 |
 |
    |
Answer these questions by using our bespoke Mac Security Testing Services |
The Issues: Why do I need my Mac systems tested?
Apple recently marked its best quarter in its 31-year history, selling 2.5 million computers in that period. This rise is thought to be influenced by users' dissatisfaction with Windows. [Secure Computing Magazine, July 24 2008, "Macs under hack attack as popularity rises", Joy Persaud]
And the latest Sunbelt Software newsletter [Dec 2008] reports that "Apple Macintoch enterprise usage continues to grow" stating that:
- "Over two-thirds of the 700 survey repondents - 68% - indicated that they are likely to allow their end users to deploy Macs as their corporate enterprise desktops in the next 12 months."
- "Seven out of 10 [sic] businesses - 70% - rated the security of the Apple Mac and OS X as "Excellent" or "Very Good"."
- "An 82% majority of corporations rated the reliability of the Mac hardware and OS X 10.x as "Excellent" or "Very Good"."
- "Over three-quarters of businesses - 77% - have Macintoshes present in their environments."
However, the increasing popularity and use of Macs in the workplace doesn't only merit the attention of the press - it is beginning to seriously merit the attention of attackers as well. No longer does the popular belief that Mac products are immune from the efforts of cybercriminals hold true.
The recent discovery of the "OSX/Hovdy-A Trojan", which may be downloaded by users disguised as a game or video link, is a case in point. The trojan affects the Apple Remote Desktop Agent (ARDAgent) to gain root access. It can steal passwords, open firewalls and disable security settings and hackers can disable system logging, leaving no traces of the activity.
In addition, Sunbelt Software researchers recently reported (October 2008) about a web site advertising a Mac security product called "MacGuard" - which may be the exact opposite! Read the full story here.
Carole Theriault, senior security consultant at Sophos, says: "In the last 12 months, we have seen growing evidence that cybercriminals are looking increasingly for opportunities to hack into Mac computers for financial gain. Although the problem is much smaller than on Windows, Mac users would still be wise to ensure that they run an anti-virus, keep up to date with security patches and to exercise care as to which programs they run on their computers".
Over the last couple of years, we have been asked to conduct Mac testing for a number of clients. This emerging requirement has lead us to develop a robust methodology aimed specifically at Mac security testing. If you have Macs on your network, let us check your exposure and advise on secure configuration.
The Solution: First Base Technologies' Mac Testing Team
Our expert Mac Systems Security Testing Team can assist you in obtaining full assurance against the issues raised above by:
- Externally testing for vulnerabilities that would permit an attacker to compromise your
Apple network infrastructure or Mac
systems remotely. - Internally testing for vulnerabilities that would permit an attacker to compromise your
Apple network infrastructure (via your
internal network), or testing individual Mac desktops/laptops.
The reports we produce, which can be tailored to your requirements, will inform you of the vulnerabilities found and provide information to help you fix them. And, we will provide you with post-test discussions and meetings to assist you on your journey to securing your Mac environment.
The Services: So what can we offer?
The following services can be offered individually or as a package depending on your requirements:
| Network Discovery | Do you know what your network looks like? Using a combination of tools and experience, we discover the network structure and map your network (Mac and non-Mac systems). We disclose the network perimeter, highlighting third-party connections. Our discovery service includes a review of router and switch configuration, passwords and SNMP community strings. We investigate third-party connections, dial-in and dial-out facilities, firewalls and edge routers, and set the stage for subsequent penetration tests and vulnerability scans. |
| Apple Network Security | We review the security and build standard of your Mac servers and workstations. We check for the presence of anti-virus software and appropriate firewall settings. We conduct vulnerability scans to highlight unnecessary and unpatched services, vulnerable file shares and weak user access controls. We investigate other network interfaces that may be offered, such as Bluetooth and wireless, and attempt to compromise them too. Our detailed report will provide guidance on improving the security of your Apple devices, making your standard build more secure. |
| Apple MacBook Testing | If a MacBook were stolen, how easy would it be to access its valuable data? We evaluate a sample MacBook - we attempt to breach its access controls and undertake a full investigation into its security. Our detailed report will provide guidance on improving the security of your MacBooks, making your standard build more secure. |
| Social Engineering & Staff Awareness | Staff awareness of social engineering is often particularly weak, leaving most organisations open to abuse both remotely and in person. We can combine our services with social engineering tests if required. Please see this page for more information. We can also author - or provide assistance with - policies, standards and guidelines for deployment and usage of Apple systems. |
Every test is carried out by one or more (depending on the scope) highly trained professionals. Their findings are reviewed by a senior technical member of staff
The final report, which can be in a format tailored to your requirements, is inspected by a partner before being sent to you. Once you've received it, we provide an in-depth discussion of our findings to ensure that the vulnerabilities and solutions are relevant and properly understood.
Thus, at First Base Technologies, we pride ourselves in ensuring that we are with you every step of the way in attempting to secure your Apple systems from attack...
| Want more information? |
|
