For those of you who may not remember, SDL stands for Secure Development Lifecycle and represents the foundation for the great strides in security that the Windows platform has made since the early 2000’s. In fact, of all the knocks about Vista you may have heard, I’m willing to bet that not being secure wasn’t one of them (unless you turned of UAC <grin>). You may recall from one of my early posts over a year ago, that Vista had far fewer vulnerabilities posted in its first year in production than any other desktop OS. And a lot of that is due to the fact that Vista is the first Microsoft OS developed entirely under the SDL paradigm, aka the Trustworthy Computing Initiative, at Microsoft.
I don’t know how I missed this article when it first came out -- I did post about the PWN2OWN hacking competition, but somehow missed this. At any rate, this is one of those articles that deserves some exposure even after the fact IMHO. Those of you who follow or have an interest in computer security, already realize that a big part of the Apple security “halo” is that they effectively have the advantage of what is known as “security by obscurity” (e.g. generally they “appear” more secure as a byproduct of reduced exposure, another phrase that I often use is, “it’s easy to be bulletproof when no one is shooting at you”). It’s interesting to me, like I blogged last year (the PWN2OWN 2008 competition), that the headlines will read “Vista falls” even though the Mac was the first to go by a significantly margin. But to have me blog about this, as a PC person, doesn’t have nearly the impact that it would coming from the actual exploit generators (aka hackers). So, when I read this article a few things jumped out at me and I thought I would share them. Of course, the link is below, so please read the entire article, I thought it was pretty interesting to get this insight right from the source. In case you don’t want to read the whole thing, let me call out a few of the more interesting comments that I found in the article that I think go to support my contention that the Windows platform is as secure, or possibly more secure, than even the Mac which many folks think is “inherently secure” primarily because of what I call their security “halo”. Here’s some excerpts that I think are noteworthy from Questions for Pwn2Own hacker Charlie Miller: (btw, the parenthetical elements after some of the excerpts are just my thoughts and are not to be associated with the article itself)
“I came to CanSecWest last year with two bugs but only one exploit. Last year, you could only win once so I saved the second [Safari] bug. Turns out, it was still there this year so I wrote another exploit and used it this year.” (hmmm)
“What’s the ballpark value of that Safari bug? … It’s much less than the IE 8 vulnerability (exploited separately by Nils) by about a factor of ten.” (which indicates that IE is a much more lucrative and sought after target)
“It’s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don’t do. Hacking into Macs is so much easier. You don’t have to jump through hoops and deal with all the anti-exploit mitigations you’d find in Windows.” (wow, to me this is the ultimate validation of the SDL implementation at Microsoft. I could also infer that Apple is likely still relying on the halo of obscurity to protect their platform which is where I came up with the title of this post).
“It’s clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that’s only half the equation. The other half is exploiting it. There’s almost no hurdle to jump through on Mac OS X.”
“It’s hard to find a good bug these days and even harder to exploit and deal with all the mitigations.” (except apparently on Apple where it was indicated above that there were almost no mitigations to have to deal with)
“On a scale of 1-10, how impressive was the Nils’ sweep of exploiting all three main browsers? I was surprised. For IE 8, I’d give him a 9 out of 10. For Safari, maybe a 2. It’s just too easy to pop Safari. For Firefox on Windows, I give him a 10...It’s really hard to exploit Firefox on Windows.” (but notice IE got a 9, so it’s not that far behind FF compared to the 2 for Safari)
but notice what he said about FF on Mac, “With Firefox on Mac OS X, you can do whatever you want. There’s nothing in the Mac operating system that will stop you...For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs.”
and lastly, “People said five years ago that buffer overflows would be solved by now. Well, they’re not. Bugs will always be there so it’s a smart move to work on mitigations and (anti-exploit) roadblocks.”
Hopefully, you’ve picked up some potential ammo here to use when you hear folks who are still living (technologically) in the 90’s continue to express the outdated notion that the Microsoft platform lacks the fundamental security of some other platforms. Btw,you could also refer to my recent post on how XP is able to meet the security needs of the USAF. And remember, Vista is the first MS OS that was developed totally under the SDL. So what I’m saying is, you have now seen the effects of the implementation of the SDL paradigm in place at Microsoft (comments above from a real hacker as well as data that shows that VIsta is 60% less susceptible to malware), and you can expect that our code will continue to reflect an ever improving security record as we move forward. I wonder if you can expect that from other platforms that have not instituted such a secure coding paradigm. You make the call.