First Base Technologies: Apple MAC Security Testing

The Threat: Mac security risks

Does your organisation primarily use Macs?
Not sure where to get your Macs security tested?
Think they are secure because they are not running Windows?

How do you answer these questions?

The Issues: Why do I need my Mac systems tested?

In July 2008, Apple marked its best quarter in its 31-year history, selling 2.5 million computers in that period. This rise is thought to be influenced by users' dissatisfaction with Windows. [Secure Computing Magazine, July 24 2008, "Macs under hack attack as popularity rises", Joy Persaud]

And the December 2008 Sunbelt Software newsletter reported that "Apple Macintoch enterprise usage continues to grow" stating that:

"Over two-thirds of the 700 survey repondents - 68% - indicated that they are likely to allow their end users to deploy Macs as their corporate enterprise desktops in the next 12 months."
"Seven out of 10 [sic] businesses - 70% - rated the security of the Apple Mac and OS X as "Excellent" or "Very Good"."
"An 82% majority of corporations rated the reliability of the Mac hardware and OS X 10.x as "Excellent" or "Very Good"."
"Over three-quarters of businesses - 77% - have Macintoshes present in their environments."

However, the increasing popularity and use of Macs in the workplace doesn't only merit the attention of the press - it is beginning to seriously merit the attention of attackers as well. No longer does the popular belief that Mac products are immune from the efforts of cybercriminals hold true.

The discovery of the "OSX/Hovdy-A Trojan", which may be downloaded by users disguised as a game or video link, is a case in point. The trojan affects the Apple Remote Desktop Agent (ARDAgent) to gain root access. It can steal passwords, open firewalls and disable security settings and hackers can disable system logging, leaving no traces of the activity.

In addition, Sunbelt Software researchers reported in October 2008 about a web site advertising a Mac security product called "MacGuard" - which may be the exact opposite! Read the full story here.

...and an August 2009 advisory identifies yet another sneaky vulnerability. Read the full story on SC Magazine here.

Carole Theriault, senior security consultant at Sophos, says: "In the last 12 months, we have seen growing evidence that cybercriminals are looking increasingly for opportunities to hack into Mac computers for financial gain. Although the problem is much smaller than on Windows, Mac users would still be wise to ensure that they run an anti-virus, keep up to date with security patches and to exercise care as to which programs they run on their computers".

More and more clients are asking us to conduct Mac security testing. This emerging requirement has lead us to develop a robust methodology aimed specifically at Mac security testing. If you have Macs on your network, let us check your exposure and advise on secure configuration.

The Solution: First Base Technologies' Mac Testing Team

Our expert Mac Systems Security Testing Team can assist you in obtaining full assurance against the issues raised above by:

Externally testing for vulnerabilities that would permit an attacker to compromise your Apple network infrastructure or Mac systems remotely.
Internally testing for vulnerabilities that would permit an attacker to compromise your Apple network infrastructure (via your internal network), or testing individual Mac desktops/laptops.

The reports we produce, which can be tailored to your requirements, will inform you of the vulnerabilities found and provide information to help you fix them. And, we will provide you with post-test discussions and meetings to assist you on your journey to securing your Mac environment.

The Services: So what can we offer?

The following services can be offered individually or as a package depending on your requirements:

Network Discovery	Do you know what your network looks like? Using a combination of tools and experience, we discover the network structure and map your network (Mac and non-Mac systems). We disclose the network perimeter, highlighting third-party connections. Our discovery service includes a review of router and switch configuration, passwords and SNMP community strings. We investigate third-party connections, dial-in and dial-out facilities, firewalls and edge routers, and set the stage for subsequent penetration tests and vulnerability scans.
Apple Network Security	We review the security and build standard of your Mac servers and workstations. We check for the presence of anti-virus software and appropriate firewall settings. We conduct vulnerability scans to highlight unnecessary and unpatched services, vulnerable file shares and weak user access controls. We investigate other network interfaces that may be offered, such as Bluetooth and wireless, and attempt to compromise them too. Our detailed report will provide guidance on improving the security of your Apple devices, making your standard build more secure.
Apple MacBook Testing	If a MacBook were stolen, how easy would it be to access its valuable data? We evaluate a sample MacBook - we attempt to breach its access controls and undertake a full investigation into its security. Our detailed report will provide guidance on improving the security of your MacBooks, making your standard build more secure.
Social Engineering & Staff Awareness	Staff awareness of social engineering is often particularly weak, leaving most organisations open to abuse both remotely and in person. We can combine our services with social engineering tests if required. Please see this page for more information. We can also author - or provide assistance with - policies, standards and guidelines for deployment and usage of Apple systems.

Every test is carried out by one or more (depending on the scope) highly trained professionals. Their findings are reviewed by a senior technical member of staff

The final report, which can be in a format tailored to your requirements, is inspected by a partner before being sent to you. Once you've received it, we provide an in-depth discussion of our findings to ensure that the vulnerabilities and solutions are relevant and properly understood.

Thus, at First Base Technologies, we pride ourselves in ensuring that we are with you every step of the way in attempting to secure your Apple systems from attack...

You can read our FAQ on penetration testing here

And see what our clients say about our services here

or phone Andy on +44 (0)1273 45 45 25

E&OE
© 2001-2010 First Base Technologies LLP - All Rights Reserved.
First Base Technologies LLP is a limited liability partnership registered in England & Wales, number: OC352070
Website designed and mastered by

W3 Org says this page is HTML 4.01 compliant