Security experts knock Apple for not patching DNS bug
But researcher who found the flaw says he's not really worried
Computerworld - Apple Inc. has not yet patched a critical Domain Name System (DNS) bug in its Mac OS X operating system, analysts and security researchers noted today as some criticized the company for dragging its feet.
"It's not sending a real good message," said Rich Mogull, an independent security consultant and former Gartner Inc. analyst. "If they don't patch this in a reasonable time, they're putting their customers at risk."
Apple, which integrates considerable open-source code into its operating systems, relies on BIND (Berkeley Internet Name Domain), created by the Internet Systems Consortium (ISC), for its DNS components. ISC patched BIND July 8, but as of today, Apple had not released an update for Mac OS X.
According to Dan Kaminsky, the researcher who uncovered the DNS flaw in February and helped coordinate a multivendor patch effort, Apple was told of the vulnerability before patches went public. "They were notified at some point," said Kaminsky, who did not name a date. "They were given a heads up."
Approximately a month after Kaminsky discovered the vulnerability, representatives from several major developers, including Cisco Systems Inc., the ISC and Microsoft Corp., met at the latter's Redmond, Wash., headquarters to discuss how to handle the bug.
"In the spring, it was all about [vendors] who write DNS code; at its core, it was about people who write name servers," said Kaminsky. Companies he called "second tier" — those that "ship name server code that others write" — were not part of that March meeting at Microsoft. Apple, he added, was one of those second-tier vendors.
Calls to patch grew louder last week, however, after other researchers guessed some of the bug's technical details. Two days later, attack code went public.
Apple did not respond to questions about when it had been informed of the DNS flaw and when it would update Mac OS X to patch the bug.
Kaminsky was willing to cut Apple some slack on the DNS patch issue because of its minuscule market share. "Not that many people are running BIND on OS X Server, and those that do don't need Apple to hold their hand about patching," he said. "If there was a huge population of people behind DNS servers running OS X, I'd be more worried. That's not a dig [against Apple], it's just a statement."
In the grand scheme of things DNS, Kaminsky continued, Apple is a minor player at best. "We have bigger fish to fry," he said, adding that it was more important to focus on the vendors whose DNS code affected the most people.
True enough, said Mogull, but that's beside the point for people running Apple's operating system, particularly those relying on Mac OS X Server. "It may be a low priority in the scheme of the DNS vulnerability, but if all my servers are OS X, it matters," he noted. "Within the Mac audience, it matters."
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts