Security expert mauls Leopard firewall

Jurgen Schmidt, of Heise Security, issued a report claiming that the Leopard firewall failed every security test performed by the firm.

"The most important task for any firewall is to keep out uninvited guests," wrote Schmidt.

"But a quick look at the firewall configuration in the Mac OS X Leopard shows that it is unable to do this."

Among the shortcomings are a default 'off' state, hidden components that can be accessed by remote users but cannot easily be blocked, and an inability completely to block incoming connections.

"Specifically these results mean that users cannot rely on the firewall," stated Schmidt.

"Even if users select 'block all incoming connections' potential attackers can continue to communicate with system services such as the time server and possibly with the NetBIOS name server."

Schmidt compared the vulnerability of Leopard to that of Microsoft's Windows XP when it first debuted.

"Apple is showing here a casual attitude with regard to security questions which strongly recalls that of Microsoft four years ago," he wrote.

"Although the problems and peculiarities described here are not security vulnerabilities in the sense that they can be exploited to break into a Mac, Apple would be well advised to sort them out pronto."

Copyright ©v3.co.uk

appleleopardmacsecurity