A couple of days ago, on Geek News Central, I read an article. On it, whichever member of the team was writing it was bemoaning the fact that in Hawaii, he only had one choice for broadband internet, and the speed wasn’t up to snuff.
A quote:
Ever wonder why we are falling so far behind in broadband penetration and connectivity speed as compared to many other countries today? It’s because there is no competition. For example I have only 1 choice of broadband carrier here in Hawaii where I live. The speed of that connection has not improved in eight years! In fact my connectivity at my home is worse today then it was eight years ago. It is obvious that the monopolies of Cable companies and Telephone Carriers, and their lack of innovation will continue to cause us to fall further behind.
Well, no. Lack of competition is not the issue. Unless you live in god-knows-where, you usually have two choices for broadband at a minimum: your local telco and your local cable company. In my area, that pretty much sums it up. In my neighborhood, Cablevision has been the clear leader in speed for so long that it never would even cross my mind to use Verizon DSL. It’s not even close. On Verizon, we get 768 down and 128 up. On cable I get 15 megs down and 1-2 up. Granted, cable costs me $15 a month more than Verizon would, but I’d say it’s worth it, wouldn’t you?
But the point of bringing this up is to point out a simple reality. Competition has nothing to do with Cablevision’s speed.
Why do I say that?
Well, frankly, they’re competing on neither. They’re more expensive than Verizon, and they’re infinitely faster. FiOS isn’t in my neighborhood yet, and Optimum Boost (30-50 megs down, 5 up) isn’t either. Cablevision has not had to compete with Verizon for broadband superiority, and yet they still own it. No competition there, either.
Competition is not the automatic answer, and that argument is just flat out silly. Does it help? Sure. But not having competition has no effect on service directly, at least in my small insignificant corner of the woods. I do know people that are out in the boonies and can barely get a DSL signal; most of them use dialup. Unfortunately, if you’re out in the middle of nowhere, you may not have a whole lot of choices. People who live out there understand that.
Back to Geek News Central.
I saw a post earlier today on Privacy Digest. In it was a detailed account of how a conference speaker at HOPE managed to derive a sniffer that could essentially determine your WiFi card’s model, driver version, and the OS it was running on. Here’s some of the relevant stuff:
The video shows Ellch and Maynor targeting a specific security flaw in the Macbook’s wireless “device driver,” the software that allows the internal wireless card to communicate with the underlying OS X operating system. While those device driver flaws are particular to the Macbook — and presently not publicly disclosed — Maynor said the two have found at least two similar flaws in device drivers for wireless cards either designed for or embedded in machines running the Windows OS. Still, the presenters said they ultimately decided to run the demo against a Mac due to what Maynor called the “Mac user base aura of smugness on security.”
[...]
One of the dangers of this type of attack is that a machine running a vulnerable wireless device driver could be subverted just by being turned on. The wireless devices in most laptops — and indeed the Macbook targeted in this example — are by default constantly broadcasting their presence to any network within range, and most are configured to automatically connect to any available wireless network.
But according to Maynor and Ellch, this attack can be carried out whether or not a vulnerable targeted laptop connects with a local wireless network. It is, they said, enough for a vulnerable machine to have its wireless card active for such an attack to be successful. That’s a trivial demand, given that most wireless devices embedded in laptops these days are switched on by default and are configured to continuously seek out available wireless networks.
Because the software that powers these wireless devices operates at such a fundamentally low level of the operating system, traditional system safeguards like firewalls and anti-virus software most likely will not stop the operating system from accepting a maliciously crafted network probe from an attacker seeking to exploit device driver-specific flaws. The result, said Maynor, is that a system using poorly designed device drivers is vulnerable to compromise just by doing what it was programmed to do.
But that explanation eclipses the larger point that Maynor and Ellch said they are trying to get across: Namely, that wireless device drivers are largely developed and written by an odd mix of hardware and software developers in an environment where time-to-market often trumps any thorough code review for potential security flaws.
Apple — like many computer manufacturers — outsources the development of its wireless device drivers to third parties. In Apple’s case, the developer in question is Atheros, a company that devises drivers for a number of different wireless cards, each designed with drivers specific to the operating systems on which they will be used.
Maynor and Ellch also found two different device driver flaws for wireless products aimed at Windows systems.
Now that we’ve caught up on the particulars, let’s read the post from Geek News Central:
One thing sadly that Windows PC users are aware of is this; “expect your machine to be hacked”, thus Windows based PC users may be better equipped with virus and firewall protection to fend of a exploit attack than Mac users are for one simple fact.
That 99% of the community thinks that there computers can never be penetrated thus the majority of Max users have no virus or firewall protection. Well hate to say it but welcome to the real world.
Do people have the ability to read in the real world?
Apparently not.
The article that Geek News cited specifically said that a firewall would not have protected against this type of attack because the device driver that runs the card runs on a lower system level than the stupid firewall itself. It really is that simple. Somehow, GNC manages to completely miss that in their rant against the smug Mac community. They also manage to miss that the bug would also affect the more “well-trained” Windows users who are trained to be protected.
The point? It ain’t the OS, it’s drivers, and all the software protection you install can’t protect you if the driver is bad.
What annoys me most about GNC’s post is the tone, and they take that tone consistently on the Mac, and they’re not alone. One glitch comes out and BOOM. Open the floodgates. Here come the attacks. Macs are insecure. We knew it all along. I call Bravo Sierra with a caveat.
No operating system is inherently completely secure in the year 2006. Any argument to the contrary is laughable. I do however have to make a few quick points here because they seem to be repeated themes.
Most Mac users are aware of security issues that surround their operating system and are quite dilligent about getting patches installed as soon as Apple releases them (usually one batch of patches every few months). Unlike the Windows idiots who, to this day, are still getting infected with a major flaw that was fixed 8 months ago, Mac users aren’t a liability to others on the internet. The MacOS is inherently more secure. Period. End of discussion. It’s not perfect, but any attempt to equate it to Windows is laughable and anyone who claims such and claims to be a geek is what is commonly known as a poseur.
Secondly, software is software, and drivers are software. Drivers, however, are not a reflection on the OS, seeing as most drivers are written by third parties for their specific hardware. Calling a flaw in an OS indicative of anything when the flaw is in a driver is just flat-out assinine.
Finally, Windows patches come out quite regularly. Usually, they involve buffer overflows or scripts that are allowed to act outside of their interpreters which are both major security holes. All the firewalls, antivirus programs, and anti-spyware apps under the sun will do nothing to protect a user in that situation; a well-schooled Windows user is just as likely to be exploited as anyone else because the flaws are usually on an operating system level. Despite the fact that OSX just had a 26 patch update, I’d be willing to bet that’s significantly less patches than I’ve received for my Windows system since the last OSX patch cycle.
Any site claiming to be a Geek News site needs to have these basic concepts in hand before they comment on them. In two articles, it would appear that the “geek cred” of Geek News just isn’t very believable.
Basic mistakes tend to do that.
UPDATE: Interesting tidbit on the WiFi story from ABCNews this morning:
Maynor said he and Ellch were not identifying the makers or models of wireless devices that are vulnerable, so that manufacturers have a leg up on criminals who might exploit the vulnerabilities.
Maynor said the MacBook used in the demonstration was not using the wireless gear that shipped with the computer.
I don’t know about other Mac users, but the included hardware is all I actually use. Oh well. This is still a problem, but it’s one that probably won’t affect 99.99999% of Mac users at this particular time.
(via InsanelyMac)
[tags]geek news central, goof, oops, misinformation[/tags]