Mac OS X from an IT Security Practitioners' Perspective? [closed]

Question

What does the Mac OS X offer that it has been recently attracting users with IT security focus?

There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an entire link section dedicated for Mac (Titled: Mac Security Related Resources).

What does OS X have to offer to IT Security? Apart from being nice looking and less chances of virus infection (comparing with windows). Is it that users are running OS X and virtualization (linux) for pentest. [killing two birds with one stone, general usage computer + penetration testing.]

Or are they actually doing the security analysis with tools directly from OS X?

IMO I though it was an operating system for designers, but now it's becoming a widely used OS, and even being used for IT security...

Answer 1

First there was one...

Below is a shot of the network management table at Shmoocon this year. That one IBM? That's my work-issued machine that was powered on for an hour because I needed to get some things done while away. It didn't do anything else all weekend. Every single one of us did the rest of the work on macs.

Why do all the security guys have a Mac?

Let's back up a step and say, "Why Unix?" That's what it's really about. We're all the type to have an ssh terminal running and live in bash prompts. The Mac suits both of those pretty well. I think you'll find that most of the folks would likely run a Linux desktop but when it comes to laptops, which now dominate the market, it becomes a question of hardware and convenience. Yes, I can get a laptop from another manufacturer and load Linux on it, or even pre-order. But the Apple will do most of what I want without the extra time and effort. It's also a known product from a predictable vendor with a lot of locations where I can bring my machine in and get it fixed. Believe me, no laptop survives me without a few trips in for service.

So, Linux may be home, but my OS X laptop has most of what I need, works smoothly from day to day, and handles a few commercial-only things that I need too like my scanner and Office. It also doesn't grate on me when I want to live in terminal land, work with text files, and not reach for the backslash key. Sure, I can find a way to make the scanner work in Linux and I can run Office in a Windows VM or fight with OpenOffice, but the fact is if my clients want it that way, they'll get it that way.

Why all the InfoSec use?

I think most people are in a similar spot to me. Also, the tools drop into it fairly nicely too. Nmap? Native. If I want BackTrack, it fires up in a VM. Since it's now my primary OS on my laptop. My laptop is my primary machine rather my more powerful desktop is used far less often. In fact, it's across the room while I leisurely type away from my desk.

Besides, I don't have to deal with Ubuntu and the Unity fiasco. I want a simple and comfortable interface, and I get it without hassle. The world where I live, the console, is the same for all purposes. It's not ideal, but it comes with a few positives and few negatives... not enough to get me to format the machine and work on Linux. In fact, now that I think back, I've been on OS X for 8 years now. I wouldn't have crossed over if it weren't for native Bash terminals.

So yeah, as a security guy it's a great general use machine that can play double-duty.