Better Mac OS X Security Numbers

Some things just aren't credible on their face, so when George Ou mined Secunia's security advisories for vulnerability data to prove that Mac OS X is less secure than Windows/XP, I had an immediate problem. According to his research Secunia's security advisories since January 2004 cover about 238 serious Mac OS X vulnerabilities and only 95 Windows/XP ones, and a 2.5:1 ratio favoring Windows didn't seem reasonable.

Now, in fact, Secunia doesn't issue vulnerability reports, they issue security advisories - 37 of them with respect to Mac OS X and 151 with respect to Windows/XP (Home and Professional only), during the period.

Since those numbers show a 4:1 ratio in Apple's favor - the opposite of what George found - I'm guessing he got his result by looked inside each advisory to count the CVEs it mentioned. In doing that he would have fallen into a simple trap: Apple's policy, and therefore Secunia's, is to mention all the software affected by a vulnerability while Microsoft's is to mention only the product the vulnerability is in. Thus, for example, advisory 16449 lists 40 CVEs for one actual Mac OS vulnerability in a piece of commonly called code while advisory 16210 lists only one CVE, but affects every Windows OS and integrated product released since ME.

Count the CVEs and this works out as about 40:1 against Apple, count actual vulnerabilities and it's closer to 23:1 against Microsoft - and that, of course, is a big part of how 37:151 advisories in Apple's favor got turned into 238:95 vulnerabilities in Microsoft's favor.

Unfortunately that's not the worst problem with the analysis. The biggest problem is that he invites the reader to draw a wholly erroneous conclusion from his numbers: that Mac OS is less secure than Windows/XP.

The reality is that a vulnerability without an exploit doesn't threaten anyone's security. What we need to count to decide which OS is more secure, is actual exploits, not the potential for them. For an attack to be realized the attacker has to go through two phases:

 

1. find a software or other vulnerability

    

2. conceptualise, build, and deliver a working attack.

In the x86 world that second step is pretty easy, and indeed many vulnerabilities have given rise to multiple exploits - but that hasn't been true of MacOS. Metasploit, for example lists only five PPC payloads for MacOS X remote attacks -and that's since its introduction.

There have been other exploits for MacOS X, but they've mostly been typical Unix exploits: meaning that you need a legal login to get started and the exploit is aimed at raising your permission levels. That's traditional for an attacker in a multi-user environment, but absurd for a MacOS X desktop machine for which the only legal user has full control already.

In Wintel's case virtually every vulnerability is exploitable; that's why there are thousands of successful attacks and why we see a daily parade of new viruses, worms, or other threats. Now it may be that George is being prescient here because step two gets a lot easier with Apple's move to x86 - so next year's numbers may be very different- but to this point the simple reality is that almost no MacOS X users have ever been affected by viruses or worms - while virtually every Windows/XP user wastes at least some time on this every day.