Recently in Apple Category

A few weeks ago my officemate posted to Facebook,

I've just been told by two different Mac Geniuses that installing an antivirus software could actually make the Mac computer less secure. Unfortunately, both were phone conversations because I'm almost certain they were doing the Jedi mind trick hand motions.

As I read that, I figured this was Mac users in our company fighting our policy requiring antivirus for Macs. Certainly antivirus can slow a system. And any software can have vulnerabilities. But this wasn't about that. No this was actual honest to god responses from Apple support. My officemate wanted to know if this was official policy. So he asked for it in writing. That got him escalated to the next level where he was apologetically told it was not Apple's policy that antivirus is not necessary.

I thought of this today as Graham Cluley tweeted links to a couple video blogs from last year. Unicorns have been spotted, Malware for the Mac does exist. Now to be fair these examples are largely social engineering. Just because its not a zero day doesn't mean the systems isn't owned. Fake Codecs and Fake anti-maiware aren't the exclusive providence of Microsoft Operating Systems.

Just when you thought you'd successfully killed it off, its back. The email from management who is getting pressure from the c levels asking why the iPhone isn't supported. It comes in on schedule every two month.

"iPhone version 3.1 has solved all the security problems, right?"
Um, no.

"There is now a Wolfram Alpha app for the iPhone. This would really help our business development"
Are you serious?

Who can blame them. Apple and their willing co-conspirators in the tech media have been repeating the mantra. "iPhone 3GS is secure for the enterprise." Secure or not companies are adopting the iPhone, even to the point of allowing personal devices. Lets summarize what we know and what we dont know about the

Problem 1: Encryption
It is of critical importance to protect data privacy through encryption. iphoneinsecurity.com, a site dedicated to iphone forensics has posted video demonstrating the bypass of the iPhone 3GS encryption.

I suppose some would argue that the evil maid attack allows bypass of Full Disk Encryption on computers so I shouldn't have my data there either. Of course using a smart card or bitlocker with TPM I could protect myself from this attack.

Problem 2: passcode bypass
The passcode on a iPhone is bypassable

Problem 3: Lack of Central Config Management
Enterprises are used to controlling phone configuration centrally a la through a Blackberry Enterprise Server. iPhones configuration is sort of voluntary. TrustDigital would say they solve that issue. I need to talk with them (again) because I think they can enforce a configuration at the time the iPhone connects to the server, but I dont think they have a permanent enforcement agent. Could be wrong.

Problem 4: patching
While patches can be pushed from the BES, iPhone users need to install each patch individually through iTunes

Problem 5: iTunes
Speaking of iTunes, that isn't exactly a corporate type product. What if we dont want that on our computers. RIM has worked to make Blackberry work without installing any desktop software in a BES environment.

Problem 6: App Store
Whose account is used in iTunes? Do they use their personal account? In that case the end user really owns any applications purchased by the corporation on that account. When the employee terminates they would essentially walk out with the applications the company owns. If a corporate account is created then the opposite problem occurs.

Problem 7: Jailbroken phones
Jailbroken phones are susceptible to security problems. Besides the ikee worm, they allow unapproved applications to be run, bypassing Apple's whitelisting security model. How can an enterprise prevent jail broken phones from being used?

Problem 8: Repeaters
Like a lot of company headquarters, ours is like a unintentional Faraday Cage. We've had to put up repeaters for Verizon and Nextel. Are we supposed to pony up and install AT&T repeaters?

While the iPhone remains exceedingly popular, it still has Apple's consumer mindset at the core. (sorry bad pun) At least at our company I dont see it making headway until the encryption issue is solved. Then I'll talk with TrustDigital again about their management solution.

update
The day I posted this I got emailed an announcement of Good Technology's support for the iPhone. Good uses their own application and would keep the corporate email encrypted in that. However any other corporate data that made its way on to there wouldn't be protected. In an era of cutbacks its hard to provide support for both Good and Blackberry.

Commenters have pointed out that the iPhone still does not support S/MIME or PGP. I had thought to check on that but it didn't make the article. S/MIME support is mandatory for my company.

I usually skip over the Mac versus PC adds, but due to the hazards of watching football live I caught one today.

It was about the hardware innovations of the Mac. Kind of silly since last time I checked my hardware was from Dell not from Microsoft.

How about Macs software innovations. Apple went all out with XProtect in Snow Leopard.

Here is Sophos' writeup

When files are downloaded through the following applications:

• Entourage
  
• Safari
  
• Mail
  
• Firefox
  
• Thunderbird
  
• iChat
  
• and other programs that use LSQuarantine
  XProtect is invoked.

  Unfortunately, if variants of these threats find their way on to your system via an application that doesn't set the com.apple.quarantine extended attribute, for example via:

  Skype
  Adium
  BitTorrent
  and Finder (via USB keys, network share, etc ...)

  Then you're sort of out of luck.
  

But hey, you're not missing that much anyway. This "feature" only scans for the hash of 2 Mac trojans according ZDnet's Zero Day blog.

Now that is innovation.