Apple has yet to have to embrace application security standards and such dure to market share. Because of this their systems are more vulnerable. But, users are safer because their is no money to be made from creating exploits to Macs due to user base.
http://www.tomshardware.com/reviews/pwn2own-mac-hack,2254.html
Interview with guy who won the pwn2own contest. So he knows what he is talking about.
Alan: How much of your work today is focused on securing Macs vs. PC vs. Linux? Who is your typical customer?
Charlie: At work, I mostly look at application-level security. Most of this is really independent of operating system. For example, source code reviews or reverse engineering binaries doesn't depend much on the operating system. I've spent a lot of my research time on Macs because I like them and they also happen to be pretty easy to break!
Alan: I hadn’t realized that Pwn2Own was one of the few contests to employ real software. I completely agree--if you’re intentionally placing bugs, it’s nothing more than a Where’s Waldo puzzle. With enough teams trying, someone will guess the bug that’s been added. Historically, most of the criticism behind “hacking contests” was that it did not reflect realistic conditions. Company XYZ would claim “our firewall is 100% secure. We’ll give $100 to anyone who can crack our system as Trade Show ABC.” Of course, by the time the trade show was over, the system wasn’t cracked. Obviously, the company will fail to mention that no one tried because the $100 reward wasn’t worth the effort.
Charlie: Right. That is true at Pwn2Own partially too. Mac bugs aren’t really valuable, but while $5,000 is a lot of money, it’s really not that much when you consider what a bad guy could make with an exploit for an unknown vulnerability in, say, IE 8 running on Vista. The one thing other contests do test that Pwn2Own doesn’t is speed. I could have written my exploit in a day or a week or even a month. At other contests, you have to be ready to go non-stop for three days or whatever. I really never work more than eight hours a day.
http://weblogs.baltimoresun.com/business/appleaday/blog/2009/03/more_from_pwn2own_winner_charl.html
Q: Should Mac users be worried?
A: They should definitely be a little worried. Any security expert knows
that Mac OS X is less secure than Windows. The question is which is SAFER. Because Mac OS X is still relatively rare, it is actually a
little safer. But it has nothing to do with it being more secure, but
rather, that bad guys are entirely focused on Windows at the moment
due to the overwhelming market share Windows has. At this time, I
still don't recommend anti-virus for Mac OS X users, because there
simply isn't much malware for that platform. However, if Mac OS X
market share ever goes up, there will be a landslide of exploits and
malware.
Q: When you say "landslide of
exploits," does that include self-replicating viruses such as those that plague Windows and spread around the globe within hours? That's not supposed to be possible on OS X, so they say. Could someone get control of my Mac at home, which is behind a router with a firewall
(but sans commercial AV software)?
A: Yes, it is built upon UNIX. However, there is a ton of Apple
developed software running in Mac OS X, so that is mostly irrelevant.
Being based on BSD, there probably isn't a remote root in the TCP
stack, but it doesn't affect whether there is a bug in Safari of Mail
or how exploitation would fail. So yes, a BSD box is very secure. A
BSD box with Safari, Mail, mDNSResponder, iChat, etc is as likely to have bugs as any other operating system.
As for a worm, I could imagine a bug in Mail being wormable, as an exploit could mail itself to all the people who have sent you mail, etc. You are protected from server side attacks from your router, but
then again, so is your Windows PC.
Q: I understand one common objective is to
take control of a PC to use it as a spam-sending zombie. Is that the kind of thing that could happen to Macs?
A: Yes, everything you could do on a Windows machine: turn it into a
"bot,” send spam, perform DDOS [distributed denial of service], etc. can be done from a compromised Mac.
Q: If it is indeed so easy to hack OS X, shouldn't we have seen at least a few examples of malware in the wild by now? The Mac's share has been growing in the past two years, especially among the
group least likely to protect themselves: consumers.
A: I think the reason is economics. Hackers don't do things for fame
anymore; it’s a business. It simply isn't profitable to try to make a
botnet of Mac OS X machines when there are so many more Windows
machines. I like to say that if 90% of computers are Windows
machines, bad guys will spend 100% of their time on Windows, not 90%.
Q: Is Windows, at its core, more secure than Mac OS X? And why is the iPhone less vulnerable?
A: Yes. It’s not about the bugs, but rather the technologies which make it difficult to go from a bug/vulnerability to a bad guy running code
on your system. Windows has it, OS X doesn't. The two technologies
that Windows has that Mac OS X lacks, specifically, are Address Space
Layout Randomization (ASLR) and a non-executable heap. These two
things make it very hard to write exploits (the code that gains
control of your computer) in Windows.
IPhone is more secure than OS X because it has a smaller attack
surface (Mobile Safari doesn't try to do everything in the world) and
it has some anti-exploitation technologies built into it (specifically
a non-executable heap).
http://www.dasmirnov.net/blog/2009/03/21/charlie-miller-on-the-lack-of-security-o
"Why Safari? Why didn't you go after IE or [Firefox]?
It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.
It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn't have anti-exploit stuff built into it.
With my Safari exploit, I put the code into a process and I know exactly where it's going to be. There's no randomization. I know when I jump there, the code is there and I can execute it there. On Windows, the code might show up but I don't know where it is. Even if I get to the code, it's not executable. Those are two hurdles that Macs don't have.
It's clear that all three browsers (Safari, IE and Firefox) have bugs. Code execution holes everywhere. But that's only half the equation. The other half is exploiting it. There's almost no hurdle to jump through on Mac OS X."