Apple invites bug researchers to scrutinize Lion OS

But security experts who accept must keep findings secret

Apple is offering security experts a copy of the developer preview of Mac OS X 10.7, aka Lion, and asking them for feedback.

Several prominent Mac security researchers have reported that they received invitations to try out the Lion preview, which Apple issued Thursday.

"Apple has invited me to look at the Lion developer preview," said Dino Dai Zovi in a tweet yesterday. "I won't be able to comment on it until its release, but hooray for free access!"

Dai Zovi is the co-author of The Mac Hacker's Handbook.

Charlie Miller, an analyst with Baltimore-based consulting firm Independent Security Evaluators (ISE) and Dai Zovi's co-author, confirmed today that he had also received an invitation to try out Lion.

The preview comes with a non-disclosure agreement (NDA) that prevents Zovi, Miller and others from commenting publicly about what they find. But Apple has asked for feedback and provided researchers an e-mail address to report vulnerabilities or other issues, said Miller.

"They've never done this before," noted Miller in an interview today. "That they're thinking of reaching out [to researchers] is a good positive step, but whether it makes a difference, I'll believe it when I see it."

Miller has been critical of Apple's security practices in the past, saying in 2008 that Mac OS X was an easier target at the time than either Windows or Linux.

Miller has proven his point at the last three Pwn2Own hacking contests by walking away with cash prizes and laptops for exploiting vulnerabilities in Mac OS X and Safari, Apple's browser. Miller is slated to tackle Safari and Apple's iPhone on March 9 at this year's Pwn2Own.

Other researchers have heard the news, if not received an invitation to the preview, and given their two cents on expectation for security improvements.

"I doubt we'll see any real security innovation in Lion," opined Alexander Sotirov on Twitter. And in a later tweet aimed at Miller, Sotirov said, "I'm sure we'll see improvements in Lion, perhaps even full ASLR. But that doesn't count as 'innovation' in 2011."

Sotirov is an independent security researcher, who with Miller and Dai Zovi, launched a 2010 effort they dubbed "No Free Bugs" that proposed researchers should be paid for their work because vulnerabilities have value.

ASLR, or "address space layout randomization," is an anti-exploit technology that randomly assigns data to memory to make it tougher for attackers to determine the location of critical operating system functions, and thus make it harder for them to craft reliable exploits.

Windows, for example, leans on ASLR, but Apple's current operating system -- 2009's Snow Leopard -- relies on partial ASLR that doesn't randomize important components of the OS. Microsoft has included ASLR in Windows since Vista's late 2007 debut.

After Snow Leopard's August 2009 launch, Miller said Apple missed the security boat by not fully implementing ASLR.

Apple has not disclosed a ship date for Lion -- saying only that it will be available "this summer" -- or its price. Historically, the company has priced its operating system upgrades at $129 for a single license, $149 for a five-license package, although it departed from that practice with Snow Leopard when it priced Mac OS X 10.6 at $29 and $49, respectively.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags AppleMac OSsecuritysoftwareMalware and Vulnerabilitiesoperating systems

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?