Perimeter
2/10/2009
06:15 PM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Could Slimmer OSes Lead To Better Mobile Device Security?

Maybe I'm stretching a bit, but let's say that operating system developers slimmed down their standard OSes enough so that eventually they'd be skinny enough to have a career in fashion and, more important, run on mobile devices. And, if so, would this be a good thing for mobile device security?

Maybe I'm stretching a bit, but let's say that operating system developers slimmed down their standard OSes enough so that eventually they'd be skinny enough to have a career in fashion and, more important, run on mobile devices. And, if so, would this be a good thing for mobile device security?I pondered this today while reading Ephraim Schwartz's story on ComputerWorld, "The incredible shrinking operating system."

I've spoken before about how delightful it would be if Microsoft, Apple, and their colleagues would cool it with the window dressing and frenetic adding of new features, and, instead, take some time to make their current OSes slimmer. In fact, I was a bit giddy when Mac announced this was precisely its plan for Mac OS X "Snow Leopard." A trim OS moves more quickly than a massive, bloated OS. Plus, less code generally means more security.

Another compelling reason Schwartz mentioned for putting operating systems on a diet is because "a smaller OS can run on a greater variety of devices, and as netbooks, smartphones, and new devices like the iPod Touch gain traction, the benefit of a smaller OS becomes hard to ignore."

OK, so let's say your Apple comes out with the new, slim-and-sexy Mac OS X Snow Leopard, and it can run on your iPhone.

Good thing? Bad thing?

From an interoperability, ease-of-use standpoint, it sounds good. From a security standpoint--well, it could be good because the mobile platform would have gone through the same scrutiny as other operating systems. (Maybe Mac's a bad example, here, but you get my point.)

Similarly, the iPhone's Snow Leopard operating system could theoretically run the same well-scrutinized applications as an iMac's Snow Leopard. (Realistically, though, the applications, themselves, would have to lose a lot of tonnage if they want to dance with an iPhone's comparatively puny RAM.) If, for example, the security industry ever succeeds in developing a secure Web browser that actually works,, I'd love to see it work on my BlackBerry.

On the other hand, narrowing the number of OSes to pen test and exploit might make attackers' job easier.

I'm just beginning to ponder this. I'm eager to gain the benefit of your thoughts.

Sara Peters is senior editor at Computer Security Institute. Special to Dark Reading. Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.