Mac versus Windows vulnerability stats for 2007
Summary: The year 2007 has been an interesting year that brought us improved security with Windows Vista and Mac OS X Leopard (10.5).
The year 2007 has been an interesting year that brought us improved security with Windows Vista and Mac OS X Leopard (10.5). But to get some perspective of how many publicly known holes found in these two operating systems, I've compiled all the security flaws in Mac OS X and Windows XP and Vista and placed them side by side. This is significant because it shows a trend that can give us a good estimate for how many flaws we can expect to find in the coming months. The more monthly flaws there are in the historical trend, the more likely it is that someone will find a hole to exploit in the future. For example back in April of this year, hackers took over a fully patched Macbook and won $10,000 plus the Macbook they hacked.
I used vulnerability statistics from an impartial third party vendor Secunia and I broke them down by Windows XP flaws, Vista flaws, and Mac OS X flaws. Since Secunia doesn't offer individual numbers for Mac OS X 10.5 and 10.4, I merged the XP and Vista vulnerabilities so that we can compare Vista + XP flaws to Mac OS X. In case you're wondering how 19 plus 12 could equal 23, this is because there are many overlapping flaws that is shared between XP and Vista so those don't get counted twice just as I don't count something that affects Mac OS X 10.4 and 10.5 twice.
| Windows XP, Vista, and Mac OS X vulnerability stats for 2007 | ||||
| XP | Vista | XP + Vista | Mac OS X | |
| Total extremely critical | 3 | 1 | 4 | 0 |
| Total highly critical | 19 | 12 | 23 | 234 |
| Total moderately critical | 2 | 1 | 3 | 2 |
| Total less critical | 3 | 1 | 4 | 7 |
| Total flaws | 34 | 20 | 44 | 243 |
| Average flaws per month | 2.83 | 1.67 | 3.67 | 20.25 |
So this shows that Apple had more than 5 times the number of flaws per month than Windows XP and Vista in 2007, and most of these flaws are serious. Clearly this goes against conventional wisdom because the numbers show just the opposite and it isn't even close.
Also noteworthy is that while Windows Vista shows fewer flaws than Windows XP and has more mitigating factors against exploitation, the addition of Windows Defender and Sidebar added 4 highly critical flaws to Vista that weren't present in Windows XP. Sidebar accounted for three of those additional vulnerabilities and it's something I am glad I don't use. The lone Defender critical vulnerability that was supposed to defend Windows Vista was ironically the first critical vulnerability for Windows Vista.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
I'm sure...
1. Microsoft simply isn't reporting and fixing its flaws, since Windows obviously must have more flaws than OS X.
2. Microsoft is fixing flaws "stealthily" and not reporting them.
3. You're a Microsoft shill and hate Apple.
Or some combination of the above.
Carl Rapson
why does windows OS "have to" have more vulnorabilities than a mac?
this is FUD who cares about vulenrabilities what of exploits?
Your suggestion is useful but flawed
However, it says nothing about the security of that OS. Apple can have 10x the attack vectors and it still won't trump an attack on XP/Vista, because has roughly 15x as many users.
The guys attacking PCs are playing the same game that the telemarketing scam artists played 20 years ago: numbers numbers numbers.
And if you can write a single attack that could potentially hit 90% of the worlds PCs or you could write one that could potentially hit no more than 6%, it's pretty obvious where you'll put your criminal resources.
The reality is that Apple is just now getting to the point where it's worth it to some security researches to find holes in OSX.
My gut tells me that it's probably not much better nor much worse than Windows, but we won't really know until the OS X has at least 10-20% penetration.
They are comming
really...
of knowledge here in the IT world. Nice try, your not fooling anyone that's not already
a fool. it must be a sad sight in the mirror every morning [putting your IT face on
instead of your tights].
-sincerely
os x leopard and vista user
This is an attempt at Tu Quoque
LOL! yes:
Mac OS X is quite simply put, superior.
Based on what?
It's strange how a year ago Mac fan boys always went by the metric of how many patches Windows had each month. Now that OSX has 10x as many, the metric has changed.
If you like your Mac, then good for you. I don't think security alone is a good reason to switch from Windows to Mac or Mac to Windows.
The reality is if you practice safe computing, you're unlikely to get attacked, regardless of the platform.
The other reality is that most people practice unsafe computing.
you're right ....
what that means [and never will]. why should they have set of rules for safe
computing. there is already a perfectly good solution. if you've ever used os x you
would know there is no need to worry about surfing whatever part of the web you
want. it just the web, not some gauntlet of spyware and viruses. to be honest you
have to be quite naive to believe this isn't a biased story. all the mac haters [i use
both] talk about this 'point' in the 'near future' when all macs will become a huge
target to hackers. sounds kinda like wishful thinking to me. do really think the
unix/linux foundation is new ??? or that it's only used in macs??? if 'hackers'
wanted to attack that foundation [successfully, repeatedly] why wouldn't it have
been done by now. what os do you think travelocity.com, yahoo.com. or
newegg.com run on?? Microsoft Windows Server or Red Hat Linux Enterprise.
There is ONLY one reason unix/linux has been chosen to run some of the biggest
sites on the web [maybe even this one]. REAL WORLD SECURITY. so keep trying to
convince yourself windows is more secure, because no one else is convinced. deal
with it.
///
Tu Quoque is a logical, argumental fallacy
another from criticism by turning the critique back against the accuser. This is a
classic Red Herring since whether the accuser is guilty of the same, or a similar,
wrong is irrelevant to the truth of the original charge. However, as a diversionary
tactic, Tu Quoque can be very effective, since the accuser is put on the defensive, and
frequently feels compelled to defend against the accusation."
MS Windows' security still sucks i.o.w.
Rubbish...
Wait a minute
anything as stupid as that.
That sort of strawman argument is just plainly idiotic on its face.
What has been said repeatedly and accurately is that there are NO exploits in the
wild.
Where folks span the spectrum is determining WHY there are none. Security thru
obscurity? Better security model? Reason X?
And whatever the reason, there are NO exploits in the wild for Mac OS X.
Vulnerabilities do NOT equal exploits.
Vulnerabilities do equal
Hackers are not 15 year olds playing games, they are terrorists or criminals. If you know your code can hit 95% of every computer in the world by using mailing lists readily available on the internet, why would you write one that might hit 2 or 3% of machines, and then have little chance of spreading significantly? How hard is that to understand. <br>
A remote exploit has been released for the Mac when there have been those with the time on their hands and any desire to do so. That is just history. Tells me nobody writes code to attack macs as is already obvious.
And this all tells the world...
Miscreants all over the world are in the business of hacking servers. They do not exclude based on "market share." From Mainframes on down to "Vista Ultimate" they are all active targets.
But far be it for me to do too much to disturb your ignorance. Feel free to live in it, and enjoy it.
That was an attempt at Misdirection
Sorry, no. The author is trying to say that Apple is worse because they have many more serious security vulnerabilities in their software.
Fairly convincingly.
Percentage of users
Win XP SP3
Frothing Zealot
If one isn't a naive user, there's no need to have anti-virus installed. I have never used an anti-virus and never got hit by a virus. I did get hit by a SQL Server vulnerability once (caused no damage), but that isn't something a virus scanner would have prevented.
You need to get your keyboard looked at - something's wrong with your Shift+S.
Some truth in that....