Re: Penetration Testing on Mac OS X

Hi Michael

Mac OS X has the same vulnerabilities as other operating systems, but
that should not come as a big surprise. Unlike those on Windows,
vulnerabilities on Mac are still not widely exploited and exploit
codes less often published. That might change with time, especially since the
amount of vulnerabilities seems to increase.

Based on own experiences, I would recommend to prepare some simple
demos to demonstrate weaknesses in Mac OS X. For example, the firewall
is not turned on and that can easily be used to install a backdoor,
e.g. a VNC server. Grab a copy of an older version of Mac OS, then
google for some iTunes/QuickTime exploits. The metasploit framework
also contains a few exploits. If they complain about the old version
of the test system, tell them to break into a current version of Win
XP... We published a "Hacking Mac OS X - case study" movie on milw0rm. It
might help you too.

You can also argue with the countermeasures available by comparing
them with Win XP, Vista or Linux. Apple has quite some room for
improvement there.



------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: [inbox] Re: [Full-Disclosure] CyberInsecurity: The cost of Monopoly
    ... The US government would have you believe that people exploit vulnerabilities ... rebut the fact that most Windows operating systems are insecure. ... > we need Netware exploits? ...
    (Full-Disclosure)
  • Re: Another "Overlooked" Mac Article Take III
    ... "Similar vulnerabilities have also been found in corresponding ... due to Apple's recent advertising on Mac OS X's security." ... of security than Windows**, would create a greater impact than ... compromise is a compromise no matter the circumstances (this is why I ...
    (comp.sys.mac.advocacy)
  • Re: Another "Overlooked" Mac Article Take III
    ... "Similar vulnerabilities have also been found in corresponding Windows ... wireless drivers but the two are demoing the vulnerability on the Mac ... compromise is a compromise no matter the circumstances (this is why I ...
    (comp.sys.mac.advocacy)
  • Re: Another "Overlooked" Mac Article Take III
    ... "Similar vulnerabilities have also been found in corresponding ... wireless drivers but the two are demoing the vulnerability on the Mac ... of security than Windows**, would create a greater impact than another ... compromise is a compromise no matter the circumstances (this is why I ...
    (comp.sys.mac.advocacy)
  • Re: The RACS method to bring down the government in one move
    ... but I have been told that the Mac architecture is ... Apple Mac OS X Multiple Vulnerabilities ... this overflow and execute arbitrary code with the privileges of the ATS ...
    (rec.arts.comics.strips)