Skip to main content

Why recent hacks show Apple’s security strength, not its weakness

Follow the news of any security breach on Apple’s systems and the pattern is predictable. Alongside reporting of the problem comes a common warning that Apple users “are not as secure as they think.”

It might be tempting to follow that line of thinking in light of two recent stories of vulnerabilities affecting the Mac and the Apple Watch. In the first instance, the Zoom video-calling app could be abused to let someone spy on you through your webcam. In the second, a flaw in Apple’s Walkie Talkie app could let a hacker eavesdrop on your iPhone conversations. They’re both troubling security issues.

But both cases actually serve as great examples of Apple’s security strength, not its weakness. Apple responded quickly and effectively to stamp out the threat before it could spread — and in this case, Apple isn’t getting as much credit as it deserves.

Actions speak louder than words

MacOS Catalina Hands-on | Macbook Pro
Dan Baker/Digital Trends

No company, system, or platform is totally immune to hacking. Companies love to boast about securing their users, but something is bound to give at some point. One way we can judge a company in terms of its security credentials, though, is the way it reacts to a crisis. And Zoom and Apple could not have provided a better example.

The issue revolved around the way Zoom’s click-to-join video conference system works. Installing Zoom also installed a localhost web server on your machine, which stayed on your Mac even when you uninstalled Zoom. This could be abused to stealthily reinstall Zoom, then access your webcam to pry on you without your knowledge.

When security researcher Jonathan Leitschuh published his findings on the issue on July 8, he revealed that he’d first alerted Zoom to the security breach on March 8 and received no reply. He tried again on March 26, pointing out a “quick fix” and saying he’d alert the public to the breach in 90 days.

Amazingly, Zoom waited until the last of those 90 days to do anything substantial, and even then it only implemented the quick fix and nothing more — which itself was promptly found to be vulnerable a few days later on July 7.

The vulnerability was made public on July 8, and the next day Zoom removed the web server from its app “via a prompted update.” From being made aware of the problem to finally removing the offending piece of software, Zoom took 105 days — almost three and a half months.

Now let’s look at Apple’s response. As we mentioned above, the vulnerability was made public on July 8. The next day, Apple instructed its built-in malware removal tool — installed on every Mac by default — to nuke the Zoom web server on sight. This was done via a silent update, meaning everything was done automatically with no holdups caused by user input (unlike Zoom’s own fix).

That’s right: It took Zoom 105 days to act. And Apple? Just a single day. Apple took no chances, implementing a quick fix that solved the problem once and for all. Zoom dithered.

The reason is simple: The two companies have very different philosophies. The one-click convenience of Zoom is one of its key selling points. To Zoom’s leadership, that was too valuable to lose — surely there had to be a way of addressing the security problem without risking this functionality? Fearing negative publicity and unsure of how to preserve its app’s advantage, the company became paralyzed — and in doing so put millions of Zoom users at risk by not securing their machines.

Apple, on the other hand, understands that the security of its systems is paramount not only to its users but to the success of the company itself. Apple has built a reputation for taking security extremely seriously — look at how it refused to build a backdoor into iOS at the FBI’s request, lest every one of its users be made vulnerable. It knows that prompt action in the face of danger — even if it means some functionality must be sacrificed — is a necessary cost.

Comparing the available resources of Apple and Zoom might not be totally fair, but Apple’s response is certainly the mark of a company that’s serious about security — not one that engages in mere virtue signaling.

No false sense of security

Macbook Air (2018) Review
Riley Young/Digital Trends

The Zoom incident wasn’t a one-off. From the foundations of MacOS to the way Apple responds to crises like these, the whole company is geared towards security.

MacOS has several features built-in that help to protect the system. There’s Gatekeeper, which will block software that Apple has not approved from running on your Mac unless you expressly allow it to. Any app that runs on the system is sandboxed, meaning it is kept completely separate from critical system components and cannot damage them. Various plugins like Flash, Silverlight, Java, and QuickTime won’t run if they’re not updated to the latest version — and Flash has been disabled by default since 2015’s MacOS Sierra.

Then there’s the T2 Security Chip, which not only safely stores your fingerprint data used in Touch ID, but also manages encrypted storage and enables Secure Boot. The last of these prevents unauthorized or modified operating systems from loading at startup and is set to the most secure settings by default.

Apple also has a system in place that allows people to report security flaws in its products. It was through this system that the Walkie Talkie vulnerability was disclosed and quickly addressed.

Windows has some nifty built-in security features, such as Controlled Folder Access that prevents unauthorized changes to your desktop, documents, and other folders, but is only just starting to catch up to MacOS. In contrast, MacOS has had a number of security features built-in for years thanks to its Unix-based architecture.

That combination of quick action and ingrained security systems highlights Apple’s security strengths. These days no operating system is truly “malware-proof,” but the actions of the company that distributes it — be that Apple, Microsoft, or anyone else — go a long way to keeping it secure and bringing peace of mind to us all.

Editors' Recommendations

Alex Blake
In ancient times, people like Alex would have been shunned for their nerdy ways and strange opinions on cheese. Today, he…
Here’s why WWDC could be a ‘critical event’ for Apple
Apple CEO Tim Cook looks at a display of brand new redesigned MacBook Air laptop during the WWDC22

Apple is planning a packed line-up for its Worldwide Developers Conference (WWDC) on June 5, which could become “one of the most critical events in the company’s history.” Aside from the company’s upcoming Reality Pro headset, there will be major updates to Apple’s software systems, including the biggest watchOS revamp since the Apple Watch launched in 2015.

That’s according to a new report from Bloomberg journalist Mark Gurman, who has a history of accurate predictions and leaks surrounding Apple products. It suggests that WWDC will be a chance for Apple to set out its future ambitions for a “post-iPhone era.”

Read more
This little-known feature is my favorite part of using a Mac and iPhone together
Person using iPhone and MacBook.

Apple’s ecosystem attracts plenty of praise for how all the company’s devices work seamlessly together -- and rightly so. But among all the admiring glances cast toward AirDrop, Continuity Camera and Sidecar, there’s another feature that feels a little unloved -- yet it’s a superb perk of using multiple Apple devices together.

That feature is Universal Clipboard, a handy little timesaver that shuns the spotlight and simply works diligently in the background. Yet that simple nature -- it just works, as the saying goes -- is part of what makes it so great to use.

Read more
9 new Apple products that could launch in 2023
The back of the iPhone 14 Pro Max.

As it currently stands, 2023 has already been a busy year for Apple. The company launched a new yellow iPhone 14, brought back the HomePod, and refreshed its Mac lineup with an M2 Mac mini and M2 MacBook Pro. But what else is on the docket? As it turns out, a lot more. From new iPhones, an upgraded Apple Watch, and possibly an AR headset, here are nine products we still expect from Apple in 2023.
iPhone 15 and iPhone 15 Pro

If there is any Apple product with an upgrade cycle that’s literally like clockwork, it’s the iPhone, which is always out in the fall. This year, we can expect the iPhone 15 lineup to include an iPhone 15, iPhone 15 Plus, iPhone 15 Pro, and iPhone 15 Pro Max. However, it is rumored that the iPhone 15 will have a bigger 6.2-inch display this year, but the rest of the lineup will have the same sizes as before.

Read more