>take a look at this list > ><http://www.sans.org/top20/#index> > >none of the listed items affects OS 9 - >half can/will affect OS 10
I'm sorry, but this is just plain silly. Of course none of the items listed effect OS 9... because they didn't make a list FOR OS 9. They have TWO lists... one for Windows, one for Unix. Yes, because OS X is based on BSD Unix, it can be vulnerable to the unix listed items (in fairness to OS X, I don't think ANY of those services are on by default... however some are installed by default). But the fact that OS 9 isn't effected by anything on the list is just plain silly. It doesn't prove OS 9 is more secure, it just proves that they didn't make a list for OS 9 at all. They also didn't list the Amiga OS, or CPM, or Apple ProDos, or MS-DOS for that matter. Does that mean all those OS's are fully secure too? No, it just means the FBI (not the brightest group of people) didn't bother to make a list that applies to them. The fact of the matter is... sit me near an OS 9 based computer, there will be little you can do to keep me out of it. There are VERY few products for OS 9 that will truely lock down the computer, and NOTHING that comes with the OS. As for network access... put me on the same LAN segment as an OS 9 machine with network services turned on (AppleShare for instance), chances are really good you won't be able to keep me out of it either. Do you know WHY OS 9 is "secure" across the internet... because 99% of internet routers do not pass the AppleTalk protocol. You can't hack into something that you can't reach. This is why I say I need to be on the same LAN segment to network hack OS 9. So that means, put me down the street from someone on a cable modem... I might be good to go (depends on the cable modem model). And to REALLY poke holes in your complaint.... on the Unix list, #3, #4, #5, #7, and #10 can all effect OS 9 with the addition of the correct server software. They don't by default simply because OS 9 doesn't come with ANY internet services installed and on by default (PWS is installed by default, but not on... and PWS was/is? very insecure). AppleShare servers have SNMP services... thus making #4 a possibility on them, many people (myself included) run FTP servers off a Mac, thus making #5 possible. #3 (SSH) is run mostly as a client, so it won't promote the hacking INTO OS 9, but it will assist in the leakage of info needed to get into other systems, #7 (LPD) services are available by default using LaserWriter 8 drivers and the Desktop printer setup tools. Since the complaint has to do with buffer overflow, all you have to do to take advantage of that is know you are overflowing a Mac and not a Unix machine. And #10... passwords... that isn't a Unix thing, that is a human thing. And OS or any THING that needs passwords or PIN numbers, or anything else, can be left vulnerable to #10. -chris <http://www.mythtech.net> ___________________________________________________________________________ To unsubscribe send a mail message with a SUBJECT line of "unsubscribe" to <[EMAIL PROTECTED]> or <[EMAIL PROTECTED]>
