Mar 31

Apple’s Security Patch Process Gets Worse While Microsoft’s Gets Better

Welcome to www.mintywhite.com! If you're new here, you should subscribe to the RSS feed.

Take a tour of www.Mintywhite.com | Follow me on Twitter @mintywhite

Thanks for visiting!

Swiss researchers suggest that the revived popularity of Apple’s products may have left the company unable to keep up with security risks.

Apple has been getting worse at dealing with security vulnerabilities while Microsoft (NSDQ: MSFT) has been getting better, according to a research paper published by Swiss security researchers.

In “0-Day Patch Exposing Vendors (In)security Performance,” presented last week at the Black Hat conference in Amsterdam, Stefan Frei, Bernhard Tellenbach, and Bernhard Plattner of the Computer Engineering and Networks Laboratory at the Swiss Federal Institute of Technology analyzed Apple’s and Microsoft’s security practices over the past six years and found that Microsoft has been getting better at responding to security issues while Apple has been getting worse.

During the period studied, between 2002 and 2007, Microsoft had 658 high- and medium-risk vulnerabilities, compared with 738 for Apple, the paper says.

The revived popularity of Apple’s products, the researchers suggest, may have left Apple unable to keep up. “Comparing the number of unpatched vulnerabilities per vendor for the period since January 2002 we observe a striking difference between Microsoft and Apple,” the report says. “On average, Microsoft succeeds to keep the average number of unpatched vulnerabilities below 20 at a steady number. On the opposite, Apple seems unable to stabilize the number of unpatched vulnerabilities in recent years. We observe a steady increase in recent years for Apple. It seams [sic] that Apple’s security processes and resources cannot cope with the side-effects of the increased popularity of their products.”

Indeed, some Apple partisans have suggested that the successful hacking of a MacBook Air in the “PWN to OWN” contest at the CanSecWest security conference in Vancouver, British Columbia, last week was a deliberate attempt by security researchers to win Apple’s sleek subnotebook for themselves and a rejection of the Sony Vaio and Fujitsu U810 computers that winning contestants could also have walked away with.

It should be noted that the researchers are analyzing Apple’s patch process rather than the overall security of its products. The fact that antivirus software is still optional on Macs and all but necessary on Windows PCs demonstrates where the risk of malware is actually present.

Macs continue to benefit from security through obscurity, but that advantage is eroding as Mac market share continues to rise. Mac users may not welcome this, but computer security vendors surely will.

Source