auditing agencies that monitor for and count infected systems in the wild. Immunity does not go out and look for compromised systems.

Immunity is measuring how long it takes (in their case, an expert) to hack into a system correctly installed and configured according to the manufacturer's specifications.

The precise details of the vulnerability the hacker (who is a member of Immunity's staff) exploited to gain control at the root level of the system in question is the 0day.

Typically, these studies are done with more than one staff member attempting the hacks. The average time is the average of all of their times to a successful hack. This is standard in the computer security industry.

Immunity didn't find 3 infected Macs, they didn't look for infected Macs. They looked for exploitable vulnerabilities in OS X and found 3 which took on average an hour to discover.

What typically happens, then, is that they notify the software manufacturer about the vulnerabilities they found and provide the details of how it works.

In your Mac example, Immunty would alert Apple that they need to fix the three newly identified problems. In addition, Immunity would also be required to alert certain regulatory agencies about the newly identified vulnerabilities. Apple would then fix the problem, ensure that Mac users get the fix, and alert the regulatory agencies that the problem has been dealt with. Finally, the regulatory agencies publish the details of the exploitable vulnerability.

When this works correctly, there is no system that actually gets infected. The whole procedure is intended to prevent that from happening.

Regulatory agencies do put time limits on how long a software manufacturer has to close the potential exploit, and they will publish the details before an exploit is taken care of, if the software manufacturer takes too long to adequately respond to the alert.

I don't remember the precise number of Mac exploits (i.e., individual viruses, worms and trojans) that have actually made it into the wild (i.e., infected user systems), but I do know that it is more than 5 viruses but less than 50. I have never looked at the data on how many Mac systems were found to be compromised by each of the viruses. All OSes have many, many more identified vulnerabilities than have actually been exploited.

The differences in number of infected systems that you note (e.g., MSBlast vs the OS X exploit) has to do with whether the software manufacturer relies on "white hats" (i.e., companies like Immunity who try to prevent the exploit from ever reaching the wild) or if the company relies on "black hats" (i.e., virus writers) to alert it to vulnerabilities.

The various *nix programs (like OS X and Linux) rely heavily on white hats, and as a consequence solve the problems before they affect actual systems. MS is notorious for not acting until there is an actual exploit in the wild (i.e., a black hat has struck).

Posted by: dhk   Posted on: 08/16/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now