Feeds

Apple patch fiasco invites trouble

It's just a matter of time...

Top three mobile application threats

According to the Apple website, Security Update 2005-007 was released to the public on August 12, 2005. And, as with all of their recent security updates, it is available to all Apple customers free of charge. I'm sure none of you reading this article will argue with me about that being a good thing.

For those of you that remember, Apple included some security patches in their release of Mac OS X Panther in 2003. These security patches were originally exclusive to Panther, and users of Mac OS X Jaguar were unable to obtain these updates without paying for an upgrade to the newer version. Whether this was done intentionally or not is still a mystery, as updates were released for Jaguar after various discussions in the media and within the security industry caused enough backlash to force a change.

What's interesting here is that Apple has chosen to release updates for both the most and second-most current release of their operating system since this initial incident in 2003. As an example, this most recent Security Update contains updates for Tiger (10.4.x), as well as Panther (10.3.x). This is a good thing, and shows that the Apple product security team is making changes and evolving to fit the needs of their customers.

However, Apple still has a long way to go. The time that it takes Apple to release patches for some publicly disclosed vulnerabilities in open source components of their operating systems is nothing less than abysmal, and it's only a matter of time before continued evolution of their security practices can be preemptive, and not reactionary.

We'll release when we're ready

On the Apple Product Security web page, the following is written with regard to Apple's policy on security notifications for their products.

"For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available."

This policy is similar to that used by Microsoft, who only recently began to release interim "Security Advisories" for certain events, including the public confirmation of vulnerabilities for which no patch is available.

The fact is, these operating system vendors can take a long time to patch security vulnerabilities once they're notified of the problem. Unfortunately, there's a big difference between Apple and Microsoft when it comes to bugs in their operating system. I would argue that Microsoft is in a far more advantageous position, oddly enough, because their operating system doesn't contain so much open source software.

Mobile application security vulnerability report

Next page: Time to patch

More from The Register

next story
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Put down that Oracle database patch: It could cost $23,000 per CPU
On-by-default INMEMORY tech a boon for developers ... as long as they can afford it
Google shows off new Chrome OS look
Athena springs full-grown from Chromium project's head
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.