Discussion on:

Message 15 of 1
0 Votes
+ -
RE: Theoretical attacks exploit iOS browser flaw
richardw66 Updated - 6th Aug 2010
@dheady@...

I hate to tell you this but Apple has some security holes. It's just that Windows security holes get found and exploited and systems get infected in their millions, and botnets grow, and Chinese students steal government secrets.

Apple security holes get found in competitions of the world's top hacking experts, and then they get plugged.

Or in this case get found by co-operative teams of hackers who hack for the user's benefit, and who publish their efforts and the holes get plugged.

So - OK this is not scientific proof of the invincibility of iOS/OS X exactly.

And it certainly is not a claim of Apple OS security perfection.

But you'd have to be pretty darn stupid to buy a Windows PC if you were not an expert at keeping out viruses - and not only by running a few anti-virus packages, but it also comes in real handy to be able to kill off a few infections on your own when the anti-virus software does not know of the new virus that just got released, at least not yet, maybe when it has already spread.

On Apple product - not so much, 3 infections in 26 years across all Macs I know of, is a little better than 18 at once on just one PC that was theoretically protected. Not to mention the other PCs I know of that are beyond anything but a reformat.

you can select another viewer until Apple patches it up.

Yes you can - and for that matter this is then not an OS vulnerability - it technically is an App vulnerability, if that matters.

On iOS though you can't easily change apps for reading PDF.

And it is not long since Adobe Reader was patched for an almost identical vulnerability, so Adobe Reader users should have had to switch to Preview to avoid the problem.

This of course does not make it OK - but it does put the whole thing in perspective.

Hackers find holes and exploit them. Holes exist. Hopefully security experts and/or benign hackers (jailbreak teams in this case) find the holes first and bring them to the attention of the developers so that they get patched.

Yet again it is not the existence of security holes that defines the security completely - all systems have holes, no matter how much work goes into protecting them. It is much more complex than that.

There is a way to break into anything - it just depends on the knowledge of the person trying to break in, and how much effort they are prepared to apply to the attempt.

What matters is what weaknesses actually get exploited and how much damage is done in the process.

It's a constant race to catch bugs before they get exploited. It is not about being 100% secure at day 1 - that is just not going to happen.

And at the moment if this is a race Apple is winning against MS - and millions of people are paying for backing the loser.
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

ie8 fix