1. Attachments are working again! Check out this thread for more details and to report any other bugs.

Apple = Crapple

Discussion in 'Fred's House of Pancakes' started by boulder_bum, Sep 15, 2007.

Page 2 of 2
  1. eagle33199

    eagle33199 Platinum Member

    Joined:
    Mar 2, 2006
    5,122
    268
    0
    Location:
    Minnesota
    Vehicle:
    2015 Prius v wagon
    Model:
    Two
    <div class='quotetop'>QUOTE(Boulder Bum @ Sep 17 2007, 02:13 AM) [snapback]513573[/snapback]</div>
    Have you called Apple and informed them of the problem? I write software too (and trust me, mine has to be a lot more perfect than yours... a failure rate of 0.001% kills people), and every piece of software has bugs in it. Give them a chance to correct the problem...

    Guess what - a camera with a memory stick in it is a device with software/firmware that can propagate viruses. a USB drive has firmware (and in some cases software) on it, and it can propagate viruses. It's not the responsibility of the device to ensure it's protected - it's the responsibility of the user. Computers aren't immune to viruses, and after the 30 day trial expires you have to go buy some software if you want continued protection. Giving ANY device the ability to act as an external hard drive or memory stick for a computer exposes it to viruses and places the device under the protection of the OS and whatever anti-virus software is installed on the computer.

    Is that really the case, though? Seems to me that if that was, then we wouldn't have so many viruses and so many millions of PC's on the botnets. I'll admit thats the general idea behind the security policies, but there are holes and ways around all that. For that, i would say every piece of software and hardware on your computer is flawed. Every single piece of it can be used to propagate and distribute viruses.

    I'll agree that the virus should have been detected before the iPods hit the shelf. however, there's no possible way to give the end user the desired look and feel of a hard drive while providing the type of security you seem to expect from a consumer device.
     
    #21 eagle33199, Sep 17, 2007
  2. vtie

    vtie New Member

    Joined:
    Apr 11, 2006
    436
    1
    0
    Location:
    Gent, Belgium
    Vehicle:
    2006 Prius
    <div class='quotetop'>QUOTE(FourOhFour @ Sep 17 2007, 02:09 PM) [snapback]513611[/snapback]</div>
    Personally, I don't make that distinction. Apple sells the product, they are responsible for it. They chose their manufacturers, determine the production process and the quality control. As a customer, I don't need and don't want to know these details.

    Of course, Apple may blame it internally on one of their subcontractors, and transfer any damage claims if any. But that doesn't change my relation as a customer towards them.
     
    #22 vtie, Sep 17, 2007
  3. boulder_bum

    boulder_bum Senior Member

    Joined:
    Mar 11, 2007
    1,371
    38
    0
    Location:
    Castle Rock, CO
    Vehicle:
    2007 Prius
    <div class='quotetop'>QUOTE(eagle33199 @ Sep 17 2007, 07:51 AM) [snapback]513648[/snapback]</div>
    I am, though they haven't gotten back to me after I sent in a support ticket. :angry:

    <div class='quotetop'>QUOTE(eagle33199 @ Sep 17 2007, 07:51 AM) [snapback]513648[/snapback]</div>
    I strongly disagree . You should never rely on the user to uphold the security of a system, you should prevent the user from having the ability to break anything. "It's a training issue" is an excuse for sloppy design.

    From IBM security principles whitepaper:


    <div class='quotetop'>QUOTE(eagle33199 @ Sep 17 2007, 07:51 AM) [snapback]513648[/snapback]</div>
    The problem is not that software can't be secured, it's that most programmers don't code securely. Hardly anyone uses AppDomains and security zones, for example, even when they might be applicable, and I can't count the number of times I've seen "senior" software engineers using concatinated ad-hoc SQL with no regards for things like injection vulnerabilities.

    I'd agree that software quality is lacking nowadays, however (you should hear me rail on the problems with SharePoint).

    <div class='quotetop'>QUOTE(vtie @ Sep 17 2007, 08:00 AM) [snapback]513653[/snapback]</div>
    I concur. It's like Fisher Price with it's lead-based paint on toys. The correct thing to do is not to point fingers at the manufacturers a parent company hired, but to make the parent company own the mistake and work for the prevention of any future mistakes.
     
    #23 boulder_bum, Sep 17, 2007
  4. eagle33199

    eagle33199 Platinum Member

    Joined:
    Mar 2, 2006
    5,122
    268
    0
    Location:
    Minnesota
    Vehicle:
    2015 Prius v wagon
    Model:
    Two
    Yes, software can be secured... but that often comes at the price of opening up the system to potential problems. Ultimate security (in todays age): Unplug from the internet. However, people aren't willing to do that. So you plug in. Lets say you've got a good firewall, and configure it to only allow access to certain ports. you're still vulnerable on those ports - at least more so than you were. And i would challenge you to find ANY piece of software that can't be tricked if someone tried hard enough.

    The simple fact is that any device that is connected to your computer is going to rely on you (or the software you have on your system) to keep it secure. If you want your iPod to act like a hard drive, then it HAS to be open to writing to it - that means that you can open a document and save it there straight from Word, Adobe, whatever. There simply is NO user-acceptable way to get around that.

    You have to realize that, despite what us programmers may want to do, the systems are designed for the end user. you have to give the user what they want in the way they want it, and sometimes that means leaving some of your security in the hands of others. Otherwise your system will be so locked down it would take someone with our skill levels to do so much as create a text document.
     
    #24 eagle33199, Sep 17, 2007
  5. hyo silver

    hyo silver Awaaaaay

    Joined:
    Mar 2, 2005
    15,232
    1,562
    0
    Location:
    off into the sunset
    Vehicle:
    2004 Prius
    Model:
    N/A
    <div class='quotetop'>QUOTE(eagle33199 @ 2007 09 17 14:32) [snapback]513906[/snapback]</div>
    Done. One PC with all the client's data, no internet. For everything else, there's Apple. Still not perfect, I know, but the risk is minimal in comparison.
     
    #25 hyo silver, Sep 17, 2007
  6. boulder_bum

    boulder_bum Senior Member

    Joined:
    Mar 11, 2007
    1,371
    38
    0
    Location:
    Castle Rock, CO
    Vehicle:
    2007 Prius
    <div class='quotetop'>QUOTE(eagle33199 @ Sep 17 2007, 03:32 PM) [snapback]513906[/snapback]</div>
    Well, I think you're presenting a bit of a false dilemma. It isn't correct to say that software needs to be insecure or it will be completely unusable. I think you'll agreee there is a balance, and it's this balance that "the principle of least privilage" addresses. A system should allow just enough functionality to perform its purpose, but no more.

    Case in point, one of Microsoft's biggest source of security problems is that they sometimes try to pack too much power into their products. ActiveX controls, for example, gave web applications carte blanche to wreck havoc on a user's computer, where web applications should have had far fewer privilages. The result is a myriad of exploits and viruses launched by ActiveX controls that many users loaded onto their system without knowing what they were doing.

    That's why IE now has about four prompts and warnings before the user downloads a control.

    In contrast, Java's web client technology tried to "sandbox" itself to limit the potential damage caused by web-based Applets (though people still found vulnerabilities).

    In the case of the virus the Apple hardware spread, the players purpose was to store, play, and transfer content by synching to another computer. Ideally, it will be designed in a way to enable this capability, but not to, say, propegate a virus when you plug the device into the computer.

    How? Well, for the sake of argument let's say that the virus propegates itself by using loading an autorun.inf file to a drive so that merely plugging it in runs a program that copies the virus to a host. For an iPod, adding or changing that file may affect the operation of the device, so reasonable countermeasures should be in place to prevent such an exploit if the product was designed with security in mind.

    Likewise, perhaps it's reasonable to suggest that the copying of data to and from the iPod should be relegated only to approved processes/users like iTunes running under an authenticated user's credentials. In that case, there are ways to protect the file system to ensure such integrity.

    The actual approach and implementation depends on the goals and requirements for the system, but the point is that responsible design can address the security without any unwelcome imposition or inconvenience for the user.
     
    #26 boulder_bum, Sep 17, 2007
  7. eagle33199

    eagle33199 Platinum Member

    Joined:
    Mar 2, 2006
    5,122
    268
    0
    Location:
    Minnesota
    Vehicle:
    2015 Prius v wagon
    Model:
    Two
    <div class='quotetop'>QUOTE(Boulder Bum @ Sep 17 2007, 06:49 PM) [snapback]513984[/snapback]</div>
    As you said, there's a balance... but by definition such a balance means you're trading off some security for the sake of the user experience. You can't have a usable system if it prompts you to verify every single write access to the hard drive. Even if you have a number of "trusted" programs, who's to say someone can't design a virus that starts off by either simulating one of those processes, or infiltrates one that's already running, using that same trusted process to do its dirty work.

    Yes, IE (and other things M$) are bloated, buggy, insecure pieces of doo-doo. And as you said, they used proper practices for things like Java, and yet people still can find vulnerabilities. Any piece of software that has an input and an output is going to be vulnerable to something, by definition.

    So, like i said before... how do you relegate that access when one of the "features" of an iPod is to act as a portable hard drive? By definition a hard drive has to allow programs to write to it. It has to let you save directly to it from Word or Excel or Matlab or any of a million other programs. How do you regulate that ability? As it was in this case, the virus in question was RavMonE.exe, which does not effect things like autorun.inf. When activated, it saves itself to the local drives and adds a run command to the registry. Other than that, it's just a file. a nasty one, but just a file that's saved to the hard drive. How do you prevent that without imposing a series of inconvenient steps to the user that marketing would never approve?

    One of the requirements of the system is that it be as transparent to the user as possible and act just like another hard drive hooked up to the system. There's no way to secure that from this type of attack.
     
    #27 eagle33199, Sep 18, 2007
  8. scargi01

    scargi01 Active Member

    Joined:
    Mar 20, 2007
    784
    57
    0
    Location:
    Missouri
    Vehicle:
    2005 Prius
    <div class='quotetop'>QUOTE(eagle33199 @ Sep 17 2007, 04:32 PM) [snapback]513906[/snapback]</div>

    And that would be called "job security" :D
     
    #28 scargi01, Sep 18, 2007
  9. boulder_bum

    boulder_bum Senior Member

    Joined:
    Mar 11, 2007
    1,371
    38
    0
    Location:
    Castle Rock, CO
    Vehicle:
    2007 Prius
    <div class='quotetop'>QUOTE(eagle33199 @ Sep 18 2007, 07:55 AM) [snapback]514240[/snapback]</div>
    Agreed, but I think it's a false dilemma to claim that iPods need to be able to carry viruses or they'll be completely unusable.

    <div class='quotetop'>QUOTE(eagle33199 @ Sep 18 2007, 07:55 AM) [snapback]514240[/snapback]</div>
    In security circles, you'll find that no one claims they're completely eliminating the possibility for attack, the goal is to simply raise the bar as much as possible. Encryption, for example, can be broken if someone gets ahold of the keys, but that doesn't mean you give up on encryption because of that danger. You simply make the data difficult to compromise with encryption and then you make the keys hard to get to.

    <div class='quotetop'>QUOTE(eagle33199 @ Sep 18 2007, 07:55 AM) [snapback]514240[/snapback]</div>
    The difference is that Sun and Microsoft acknowledge their flaws and work to fix them. Apple passed the buck for their vulnerability.

    <div class='quotetop'>QUOTE(eagle33199 @ Sep 18 2007, 07:55 AM) [snapback]514240[/snapback]</div>
    The first thing I'd do is question the decision to use the iPod as a hard drive, since the vast majority of users simply use the iPod to play music, and keep a portable hard drive or thumb drive handy for storage. The hard drive feature increases the "attack surface" and is at the core of both the security vulnerability and some early compatibility problems with Vista.

    If you still wanted the hard drive feature, however, there are steps that can be taken. Turn "enable disk usage" off by default. Default to deny execute permission on the appropriate directories so no code automatically runs and thus propegates itself without user interaction and/or reconfiguration. Use a proprietary secure file system instead of the aging FAT 32, require password protection on the storage part of the drive (which is a good idea anyway), etc.

    Also, just as important would be to secure the computers at the factory to prevent this from happening in the first place. The manufacturers' computers should have had the ability to copy over the firmware and nothing else.

    The way Apple would go about their implementation can, and probably would differ from the suggestions above, but it's absolutely false to say there's no way to make iPods more secure and no way this sort of thing couldn't have been prevented.

    I wonder if Apple blames Microsoft for this sort of breach, too: <_<
    http://www.cnn.com/2004/TECH/internet/04/09/apple.trojan/
    http://www.theregister.co.uk/2006/05/09/mc..._security_risk/

    I also liked this:
     
    #29 boulder_bum, Sep 24, 2007
  10. desertbriez

    desertbriez New Member

    Joined:
    May 20, 2007
    376
    2
    0
    <div class='quotetop'>QUOTE(hyo silver @ Sep 16 2007, 08:20 AM) [snapback]513305[/snapback]</div>
    AMEN! hubby HAD to have a new laptop... that, of course, came with vista.... now he's finding out some of his stuff doesn't want to play with vista! UGH!
     
    #30 desertbriez, Sep 25, 2007
(You must log in or sign up to post here.)
Page 2 of 2