June 01, 2009, 10:17 AM — Last week, security researcher Landon Fuller posted attack code for a Java vulnerability in Apple's Mac OS X that hackers can use. "Due to the fact that an exploit for this issue is available in the wild, and the vulnerability has been public knowledge for six months, I have decided to release my own proof of concept," Fuller wrote on his blog.
A security update for Mac OS released two weeks earlier didn't include a patch. Apple now says it is aware of the issue and working on a fix. Security vendor SecureMac advises people to disable Java in their browsers until Apple fixes the problem.
[ Learn the details of the Java security hole in Mac OS X. | Apple's delay in fixing the problem prompted one hacker into action. ]
It's this kind of nonchalant attitude toward serious security problems that analysts like Jon Oltsik, Mac security analyst at the Enterprise Strategy Group, say is making them a bit irritated. He advises Apple to change its ways before it's too late.
Apple has until now gotten away with a lackluster response to security largely because Mac OS X (and Safari browser) flew under the radar of many hackers, he says. But as the platform rises in popularity, says Oltsik, hackers will soon take dead aim if they haven't already.
Oltisk talked with CIO.com about the impact of this security hole, as well as the potential fallout from what he calls Apple's cavalier approach to fixing such problems.
How serious is this Java vulnerability?
Oltsik: The vulnerability could be used to run a rogue executable, so it is very dangerous. It certainly simplifies the process of writing a malicious Mac exploit. I haven't yet seen malicious code "in the wild" that takes advantage of this vulnerability, but one could pop up anytime.
How can enterprises protect themselves?
Oltsik: Most enterprise Macs are protected with security software that could be updated with a signature or re-configured to block an exploit. Large organizations should be somewhat protected. Consumers and small businesses are more at risk.
What do you think about the actions of Landon Fuller?
Oltsik: I always equate security professionals with physicians in that they live by their own version of the Hippocratic oath. If a physician is on the scene of an accident, he or she feels a sense of duty to help. Likewise, a security professional feels the need to speak out about vulnerabilities and risks. When researchers are ignored, they often feel like their only recourse is to go public. Some people question these tactics, feeling that this could encourage attacks, but I don't share this opinion.
What's the fallout from Apple's slow response to security threats?
Oltsik: All software has vulnerabilities including Mac OS X. What is surprising is Apple's somewhat cavalier attitude toward fixing the problem. I can't say why Apple did not address this vulnerability sooner. I will say that I find Apple's behavior toward security curious to say the least. Apple publicly takes shots at Windows security, yet its security practices seem a bit ad hoc.
I've long believed that Mac OS X will soon suffer the type of exploits that Windows has seen, and Apple will find itself eating a big piece of humble pie. Mac OS was never an attractive target in the past. It is now.
How concerned are you about Apple's security measures? Send me an email at tkaneshige@cio.com. Or follow me on Twitter @kaneshige. Follow everything from CIO.com on Twitter @CIOonline.
