There's an interview at the BBC with Kevin Finisterre, one of the contributors to the Month of Apple Bugs project. (Finisterre ran it with another, unnamed contributor by the handle of 'lmh'.)
Though it has to be said the interview's pretty thin, since there's a lot of what we could call setup (or maybe bootup?) explaining what the MoAB was about. The key paragraphs, about halfway down, are these:
Finisterre said: "Try calling any Apple store and ask any sales rep what you would do with regard to security, ask if there is anything you should have to worry about?
"They will happily reinforce the feeling of 'Security on a Mac? What? Me worry?'."
He said the Month of Apple Bugs (MOAB) project had succeeded in its original aim of raising the level of awareness around Mac security.
"I would really hope that people got the point that there are most definitely some things under the OSX hood that need a closer look," he said.
Hmm, well. I'm taken by the comment of Glen Fleishman at Tidbits's Moab is my washpot (you'll have to read his piece to understand the title), who says of MoAB that
"None of the bugs released had any real potential of a vector - spreading from computer to computer as a worm through an Internet- or LAN-exploitable flaw - and as far as I have seen, no in-the-wild exploit was released for any of the bugs, despite the fact that MoAB refused to notify Apple or third-party developers before releasing the bug details to the public.
Sure, this does point to a lack of people looking to exploit Apple security holes. But you can be safe in two ways: your house is impregnable, or you live in an area that has no burglars. If your house is pretty secure and there are very few burglars, you're very close to being in the same place as either of those extremes. Not exactly, but close. Certainly the lack of any vector was a key thing that made me, well, dismissive of what MoAB turned up in its early days. Some of the exploits looked better towards the end; too bad that Apple has now, a month later, fixed pretty much all of them. There's also a Google discussion group about MoAB where people are pretty much putting up the shutters. On the other hand, Brian Krebs (who first blogged about a demonstration of a much-disputed Wi-Fi hack on Apple systems) is less reassured, pointing out that a flaw in Software Update remains. Though it would have to be exploited by someone on your common network (and I did think that SWU used cryptographic keys for validation; maybe I've missed that bug's point.)
Conclusions? OS X isn't impregnable, but its weaknesses remain largely unexploited. We await developments, as ever. And we await the first successful attack against Vista - which, if I'm not wrong, has not been hacked in a malware sense so far.
