ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Apple snags ex-OLPC security chief

By | May 13, 2009, 10:33am PDT

Summary: Former director of security architecture at One Laptop per Child (OLPC) Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system. Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week [...]

Former director of security architecture at One Laptop per Child (OLPC) Ivan Krstic has joined Apple to help thwart hacker attacks against the Mac operating system.

Krstic, a well-respected innovator who designed the Bitfrost security specification for the OLPC initiative, joined Cupertino this week and will work on core OS security.  His hiring comes at a crucial time for a company that ties security to its marketing campaigns despite public knowledge that it’s rather trivial to launch exploits against the Mac.

[SEE: Inside the $100 laptop's security spec ]

Krstic sees the OLPC’s Bitfrost system as a foolproof way to defeat malware attacks so it’s a safe bet he’ll be working with Apple engineers on some form of sand-boxing of applications:

Instead of blocking specific viruses, the system (Bitfrost) sequesters every program on the computer in a separate virtual operating system, preventing any program from damaging the computer, stealing files, or spying on the user. Viruses are left isolated and impotent, unable to execute their code. “This defeats the entire purpose of writing a virus,” says Krstic.

I’ve written in detail in the past about Apple’s security-by-PR campaigns and the danger of assuming Macs are secure because hackers aren’t targeting the operating system so it comes as pleasant news that the company appears serious about hiring top talent in the security world.

[ SEE: Apple bumper patch vindicates MOAB, MOKB hackers ]

Krstic is a no-BS software engineer who has done quality work in the past and his presence at Apple will only help.

Here’s a talk that outlines Krstic’s thinking around computer security.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
36
Comments

Join the conversation!

Just In

RE: Apple snags Ex-OLPC security chief
FAULKNE 13th Oct
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.
0 Votes
+ -
I am looking forward to the cheaper, lower
power, secure, ARM based Android-Sugar laptops
to be released at $75 each, and to see how that
will trigger a new revolution in the tech
industry effectively eliminating the monopolies
of the 20th century PC/Laptop giants of Apple,
Microsoft and Intel.
0 Votes
+ -
Don't hold your breathe
Marcos El Malo 14th May 2009
You say you are looking forward. How far forward?
0 Votes
+ -
This is a pretty cool post,thanks replica watches
0 Votes
+ -
A Users Perspective
Harry Bardal 13th May 2009
Apple has been criticized for promoting a system that is
more secure than PCs. I'm not sure this is what they've
done. The message has always been the same one that
appears in the latest round of ads. The
message is? "with Apple, there far fewer consequences".
Perhaps it's a crime of omission to leave out the reasons
for this. The reasons have always been a more complex
mix of monoculture issue, technical issues, market share
issue, and simple malice. Those who would count
vulnerabilities, or make this a purely technical issue, will
continue to have too narrow a focus. Clearly malware has
become as much a sociological issue as a technical one.
Clearly users count consequences and not threats. Is this
complacency? Is it good sense? Everyone has an opinion.

This new approach to malware holds a lot of promise. Its
the shift in thinking away from the walled city approach
that should have been outside of consideration since Troy.
The larger PC economy has benefit from the gold rush
though. Lots of careers and businesses are
derived from open architecture's complexities and failings.
The security industry as a whole has to be accountable to
users. At any given time, the malware dance has felt like a
protection racket. If this new idea can be deployed, and
work on OSX, it's a bit of a coup.

As it stands, the pwn to own contest results, or the
number of Mac vulnerabilities have not added up to
meaningful consequences. It's not a brag, it's just a fact.
Could they? Sure, but that may not be the point.
It would take 10 years of stagnant security, a reversal in
market share, and boatloads of malicious intent for the
Mac record of consequences to come close to that of the
PC. This has become a branding issue. Apple's made sure
of it. It's caused some resentment. Apple doesn't owe IT a
living.

Ironically, a move away from monoculture means that
irrespective of any new security improvements, the effect
of malware is blunted and dissipated. Add these new
initiatives like bitfrost, the future looks brighter still.

Users are tired of threats. Vendors who deliver results will
win. If bitfost works for Apple, it will "pardon" Apple's
crime of omission and will freeze the platform's record of
consequences at a miniscule level relative to the PC. Users
won't care how it was done. Users will pay for
this via an "Apple tax" beacause they know they've always
paid for it. Security is worth paying for, everyone agrees.
The question becomes the cost.

OLPC innovations, and the initial impulse towards goodwill
will be validated and rewarded. Many times in it's history,
Apple has been technology's telethon. Whether one uses
their gear or not, we all benefit from a mechanism that
channels cash from the coffers of adult consumers, into
progressive thinking.

0 Votes
+ -
No need for his work at Apple.....
OhTheHumanity 13th May 2009
As I have realized from people on this site, there is no need for a security guru like this because he will be nothing more than a body to fill a seat at the company. Apple OSX is secure by design and cannot, and I repeat cannot be attacked in anyway other than social engineering.

Makes you wonder why they would go out of their way to hire this guy for something they obviously do not need. Thats a weird move Apple? I hope they can explain it to all of us.
0 Votes
+ -
As Harry mentions everyone benefits from Apple's crazy ideas...even if
you hate Apple and never use any of their products, you will benefit by
what they do. No one else seems to be willing to step outside the lines
an do something different which leaves the competition scrambling to
catch on and catch up.

Right now the security issue is a quagmire and has nowhere else to
go. It's going to take something other than continually building new
barriers. The idea of security needs to evolve and it is Apple that
willing to get that started.

This is not a weird move and if you get Apple at all you would
understand that it is a patented Apple move.

Apple doesn't want to be the biggest computer company in the world.
It doesn't want to create the richest man in the world. Apple just
wants to be the best at what it does. This may be understating it.
Better, Apple wants to make people happy.
0 Votes
+ -
Apple just invented chroot!!
NonZealot Updated - 13th May 2009
As Harry mentions everyone benefits from Apple's crazy ideas

Wow, Apple just invented chroot! Oh, and BufferZone (trustware.com). But of course, this doesn't come as a surprise to any of us. We've witnessed Apple get credit for inventing lots of things that we've been using for 5 years now.

Apple just wants to be the best at what it does.

And Apple is the best at what it does: branding stuff that has been around for years, jacking up the price, and selling it to kool-aid drinkers just like you! Nobody does that better than Apple! happy
0 Votes
+ -
How about 10 years? See this :
Soulstorm Updated - 14th May 2009
http://www.silentpcreview.com/news935.html

They are now trying to patent something people on that site (which is number one in this field (i.e. silent/dead-silent computers) have been doing for the last 10 years. Patetic.
At least that way maybe they will learn how to make a silent Mac Pro and get rid of the stupid hardmounting for the hard drives (the Mac Pro is actually silent when it comes to fans (they spin at around 500-800 rpm) but the harddrives are hardmounted to the case and make noise.
0 Votes
+ -
Better Mouse Trap
CowLauncher 14th May 2009
Haven't you heard of this concept Einstein? Why do care anyway, you are
not a Mac user.

As for Kool-Aid (asinine term by the way..it's up there with the term
fanboy which also seems to be used by the same types as you) I have
probably been using multiple platforms professionally for longer than
you have been able to use the potty. So I think I have earned the right to
draw valid conclusions based on real experience. What vast experience
do you have to draw on to support your wiseass claptrap?

0 Votes
+ -
@NonZealot
Axsimulate 15th May 2009
"And Apple is the best at what it does: branding stuff that has been around for years, jacking up the price, and selling it to kool-aid drinkers just like you! Nobody does that better than Apple!"

Yep, your right, nobody does it better than Apple, at least until you include Microsoft in the equation, then Apple loses that top spot to Microsoft. How's that MS kool-aid taste NZ?
0 Votes
+ -
Hilariousness
derekcurrie 15th May 2009
NonZealot, you've got to stop being a non-thinker if you're going to
reply around here. Too many intelligent people hang out at ZDNet to
accept boring old mythology FUD as fact. We're more likely to laugh at
such rubbish than to buy, swallow and gag on it. :-P
0 Votes
+ -
WHERE DOES IT SAY THAT?
SimonUK2 18th May 2009
Literacy level low, or just plain stupid?
0 Votes
+ -
Well, except...
zepedebo2 13th May 2009
the fact that you can brick an intel mac (I mean you have to replace the "logic board" aka mother board to fix it) by typing a single line at a shell prompt with administrator rights. But that's not really a security problem. Is it?
A) I'm curious as to the method. Just interested.

B) Why would someone with Admin permissions brick their Mac?

C) Any Mac admin that allowed someone to discover or change the
admin password gets what they deserve. Password protect the firmware
and nobody but the source admin get in.

D) How come Windows still requires BIOS firmware? Antiquated much?!
0 Votes
+ -
FUD?!?!
SimonUK2 18th May 2009
WHAT?!? You are new to computers, aren't you. Man, you shills are
getting worse.
0 Votes
+ -
You don't understand security, do you?
The Mad Hatter 13th May 2009

Oh, I admit that if you can trick a person into using Safari, and clicking on a link, you can take over a Mac. That however is the only way you can do it.

Windows on the other hand has so many holes, that can be attacked in so many ways, it's incredible. Even Vista, which Microsoft put a lot of work into, has had problems. Windows was never designed to be secure. OSX was. This is a huge difference.

And Apple is moving forward to making OSX even more secure, which is great. What's Microsoft doing? They are putting lipstick on Vista, and calling it Windows 7.

Microsoft's attitude seems to be: "Security? What me worry?"
0 Votes
+ -
What was that again?
OhTheHumanity 13th May 2009
Get off your emotional fact ride and go check the stats for Vista and Server 2008 compared to OSX. Vista is a different beast so realize that. I use and manage many Vista systems and have no issues. Microsoft does very well with security so understand that as well. You want the stats I will provide......

Most Vulnerable Operating Systems
X-Force tracks vulnerabilities by platform and has produced metrics this year to show the operating systems with the most disclosed vulnerabilities. The following chart shows the operating systems with the most vulnerabilities documented in 2008. The top ten operating systems account for nearly 75% of all vulnerability disclosures affecting operating systems.

Operating System Percentage
Apple Mac OS X Server 14.3%
Apple Mac OS X 14.3%
Linux Kernel 10.9%
Sun Solaris 7.3%
Microsoft Windows XP 5.5%
Microsoft Windows 2003 Server 5.2%
Microsoft Windows Vista 5.1%
Microsoft Windows 2000 4.8%
Microsoft Windows 2008 4.1%
IBM AIX 3.7%
Others 24.9%

0 Votes
+ -
Ignorance is Bliss in Windows World
derekcurrie 15th May 2009
The percentage chart you provided shows one thing: What operating
systems are most scrutinized for security flaws.

That puts Microsoft Windows in the basement as one of the least
scrutinized.

Meanwhile, let's examine what operating systems have had the fewest
number of successful security attacks. They are, in order:

OpenBSD
FreeBSD
Mac OS X

This is no coincidence since both OpenBSD and FreeBSD are integrated
into Mac OS X.

How many active malware are there for Mac OS X at this moment?
Eleven. All of them are Trojan horses. All of them require user error in
order for them to be installed, aka Social Engineering. There are no
viruses for Mac OS X, no worms, no illegal spyware/adware. There is
no 'security by obscurity' for Mac OS X. There is instead fundamental
security. There is also no such thing as perfect security, including for
Mac OS X. But there is such a thing as poor security and Windows is it.
How many active malware are there for Windows? I lost count after
200,000.

Vista was an improvement. Vista SP3, aka Windows 7, is likely to be a
further improvement. I sincerely hope so. About bloody time.
0 Votes
+ -
http://news.zdnet.co.uk/security/0,1000000189,39648558,00.htm

Microsoft has failed to remove a long-recognised Windows Explorer security risk from Windows 7, according to security company F-Secure.

The 'hide extensions' feature, which was present in Windows NT, 2000, XP and Vista, is included in the Windows 7 release candidate, F-Secure's chief research officer, Mikko Hypp?nen, said. The feature could allow virus writers to trick users into opening and running malicious files, he added.

"In Windows NT, 2000, XP and Vista, Explorer used to Hide extensions for known file types," Hypp?nen wrote in a blog post on Tuesday. "And virus writers used this 'feature' to make people mistake executables for stuff such as document files."

For example, malicious code writers could name a 'virus.exe' file as 'virus.txt.exe' or 'virus.jpg.exe', he said. Windows Explorer would then hide the .exe part of the filename, meaning that the user would only see 'virus.txt' or 'virus.jpg'. Additionally, virus writers would change the icon displayed with the file in Windows Explorer so it looked like the icon of a text file or an image. Users might then click on the disguised file.

The blog post appeared on the same day that Microsoft had been scheduled to make the Windows 7 RC1 available for download to the public, although the OS release did in fact arrive early. Microsoft made its Windows 7 release candidate available to MSDN and TechNet subscribers on 30 April.

Microsoft had not responded to a request for comment at the time of writing.
0 Votes
+ -
Maybe this links with getting Hypervisor Type I (or II)?Windows on Mac needs it
0 Votes
+ -
RE: Apple snags Ex-OLPC security chief
DannyO_0x98 13th May 2009
Gee whiz when the trolls fall for a troll post, I guess it's a
wake up call that ZDNet needs better trolls.

Mr. Naraine, a quibble about the use of the word trivial. It
may be easier than Windows Vista SP2 and security guys at
the 90th percentile may have no problems, after they've
spent a few hours working out a possibility, but I don't
think that quite constitutes trivial. Not today.

Just a heads up, apparently the some of the vulnerabilities
that Microsoft fixed in Office on Tuesday exist in Office for
Mac and Works for Windows, but no patches yet. Some
have said that by revealing this, Microsoft has gone against
its responsible disclosure policy, but in mitigation,
Microsoft thinks that the reverse engineering of the patch
is unlikely to result in exploits in the wild for those other
platforms, so there's time to patch. Incompetence? Malice?
Something Else?

In the meantime we congratulate Apple on its talented new
employee in a field where we'd like to see improvements.
0 Votes
+ -
Then why.....
OhTheHumanity 14th May 2009
Aren't you calling out Apple for sitting on a patch fix? I mean lets be fair here. They wait till they have a bundle and then send them out.
0 Votes
+ -
I Wouldn't Have Considered It A Propos
DannyO_0x98 Updated - 14th May 2009
I suppose based on the things I post here that you see, it would be
easy to think I'm one of those folks who apply double standards with
Apple (and Linux) always good, Microsoft always bad. Truly, I do try to
be as fair as possible. I want everyone to play nice and to take
responsibility and fix things as quick as possible. I also accept that,
unlike the FOSS world, we will not get get unscheduled updates from
Microsoft and Apple, except at crisis situations.

Still, while I see things like openSSL get a patch on my Linux systems
and not on my Macs, I do get nervous and basically wish that security
patches for included third party code was pushed out faster by Apple.

However, and I think I have made this point before, as long as
"security" is a marketing point or counter-point, the proprietary
companies will play games with disclosures and patches.

Any way, 24 hours later, it is clear that ZDNet did not pick up the
story (I saw it at The Register) and so my prediction that it would be
today's topic was incorrect. I thought that the interesting part wasn't
that Microsoft was sitting on a patch - the article says there are no
patches yet - but that they disclosed these vulnerabilities of Office for
Mac and Works without giving the vendor, themselves in this case,
time to respond, in seeming contravention of the "responsible
disclosure" policy they wish third parties would apply to them. I lean
towards an opinion on this particular topic, but I can be convinced
differently.

Finally, I apologize for current and past failures to make call outs
regarding HP's policy with regard to patch releases for HP/UX.



0 Votes
+ -
ASAP Patches Are The Way To Go
derekcurrie 15th May 2009
"Aren't you calling out Apple for sitting on a patch fix?"

I TOTALLY agree with this point. This month Apple pulled a Microsoft
move with a massive set of security updates on the second-Tuesday-
of-the-month. I am hoping this is merely coincidence. However, I
strongly suspect it is to make IT folks happy. Sadly it is BAD security
protocol.

In the Windows world, the hackers gear up for THE DAY and jump on
all the security vulnerabilities like rats, pumping out malware to take
advantage of all the newly discovered flaws. They know very well that
only a small percentage of computer users update on THE DAY.

Thanks to this ridiculous THE DAY practice, security vulnerabilities
potentially sit around for WEEKS, ripe for the hacking. Instead, the
proper practice is ASAP security patching. It gives hackers no reliable
time schedule and cleans up discovered security problems
immediately. Steve Gibson over at GRC.com has been pointing this out
for years.

ASAP doesn't solve the lazy user updating problem. The Conficker
worm proved that. But it's obviously the better security protocol.
0 Votes
+ -
Hmm
honeymonster Updated - 17th May 2009
as I understand it proof-of-concept code is
available for these vulns.

In other words, no would-be attacker need to
reverse Microsoft patches and figure out
exploit code for themselves when they could
just just the PoC code as a road map.

So it wouldn't matter whether Microsoft patched
the Windows version now or later. The patches
reveal no information not already known to
would-be attackers.

You can fault Microsoft for not patching OSX
sooner. But given that nobody really seems to
target OSX anyway (at least at this time) the
decision to prioritize the Windows versions
seems prudent.

Also, to put this into perspective, many
of the vulnerabilities patched in the latest
Apple monster patch was patched months
ago in Linux and BSD distros. Any would-be
attacker could have used that publicly
available source code diffs along with the
disclosed CVEs to (easily) figure out how to
exploit those vulns. That didn't seem to worry
Apple nor the OSX community. Double standards?
0 Votes
+ -
"it?s rather trivial to launch exploits"
derekcurrie 15th May 2009
"it?s rather trivial to launch exploits" against Mac OS X ...
Which of course is why there are only Trojan horses for
Mac OS X. Right? There are no viruses, worms or illegal
spyware/adware for Mac OS X.

What is actually 'trivial' is tossing FUD at the public in lieu
of doing research and providing factual information. I call
it 'journalism-by-FUD'.

The ongoing anti-Mac security FUD campaign, despite its
deliberate ignorance, has actually been good for Mac OS X
and Apple. There's nothing like a cattle prod to get a
sleeping cow moving again, and Apple was formally asleep
regarding Mac OS X security. Clearly the sky never fell. The
onslaught of Mac malware never happened. But Apple has
responded in recent years with an exponential increase in
attention to security flaws. Tossing in BitFrost app security
is clearly an excellent next step.

So bring on the FUD! It has done nothing but make Mac OS
X even more secure.
0 Votes
+ -
RE: Apple snags Ex-OLPC security chief
birumut Updated - 2nd May 2011
Well done! Thank you very much for professional templates and community edition
seslisohbet seslichat
0 Votes
+ -
I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate! nccma cooler
0 Votes
+ -
I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post. this thread is amazing i like your work and i appreciate you that you have share a useful stuff thanks for sharing the i shop abatwa
0 Votes
+ -
I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post.Bookmarking now thanks please consider a follow up post. power sa shop
0 Votes
+ -
I think the representation of this article is actually superb one. This is my first visit to your site. Thanks a lot and keep sharing the information. Keep updating the information for all of us. Thanks ZDNet Government was launched as the brand's first industry vertical, with a mission to cater to IT professionals in the public secto I agree with your post. However, do you have any sources I can cite for my paper wheel car com bury
0 Votes
+ -
Well welcome, hopefully you can become a vital member of the community and really help to push far ahead of google. Which Im sure the development team would love. This will of course earn you alot points too and get you on the leaders board. z d n e t t h a n k Im not sure i come to an agreement with you on every level, howevor it absolutely was a good posting, many thanks for taking the time to put up your ideas.
0 Votes
+ -
Thanks nice info z d n e t I really liked your current article write more..let me add you to its favorite The articles you have on zdnet s i t e are always so enjoyable to read. Good work and I bookmarked it.
0 Votes
+ -
Fantastic news about the new release.I positively enjoying each little bit of it and I have you b o o k m a r k e d to check out new stuff you weblog post.Im not sure i come to an agreement with you on every level, howevor it absolutely was a good posting, many thanks for taking the time to put up your ideas
0 Votes
+ -
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix