Symantec: Mac OS X Becoming a Malware Target

tb3 writes "According to ZDNet 'Security vendor Symantec is warning that Apple's OS X operating system is increasingly becoming a target for hackers and malware authors.' They go on to warn that the only thing that's protected Apple users from exploits so far has been the small number of Macs on the net. Now that people are buying Apple products for 'style over function,' according to one analyst, Apple computer has become a target for new attacks. More coverage on Australian IT and Silicon.com. I guess sales of Norton Anti-Virus for Mac needed a boost." Symantec may well be right about this, but note that they also have the world's biggest vested interest in making Mac owners nervous enough to buy their anti-virus products.

Comments

Style over function?

[sgant]

Why does it have to be one or the other? From what I've found in OSX is that it can have style AND function.

Is that so wrong?

Re:Style over function?

[jav1231]

I think he meant "style over malfunction."

Re:Style over function?

[gitana]

Of course not.

The OS X platform is built on solid unix programing. The eye candy is just the sparkly coating. Properly implemented OS X can be quite secure. Although, you might be able to say the same thing about any modern os(yes even windows.)

Re:Style over function?

[Too Much Noise]

Why does it have to be one or the other?

It does not have to, but inevitably it will for some people.

The by-product is that people are buying these products for form over function. They say it looks pretty and then buy it but don't secure it.

Familiar, eh? it's the typical user buying a machine from Fry's, CompUSA and, now, Apple stores. Meaning Apple is also netting clueless users with its 'switch' campaign. Simply because they were largely confined to Windows so far won't magically change their ways as they move to Macs.

Next, more of this type of users can mean more unsecured machines, hence a more attractive target for hackers. Once hackers move in (and they will, what with macs becoming cheaper and all) security of OSX will really begin to get tested.

Re:Style over function?

[Anonymous Coward]

Reading all the comments below, this story is getting flooded with fanboys trying to dismiss an article which has a genuine point, by using any dirty means necessary - kind of like what happened here.

Sorry kids, but don't you think that there's a possibility that an OS which is designed to be easy to use (ie for the computer illiterate) AND is growing in popularity is going to be a target for malware/viruses?

Jesus Fucking Christ.

Re:Style over function?

[Elwood P Dowd]

"Don't hate me because I'm beautiful."

&c.

Re:Style over function?

[wealthychef]

I agree this will be a good test of the out-of-the-box security of Apple. Actually, I believe that out of the box, Apples are ironclad secure. They start with no services turned on by default. There are no Microsoft-like ActiveX analogous components that allow viruses to replicate if you do something innocuous-sounding like read email or run a word-processor. About the only service that is password-free is Software Update, but that is a client, not a server. If users turn on sshd and choose a poor password, they may well be attacked. This will probably rarely happen, since most people enabling ssh will be aware of the risks of poor passwords, and not really complain if attacked. I think this is just FUD for marketing.

Re:Style over function?

[prockcore]

There are no Microsoft-like ActiveX analogous components that allow viruses to replicate if you do something innocuous-sounding like read email or run a word-processor.

You mean *besides* the buffer overflows found in quicktime?

Re:Style over function?

[wealthychef]

I didn't say there were no _potential_ bugs or vulnerabilities in the system. I just think (and this is not a contradiction) that the system is very secure out of the box.

Try this experiment: install OS X and connect to the Internet. Leave it connected for a week. Now install Windows and connect to the Internet. Leave it connected for 30 minutes. Which one will be hacked? My point is that Windows needs special steps to be _protected_; Mac OS X requires special hacking and other circumstances to become _vulnerable_. The QuickTime ruse you refer to no doubt requires some social engineering to make work... that's just a guess on my part. Am I right?

Furthermore, the buffer overflows in quicktime do not afford an attacker root priviledges, do they? And when vulnerabilities are found, Apple, unlike Microsoft, so far anyway, has a great record of fixing them immediately. Apple has a great record on security in OS X. You are not going to see a flood of crippling, disabling OS X attacks like you see every couple of months with Windows viruses that take out our whole email system at work from time to time. Hacking an OS X box is HARD.

Re:Style over function?

[GFLPraxis]

You know what I find amusing? "Mac OS X is becoming a malware target! There are no viruses yet, but there will be some!"

Re:Style over function?

[Anonymous Coward]

Nope, merely visiting a website with a malformed quicktime file will do it. At least with OS X and most modern Linux distributions you can connect a newly installed system the internet without a firewall and download patches. It used to be that in Windows 2000 you could set required services (servers) like DCOM and RPC to listen on localhost only but that feature was removed from XP so the only way to prevent DCOM or RPC from binding to interfaces connected to the internet is a software firewall. Completely disabling bind_interfaces_only functionality in XP was dumb even by Microsoft standards.

Re:Style over function?

[wealthychef]

I don't see how the fact that the OS is designed to be easy to use has anything to do with its security. Your logic is wanting.

I do agree that its growing popularity will encourage virus and malware authors to find exploits in the OS. But Mac OS X is pretty analogous to Linux, security-wise. I'm sure occasional exploits will be found, and some have already been discovered. But they are rare, and relatively hard to use. I haven't seen any that enable a script kiddy with a shell script to hack into 50 OS X machines and turn them into zombies like you can with Windows.

The fact is that OS X is, inherently and by design, more secure than Windows. Even if it had 90% user base and was made for use by monkeys, I daresay there would be more Windows viruses going around than OS X viruses (of which I have yet to hear even of the possibility, much less any real attacks).

Jesus Fucking Christ to you, too. :-)

Re:Style over function?

[pyrrhonist]

Try this experiment: install OS X and connect to the Internet. Leave it connected for a week. Now install Windows and connect to the Internet. Leave it connected for 30 minutes. Which one will be hacked?

Neither (except if you're dumb enough to not have installed Windows XP SP2)

Windows XP SP1 with the for-free ZoneAlarm firewall, however, as well as Windows XP SP2, fared much better. Although both configurations were probed by attackers, neither was compromised during the two weeks.

My point is that Windows needs special steps to be _protected_;

Actually, in SP2 it doesn't. The XP firewall is turned on by default in XP2. In SP1, all you needed to do was turn on the firewall for a connection in the Network Connections control panel.

Now as far as local security goes, I agree with you; there are some nasty local security exploits. Microsoft is to blame for much of the security issues, but also a major part of the problem is third-party developers! It would help if application developers would realize that Windows is a multi-user system and actually follow Microsoft's reference guides for how to program in this environment instead of forcing the user to be an Administrator to actually use their program. Windows has been multi-user for years, and application developers still haven't caught up. Why do I have to be an Administrator to run a game? Bad programming, that's why! Not even Norton AV gets this right (scheduled scans do not run for non-administrators and a non-administrators are told that Live Update is off even if it is actually turned on). The only program that I've see actually try to do something about this is Nero, which has a program to set up a group to enable burning by non-administrator accounts, but even this is a special download that is not part of the regular install. This needs to change; developers need to start using the Windows multi-user environment correctly.

In summary, Microsoft provided the ability to make the system more secure using non-privileged accounts and groups like every other major OS, but application developers are not taking advantage of it. I always run as a non-privileged user, and I am getting sick of applications that have no reason to need administrator privileges not running correctly.

Re:Style over function?

[maxspivak]

There are at least two ways of getting a system infected: automatically and with user intervention.

A system may become infected 'automatically' when an external attack exploits a hole in the box's current configuration.

I got hit with a script-kiddy's sendmail exploit in an underpatched Linux box back in '97. Yes, it was my fault for not patching the system correctly. However, a properly locked down system, one with all necessary patches installed, is going to be *fairly* impervious to this type of attack.

Mac OS X gets kudos for being secure out of the box (though Apple should enable firewall by default). Linux has generally been there for a while now. Windows is slowly getting there.

Part 2 of avoiding 'automatic' exploits is being able to keep a system up to date. This is important and requires some user intervention on *all* OS's. The user *must* allow the OS to keep itself up to date. If not, newly-found holes will be left unplugged and potentially exploited in the future.

<aside> How many of these holes will be found depends on the underlying design of the OS. The worse its initial design with respect to security the more holes will be found. In its current state, Linux and OS X are more *inherently* secure than Windows. This is akin to Java being more secure than Active X -- Java was designed with security in mind, and very few security vulnerabilities were ever found. Active X has a security model of a sieve, and its terrible security history speaks for itself. </aside>

The second way a system can become infected is via user intervention. This is commonly called 'Social Engineering' and goes something like this: "Hey user, install this cool piece of software for neat feature X, Y, Z". So user installs the package, which includes malware, adware, opens a port from inside the system and communicates with it's mothership, etc. I don't see whey the Mac is inherently more secure to this type of an attack. In my one week's using a new Mini, I think this kind of an attack can succeed -- the user would even type the admin password to install the bad piece of software. Now, the malware on OS X & Linux wouldn't be able to overwrite critical system files (wouldn't have filesystem permissions) as it would on XP, but it could still cause enough havoc.

What worries me more is that Mac users, thinking that they're impervious to any attacks, wouldn't think twice about installing some random software on their invulnerable mac. They're not paranoid enough, and some paranoia is not a bad thing. :)

All in all, I welcome additional users into the Mac camp, even if it brings more risk with it.

Re:Style over function?

[flyingsquid]

Yes, but OS X has the most stylish viruses and malware around!

Re:Style over function?

[TMacPhail]

My point is that Windows needs special steps to be _protected_;

Actually, in SP2 it doesn't.

I'd say installing SP2 is a special step on it's own.

Re:Style over function?

[Spectra72]

I just bought a new computer that had WinXP. SP2 was already installed.

Re:Style over function?

[Urgoll]

In summary, Microsoft provided the ability to make the system more secure using non-privileged accounts and groups like every other major OS, but application developers are not taking advantage of it

You do realize that Microsoft, if they were serious about security, could have fixed that with the release of Windows XP. For some reason, most application publishers want the 'designed for Windows XP' sticker, logo or whatever. To get this, they're supposed to follow the guidelines of the program setup by Microsoft. For some unknown reason, Microsoft has never asked that the programs be well-behaved in multi-user, non-administrator environment. So developpers don't care (path of least resistance).

In most cases, fixing the issues are simply to store preference files in the right place (user's directory, user's registry).

Re:Style over function?

[Moofie]

No, I DON'T think that its "stylishness" has anything whatsoever to do with its susceptibility to malware.

Once there are some actual exploits in the wild that we can examine and dissect, my conclusion will remain.

Oh, wait, what's this? There aren't any? Ah. OK then.

Re:Style over function?

[Darby]

Windows has been multi-user for years,

Well, they have advertized themselves as such for years.
Tell me this, though.
How do you build a windows service (that's a daemon for you unix folks but it needs to be specifically built and installed to work properly), have it run as an unprivileged user (i.e. *not* the system account) and have it start when the system boots *without* the user it is supposed to run as logging in at the console?

If it's possible, then it is *very* fucking new.

Re:Style over function?

[chaoaretasty]

I'd say installing SP2 is a special step on it's own.

New instalations have SP2 by default.

Re:Style over function?

[CodeBuster]

I manage a group of offshore foreign software engineers and they will use VBScript to run FTP with the shared directory mapped to the root of the C drive using the domain administrator account over the Internet. I have tried to explain to them why this is not a good idea, but their argument is always, "We haven't had any [security] problems yet...if you don't like it then rewrite it [the software] yourself." One step that Microsoft is taking is to require Certified Partners to adhere to the best practices, which include not requiring root privileges to run the software (unless of course the program is an OS service or other administrative related application that requires root by definition). You are right though, plenty of developers are ignoring these best practices. However, there will come a day, and the day is fast approaching, when no serious company will be able to sell their Windows software if they do not get it certified and signed with a code-signing certificate. So at least in that regard the trusted computing initiative may be a good thing.

Re:Style over function?

[MntlChaos]

Tell me this, though.
How do you build a windows service (that's a daemon for you unix folks but it needs to be specifically built and installed to work properly), have it run as an unprivileged user (i.e. *not* the system account) and have it start when the system boots *without* the user it is supposed to run as logging in at the console?

If it's possible, then it is *very* fucking new.

Administrative Tools->Services. Select the service. properties, Log on tab, this account, fill in the account's details. general tab, startup type, automatic.

Not that complex actually. And it's been in since at least XP's release (maybe 2000, but I haven't used that much).

Ugh. I've defended Microsoft. I feel dirty now.

Re:Style over function?

[pyrrhonist]

How do you build a windows service (that's a daemon for you unix folks but it needs to be specifically built and installed to work properly), have it run as an unprivileged user (i.e. *not* the system account) and have it start when the system boots *without* the user it is supposed to run as logging in at the console?

1. Open "Computer Management".
2. Double-click on "Users".
3. Select "New User..." from the "Action" menu.
4. Type in the user's information.
5. Select the "Password never expires" checkbox.
6. Click "Create" and then click "Close".
7. Right-click on the user.
8. Click on the "Member Of" tab.
9. Click on the "Add" button.
10. Enter a name of a group you need to run the service.
11. Click "OK".
12. Repeat 9-11 for each group you need to add.
13. Click "OK".
14. Open "Local Security Settings".
15. Double-click on "Local Policies".
16. Double-click on "User Rights Assignment".
17. Right-click on a right that you need to run your service and select "Properties".
18. Click on "Add User or Group".
19. Enter the name of your new user and click "OK".
20. Repeat 17-19 for each right you need.
21. Repeat 17-19 for the "Log on as a service" right.
22. Open "Computer Management" again.
23. Double-click on "Services"
24. Right-click on the service and select "Properties".
25. Click the "Log On" tab.
26. Select the "This account" radio button.
27. Enter the username and password.
28. Click on the "General" tab.
29. In the "Startup type" select box, select "Automatic".
30. Click the "Start" button.
31. Click "OK".
32. ???
33. Profit!

If it's possible, then it is *very* fucking new.

It's been there since Windows NT, although the configuration was different in NT.

Re:Style over function?

[Sparks23]

In summary, Microsoft provided the ability to make the system more secure using non-privileged accounts and groups like every other major OS, but application developers are not taking advantage of it. I always run as a non-privileged user, and I am getting sick of applications that have no reason to need administrator privileges not running correctly.

Good assessment. I'd elaborate by adding that the /reason/ people don't program things to do non-administrator (or multi-user) stuff properly is because of legacy stuff, alas.

Let's say you're writing a program. You write it under Win95. Time goes on, Win98 comes out, then WinME, and finally XP. Now, with XP, you can do multi-user stuff... but by now you have a codebase you don't want to have to go back and rewrite all of. Or even with more recent programs, people complain that they want it to run on Win95, or 98, because they don't want to upgrade to XP.

It's really a pain to write something to do everything properly NT-ish/XP-ish multi-user /and/ run on single-user Win9x as well.

Whether or not Mac OS X is inherently 'better,' they picked up a bit of a benefit by the 'throw out the old system and start over with OS X' tactic. By basically creating an entirely different operating system, people really had to redesign their apps for it. Huge investment in time and energy... but as long as they're rewriting their apps anyway, they can rewrite them properly for a multi-user environment.

(Disclaimer: While I write Windows software for a living, Mac OS X software for a hobby, and use both, the Mac is my machine of choice for casual browsing and productivity.)

Re:Style over function?

[i wanted another nam]

Installing software from a non-administrator account.

In Windows, you have to either log in as an administrator, or use "Run as..." that 95% of the world doesn't know about but wouldn't use anyways becuase it's easier to just run an admin account. If already on an admin account, it just installs.

In Mac OS X, the installer simply asks you for the administrator user name and password. If on an admin account, it still asks for the password. They even ask for the password while root. If root is even enabled, which is superfluous with sudo.

Per-user preferences for all user apps

This isn't the case with Windows. Certain apps write to the global registry and save preferences in sytem folders. Bad coders, bad. This probably has something to do with the fact that there's no one single spot for preferences to go in Windows. It could be %HOMEPATH%\Local Settings, it could be in the app's folder, it could be %HOMEPATH%\Application Data. It could even be stored in the fucking Windows system folder. You just never know. The problem with the Windows model is that you never really know if you have to be an administrator to even run certain apps. Example: Until recently, the minimum group to run Yahoo! Messenger was Power User. Running an IM client as an administrator? Baaad. It's also just a general pain to run as a non-admin in Windows.

In OSX, it's ~/Library/Preferences. /Library/Preferences is read-only to normal accounts, and only used for system-wide preferences (display resolution, network config, etc). Sure, there will be the odd app that uses an ini file, but those are always apps ported from Windows, bad behaviors and all. One that comes to mind is Unreal Tournament. In OSX, running as a non-admin is practically transparent.

And now a message for those of you that had the mental, ocular, and intestinal fortitude to read this entire comment, "What is wrong with you?"

Re:Style over function?

[delire]

The OS X platform is built on solid unix programing. The eye candy is just the sparkly coating..

... that comes between you and the solid unix programming, choking the gfx card and swalling system memory.

Re:Style over function?

[iamacat]

Windows has been multi-user for years, and application developers still haven't caught up.

Actually it's not, unless you count malware as an extra "user", and neither is OSX. Unlike UNIX, they don't allow multiple concurrent users connecting via network or terminals and using the system's standard UI. As such, local file security is less important, because the machine will likely be only used by people with physical access. VMWare and other solutions that actually allow concurrent access have decent security (not sure about terminal server).

On the other hand, Win and OSX should have serious sandboxes for browsers and email to avoid becoming multi-user systems!

Re:Style over function?

[Servo]

I switched because of function not style. I use a Mac because it does everything I want and more. I don't have to have 2 or 3 computers to do what I want.. just 1 Mac. So called analysts need to get their head out of their ass.

Re:Style over function?

[OwnedByTwoCats]

As soon as Apache is as popular as Microsoft's superior IIS, there will be just as many exploits for Apache as there are for IIS.

Oh, wait a minute....

Re:Style over function?

[daviddennis]

Frankly, this annoys the heck out of me.

Give me a proof of concept virus that actually spreads via email, instant messenger or something similar, and I'll start worrying.

The problem is that the email client in MacOS X isn't scriptable, and so you can't use it to read the address book and automatically send out messages.

If malware comes for the Mac, it will probably come through something like Kazaa. The simple fix, of course, is not to install whatever program introduces the spyware.

D

Re:Style over function?

[Moofie]

I happen to prefer Apple's software (particularly iPhoto and iMovie) for the things I like to do. Are there Windows options for these tasks? Sure. Do they suck? Mostly.

I, unfortunately, use Windows at work, but for my own stuff, the choice is clear.

Re:Style over function?

[Slur]

"but by now you have a codebase you don't want to have to go back and rewrite"

Of course, forward-thinking OS developers make sure that in order to write files into a preferences location (for example) you have to call "GetPreferencesFolder" and you are discouraged from using absolute paths, assuming there is such a thing as "C:" and so forth. So when the OS gets revised you don't have to rewrite anything at all. Your code does the right thing.

This is the marvelous thing about Mac OS X and its legacy Carbon APIs. I have a fairly large shareware music program that I originally wrote for Mac OS classic, and it took me about two days to get it running on Mac OS X. And I didn't have to do anything specifically for the multi-user elements of the new OS because the system environment is so well abstracted. (And it was very helpful that Apple provided the "Carbon Dater" utility which told me all the changes I needed to make, and where.)

Of course, just getting it running wasn't enough. I felt the need to redesign the appearance and to take advantage of the modernized music and sound technologies that Mac OS X provides. Now I have a program with an entirely new codebase, but one which I can now use to build future music applications. And I wrote it entirely in C++ with strong separation between TheirAPIs and MyData so I can consider faster cross-platform migration in the future.

I think if you install the developer tools and study the Apple headers you'll be pretty impressed with their forward vision and the intelligent choices their technology developers have made. (There are also very few LONG_UNWIELDY_UPPERCASE_LABELS to deal with, so code tends to be more readable.) Who knows, you might even decide to field some Mac projects in the future...?

As an IT person who is deploying OS X

[snuf23]

Can someone out there tell me what the reality of the situation is? Do you really need anti-virus for OS X? In the research I've done I can't seem to find any references to real (as in active in the wild) OS X viruses.
We will be transitioning about 8 production Macs to OS X later this year, and I am wondering whether I need to concerned at this point. It doesn't seem like I do.
I also understand the possibility of exploits in some of the open source code used in OS X. I assume you deal with this the same as on any other OSes and patch it when the fix comes out.

Re:As an IT person who is deploying OS X

[mekkab]

You can "rootkit" BSD boxes. Though from here its a bit more than just BSD... sort of a mix.

Poorly administered servers can get trashed. If your root password is "r00t", it won't take long for someone to figure it out.

You need to be concerened only insofar as you need to have a network admin (or something to that affect). How do you know when your network is being attacked? How do you know what attacks are being tried? If you aren't analyzing your network thats the worst mistake anyone can make.

That being said, there is this virus, its called "rm -rf *", its really bad.

Re:As an IT person who is deploying OS X

[SmoothriderSean]

In my experience (as support staff for the Humanities Div of a university), far and away the most common virus issue with Macs is that they can be a carrier for Word macro viruses. Beyond that, you just have to keep an eye on users turning on services without knowing what they're doing (or using decent passwords). On the one hand, it's better to be safe than sorry, and just install an anti-virus package, but frankly, the need has been so slight that mac AV packages tend to be a mess.

Re:As an IT person who is deploying OS X

[littlerubberfeet]

I admin a sound studio with 10 macs and two windows machines. Nine run X.3 and one runs 9.2.2. The two windows machines run GigaStudio and are never, and will never be connected to the internet. I run antivirus software on the macs connected to the internet, and nothing has ever come up in a scan. Ever. I have run every single single version of X since 10.2.1 and they all stayed clean.

As for patching, I patch manually, because of quirks in all the audio software we run, but OS X will patch automatically if you set it up to. you will be manually installing patches for any apps not distributed by apple, but all of Apple's stuff will update automatically.

Re:As an IT person who is deploying OS X

[Skippy_kangaroo]

I have been running my home computer on OS X hooked up to broadband for a fair while. So it's always on and always there to get infected. Thing is, it hasn't been. Its protection consists of the default firewall that comes with OS X. I turned NAT on in my DSL modem but that was just so I could hook up my mother-in-law's Windows computer when she was visiting.

The only virus definitions I have ever seen in Symantec products for Mac OS X are Word macro viruses and the like. That would suggest that there are no viruses in the wild that can cause any damage that Symantec will protect you against. There have been a few proof of concept stories going around which are usually fixed by Apple at the next security update. Sometimes they relate to open source software (I think Apache had one a while ago) and some relate to Apple software. As far as I know they have all been patched. And, as I said, I'm still not infected.

Re:As an IT person who is deploying OS X

[gnasher719]

You definitely need anti-virus software on the Macintosh. That way you can download stuff on a Macintosh that you want to use on a PC; you do the virus check on the Macintosh without the slightest chance of catching anything. Then pass the checked stuff on to the PC. On a PC, there is always the risk that some virus is more clever than the antivirus software and you catch something. Seriously, the viruses that Symantec has found are so absolutely lame that you have to be completely braindamaged to catch anything. Like download the virus, then enter your admin password to allow it to infect your machine. At the moment there is nothing on MacOS X that would require a virus checker.

Re:As an IT person who is deploying OS X

[jericho4.0]

The reality is, this article is FUD.

Update reguarly/automaticly, and keep an eye on an OS X site or two to stay abreast of things, and you'll be fine.

Re:As an IT person who is deploying OS X

[Omniscientist]

My girlfriend bought a Powerbook G4, so I've played around with it a little bit. The root account seems disabled by default. Well...I'm damn sure that a lot of processes run root level (so compromising a process and obtaining a root shell should still be ideally possible if there is a hole right?), but the actual logging into root seems to be disabled by default; which, at least locally, is a good idea for your average computer user.

Also, /etc/sudoers seems to allow a user to "sudo passwd root" upon default install...I'm not sure if this is limited to administrators, but uh, that's not very cool. Easy to fix, but I wonder why they even included that?

Re:As an IT person who is deploying OS X

[Anonymous Coward]

I have been doing tech support for 5 years in a mixed Mac/PC environment, and have never seen a Mac computer have a virus infection. Take that for what it's worth. (Most of our Macs are running 10.3 right now.)

Re:As an IT person who is deploying OS X

[CaymanIslandCarpedie]

As an IT person, you should already know the answer to this ;-)

Yes, Mac OSX has historically had very few problems with viruses or exploits. However it only takes one ;-) And in my experience when that one hits users/bosses aren't very understanding to "I didn't even realize there was anything to worry about." as an answer from IT about why they weren't protected. If there is a SUPER tight budget, yes you can probably get away without it, but I NEVER would. If for no other reason than to CYA. We only have a few OSX computers in the network, but they are all protected. The price of the Macs VS price of some basic anti-virus its really not much of an issue better to spend the extra few bucks than be sorry ;-)

Here is a decent summary of OSX historical vulnerabilities (there are still a couple unfixed ones out there).

http://secunia.com/product/96/

Re:As an IT person who is deploying OS X

[Anonymous Coward]

It's limited to administrators. If you have administrator rights on OS X, you effectively have root anyway; it's just that it's shielded power: you need to take deliberate action to access it, rather than it being at your fingertips. Sort of the difference between an empty pistol with ammo in your pocket, and a loaded and cocked pistol.

Re:As an IT person who is deploying OS X

[Sycraft-fu]

At this point I'd say not to worry, there doesn't seem to be much in the way of viruses. The only real function would be to catch Windows viruses so you are an unwitting carrier, but then that can just be done on the Windows systems.

It sounds like spyware is the problem that is going to be the more immediate concern. Initally, there should be little enough of it that you can just shitlist it, but once the door is open I expect they'll be a flood of it since scammers just never seem to give up.

The real solution for that is just user education. Teach them not to install crap (I know, easier said than done). Make sure they don't think they are invincible just because they are now on a Mac. A distrubing trend I see with many Mac converts is they believe themselves to be invincible to malware/viruses/exploits/etc. Well that mindset will lead to crap getting on the systems when it comes out.

So while I'd keep an eye on the OS-X virus situation, I wouldn't worry about software at this point. Worry more about malware and teaching users to stay away from it.

Re:As an IT person who is deploying OS X

[BandwidthHog]

Yep. Just tried it on my iBook under 10.3.8. I was then able to log in graphically as user "root," which showed up in my top right corner user menu as "System Administrator." Of course, I did have to enter my password, which is for an admin account.

So while it just don't seem right, I guess you can't really consider this a privilege escalation bug; from what I can tell it's just a shortcut for enabling root that requires admin credentials anyway.

Re:As an IT person who is deploying OS X

[mekkab]

Totally! Log all inbound packets (to see whats out there) and have your firewall act in 'mysterious mode' (doesn't answer pings, etc.)

Re:As an IT person who is deploying OS X

[notasheep]

Do the Mac anti-virus progs use the same virus lists as their Windows couterparts? If not, then you can't really claim a download to be clean just because you check it out on a Mac.

Re:As an IT person who is deploying OS X

[obeythefist]

That's the whole crux of the article, if you read it.

It never was much of a problem, but Symantec are saying that because of increasing numbers of Macs connected to the 'net, there's an increase in sighted Malware/viruses/adware/spyware.

Although you should take the words of a vendor trying to sell you something with a bag of salt, it is inevitable that incidence of external threat to an OS will be proportionate to the market share of that OS.

Perhaps the era of security through obscurity for Apple is drawing to an end, and the true security of OS-X will be tested. Should be interesting to watch.

Re:As an IT person who is deploying OS X

[wealthychef]

I think it will be interesting, because I think OS X will be shown to be highly secure. I agree, though, as market share increases, the proof will be forthcoming. Apple has made some MS-like security mistakes, such as the Help vulnerability that was discovered last year. But in general you are not going to see a Mac box with no MS Word and no MS Access installed spreading viruses like the PC's around my office seem to. I cannot believe what people put up with on their Windows machines. They are such pieces of crap, security-wise. :-) I don't mean to troll, it's just that I have yet to see a virus forwarded from an OS X machine... yet have seen hundreds from PC's. It's not just market-share, people. There is actually a difference in operating systems. Why is the idea that OS X might be inherently more secure than Windows such a shocking one to some people?

Re:As an IT person who is deploying OS X

[robogun]

Here is what I have:
He is running a G4 with OSX 10.2.8
He opened the email with 1.2.5
He runs Camino as a browser
1) He received an Ebay phishing email. The subject line was 'Please verify your eBay account'
This email appeared similar to others received on a daily basis.
2) He opened the email, but states he entered no information, as he knew what it was.
3) He reports the screen "flashed for a second." Otherwise, the computer appeared to continue to operate normally.
4) After some time, he noticed no new emails were arriving. He knew something was up when not even spam was appearing.
5) He dialed Earthlink Customer Service, and after a couple of hours, it was determined an attacker had obtained his Earthlink account information and set up email forwarding.
6) Also, he logged into Ebay and discovered a number of auctions for high-end goods in progress under his screen name. The attacker had changed his ebay email address to the forwarded address.
7) After more bouts with Customer Service, he recovered his accounts and passwords were changed.

Any ideas what happened?

Re:As an IT person who is deploying OS X

[MightyMartian]

Plenty of better scanners. ClamAV and F-Prot both are far better than Symantec. Symantec's stuff is trash. I spend at least a couple of hours a week dealing with that piece of crap Internet Security program of theirs. If you want to use Norton/Symantec garbage, be my guest. Do you really have that much faith in it?

Re:As an IT person who is deploying OS X

[davidstrauss]

but last time I checked, an out-of-the-box Windows box is owned minutes after connecting to the network

Last I checked, out of the box machines come with SP2, which fixes most such vulnerabilities, and have a firewall enabled by default. In addition, the latest desktop and server versions of Windows come with very few services enabled by default. It's also been a LONG time since any Microsoft email program ran worms without user interaction. And finally, if you take security so seriously, why don't you filter viruses in messages on your mail server, patch your mail clients, install client-side virus scanners, or TRAIN your users?

IE sucks for security, but that doesn't seem to be part of your argument. Please play again later.

Re:As an IT person who is deploying OS X

[Nate4D]

Well, I've never heard of anything like this, but a few comments:

The current version of Mail is 1.3.9. I don't know offhand if it runs with 10.2.8, since I'm running 10.3.8.

I wouldn't be completely surprised if there was a vulnerability in the older versions of Mail that allowed this to happen. I'm not aware of any such vulnerability, I'm just saying that it could possibly exist.

Camino's fairly beta software - I guess it's theoretically possible that there's a hole in it somewhere that allowed the attacker (who one has to presume got remote access) to find his eBay account name and password.

But, honestly, I'm much more inclined to guess user incompetence and/or deceit. Did anyone actually witness these events besides him, or is it all just on his word? I've known people to do stupider things than bid on expensive items while they're drunk, and this seems as likely an excuse as any to get back out of it.

Most likely scenario might be something like:

He acidentally did click on a link inside the email, and didn't realize it. Once activated, the link did it's job, and his account info was snagged in some nefarious way involving autofill, if Camino even supports that (I don't know, I use Safari, and cannot for the life of me fathom why a Mac user runs anything else, unless they're doing Web development).

I still bet he was drunk... ;)

Re:As an IT person who is deploying OS X

[jcr]

Please have your friend contact AppleCare, and if possible, forward them a copy of the phishing message. If there's a way to do do what you describe in Mail.app, Apple certainly wants to know about it.

-jcr

Re:As an IT person who is deploying OS X

[NoodleSlayer]

Its possible to set up a root password using the NetInfo config utility, which unlocks 'su' on a OS X Client machine, OS X Server comes with 'su' unlocked by default. Log in as root from the log in screen is still disabled after unlocking 'su' though I believe.

As for sudo, its this simple, don't let people log in as admin if you're worried about security. If you are the type that knows how to use sudo, odds are you know enough to keep yourself from fubaring the system anyways, and even if you do, reinstall isn't that hard.

Besides, you're perfectly capable of doing most things you need to from a regular account. The point of admin level access isn't to make the machine 100% secure, its to have cursory security from the users to make sure that they can't easily delete their system folder, or anything of the sort.

Sounds to me like Symantec's trying to push their

[Anonymous Coward]

Mac products out the door again. I guess with Apple projected to take 5% of the market share they decided maybe it would a good idea if they actually started pushing Mac products.

Security through obscurity?

[LukaFox]

Is it really true that the only thing protecting Macs thus far has been their smaller by comparison presence on the Internet? Is there nothing to be said for the inherent security or insecurity of a particular platform? This is the kind of argument that free operating systems get against their security all the time. It'll be interesting to see whether the Mac platform can stand up to increased attacks. If it does, this might help convince people that some platforms really are more secure than others.

Call me anal..

[Paska]

..but I already use an Antivirus for my Mac. Mind you I switched over from Windows a little under 1 year ago and since I use these machines for work I really didn't want to risk, even if it's 0.0001% of getting my work machine infected by a virus. All it could take is one sneaky website I visit to infect me, record information and I honestly wouldn't really know - mind you I doubt the Antivirus updaters would know about any Mac virus within 1 week of being lanched.

And no, I use McAfee. And it's not too bad, but then again I am biased as we bundle McAfee with systems.

Re:Call me anal..

[Hungus]

Hey, I have a product I have developed that stops all known chartreuse buzzards from stealing your cheese if you send me 50 bucks I will letr you use it. (I mean since you are using a product that detects all known viruses on OS X you must be interested in using my product too right?)

Portability

[khromatikos]

That's great!

Once they have it for OSX it must be fairly easy to port it to FreeBSD. I guess they might have to add a new category in the ports: /usr/ports/malware

money for symantec from mac users

[tofucubes]

gee wonder why Symantec, an antivirus and firewall maker, would say such a thing...

long time listener... first time caller

[wahsapa]

I have been using Mac's for 8+ years now, I even orderd my Cube on a Dreamcast, and have never had a virus or malware... so you can put me in the "believe it when i see it" catagory.

Re:long time listener... first time caller

[Sponge Bath]

I even orderd my Cube on a Dreamcast...

That sounds vaguely illegal, but fun.

Infidel!

[Faust7]

Is that so wrong?

Yes. Now, back to the bash prompt with you, heathen, and may the glistening tentacles of Aqua and Luna never intrude upon your conscience again!

(I kid, I kid. Luna doesn't glisten.)

Re:Infidel!

[BandwidthHog]

Luna doesn't glisten.

Ever see how Stephen King uses that word in his stories? Luna does too glisten!

Re:Infidel!

[jericho4.0]

I don't own a Mac, but I do notice that;

The default shell is Bash

The terminal app's fonts and antialiasing is really nice.

Re:Infidel!

[PedanticSpellingTrol]

... God rest his soul.

Re:Infidel!

[Baricom]

Excuse me, but isn't tcsh OS X's default shell?

Re:Infidel!

[Jord]

Not any more. It was changed in Panther I believe. The default is now bash

Re:Infidel!

[Jord]

Previous versions did come with bash btw, it is a simple change in the NetInfo Manager to go from tsch to bash.

Re:Infidel!

[OECD]

it is a simple change in the NetInfo Manager to go from tsch to bash.

Yes, and you'll have to change it yourself if you've upgrade to Panther from a previous version of OS X. (Unless you prefer tcsh, of course.)

1. Launch NetInfo Manager (in Applications/Utilities)
2. Click on "Users"
3. Click on your username (it'll be the short username)
4. Click the lock (to be able to make changes)
5. Double-click on the "shell" item in the bottom pane
6. Change the value to "/bin/bash"
7. Quit NetInfo (to set new values)

You can also change it via the terminal, as someone else has pointed out.

The only reason Windows is exploitable...

[hereschenes]

From the article:

"The only reason Windows has had mass exploits written for it is the sheer number of connected devices that are present on most networks."

It's a reason for sure, but the only reason? I think not!

bring it on. i think.

[trainwrek]

"style over function" Yeah, like the "style" of increased security. In some sick way I hope that OSX becomes a target so we can finally know the answer to whether OS X has limited security issues due to its user base or design.

And the I-told-you-so's are redeemed!

[SmoothriderSean]

Bad or non-existant passwords, crappy anti-virus software (Virex, I'm looking in your direction!), and a long-unchallenged (calm down, I mean by experience) belief that Macs would continue to be unaffected by this sort of thing always seemed like they'd rear their ugly heads one of these days. But on the other hand, why trust the exterminator when he says it's bound to be a big bug season?

Good business model.

[MuckSavage]

So their only "real" proof that hackers are targeting OS X is a rootkit? Wow. The Symantic FUD, aka "we need to sell more versions of NAV for the mac" has been shifted up a gear.

How useful

[Anonymous Coward]

Symantec Anti-Virus OSX Version 1.0:

Please upgrade to signature file 032105.sgn, your current version only detects 3 viruses, however the new signature file finds and cleans 5 different viruses.

Virex, not Norton

[Grayden]

I think that if anything, this would boost sales of Apple's .Mac Service which includes a copy Virex.

Just like Linux?

[tquinlan]

If I'm not mistaken, doesn't OS X log you in as a non-root user? And if that's the case, isn't the regular user (as in Linux and other Unixen) unlikely to do major damage to the system?

Re:Just like Linux?

[johnbeat]

Yes and no. The default user is an "administrative" user. They must type their username and password to gain root access. However, there have been some exploits that allow someone gaining control of an administrative user account to parley that into root access. Some of this has to do with what parts of the file system the administrative user has write access to.

For example, up until at least 10.2, the admin user could write files to /Library/StartupItems/; if they get the startup format correct, then on reboot those files would be run as root.

I always recommend that people set up a non-admin user as their normal account. But of course, few people are going to go to the trouble of going beyond the default settings.

That said, even if security on that front were perfect, all it would do is keep malware from gaining root access. For the average user, malware that only has write access to their own files is going to be just as catastrophic.

The system does now warn you if this is the first time you've run an app.

Jerry

Vested Interest up the Wazoo

[Skippy_kangaroo]

Yes, Symantec have a vested interest up the wazoo for that press release. The interesting thing is, the only virus definitions I have ever seen in their Mac OS X updates are MS Word macro viruses and the like. If there really was a threat it doesn't look like Symantec will be providing the protection.

Maybe Symantec is trying to draw attention to generate more business for themselves because there certainly haven't been any viruses released yet on OS X that Symantec provides any real protection for - so I wonder, what information could they be basing their statement on? Secret contacts with the hacker community? Certainly nothing public...

The protection will come from such sexily named files as Security Update 2005-002 and Security Update 2005-003 distributed courtesy of Apple Inc.

Re:Vested Interest up the Wazoo

[codegen]

I had a similar experience. A long time mac userr, I used to use some of the virus products in the old days (System 6 days) such as gatekeeper. I recently bought a compter at the university that I am at which has a site license for Norton. I installed Norton for MAC and constantly got warnings about the PC email viruses. I leave my email client on in the background and it was constantly interrupting me with warnings. I ended up turning the thing off. If they were able to be a bit more subtle with thier messages I might consider it again.

Security through obscurity is not permanent.

[Faust7]

In its seventh bi-annual Internet Security Threat Report, Symantec said over the past year, security researchers had discovered at least 37 serious vulnerabilities in the Mac OS X system.

Don't let this line fool you - it doesn't necessarily mean that OS X is inherently more secure than Windows, or Linux, or whatever. It can safely be said that the amount of resources being expended to identify and cure OS X vulnerabilities is at least somewhat smaller than those used for Windows, in rough proportion to OS X's much smaller market share. The lesser amount of pure research, plus the lesser amount of wild exposure, mean that there will be plenty security-wise in OS X that's missed. The truth won't really be known until OS X gains enough visibility to have as much as, or at least a fair chunk of, what Windows has thrown at it on a daily basis.

Obscurity isn't a permanent solution by any means, and here is the proof.

Re:Security through obscurity is not permanent.

[zulux]

It can safely be said that the amount of resources being expended to identify and cure OS X vulnerabilities is at least somewhat smaller than those used for Windows, in rough proportion to OS X's much smaller market share.

MORE effort is being spent to fix OS X than Windows - in proportion to market share.

OS X gets fixes from Apple.....

And FreeBSD.
And OpenSSH
And Samba
And Kerberos.
And Mach Developers.
And KHTML/KDE Developers.
And GCC Developers (stack protection,etc)

Plus a bunch more that I'm missing

Services are turned off by default...

[Philippe]

On MacOSX, most (all?) network services such as ftp, sshd, httpd... are turned off by default. And automatic software update (prompting the user) is on by default. That, coupled with a better security model from the ground up will ensure that the MacOS never becomes the trojan-infected mess that Windows has become.

Methinks that Symantec is propagating FUD to drum up sales...

Re:Services are turned off by default...

[Sloppy]

Well, the real risk these days is the user, combined with sanely written software. Disabling services is a good thing, but it's only one brick in the wall.

The question is: do web browsers on MacOS X automatically download and execute code, just by loading a web page? Do MacOS X mail readers let users execute an attachment as easily as clicking on it? And in both cases, does the code run with absolutely authority (i.e. root)?

From what little I've seen on my bro's Mac, the answer to those question is No, whereas it's Yes for a typical Windows user.

Norton AV is worse than malware

[zecg]

From what experience I've had with Norton antivirus for the PC, it does more damage to performance (network latency and throughput, memory and processor usage) than most malware. I've never installed it myself, just seen it on other people's PCs. I might just have wrong/incomplete experiences, but I think that their software is bloated crap with a horribly confusing UI. If I had a Mac OS X, I would prefer to have a command-line controlled utility which I never have to see, which runs as a service, updates transparently and can be fully controlled using plaintext configuration files. NOT anything remotely like Norton for the PC. Virex might not be good, but unleashing the pestilence of Norton upon the Mac is... cruel. Isn't there something like a chkrootkit in Darwin ports or Fink?

Users are not root; data more important

[Anonymous Coward]

That is correct, but you have to admit that the data a user has (work, music, etc.) is likely to be far more important than the OS. I can reinstall my OS X and apps and recompile my OSS software in a day, but if I loose my source files, I'm in a world of hurt.

let's see!!!

[netdur]

a small program that
1) fool web browser to download without user notice
2) chmod itself ---x--x--x
3) excute itself!!!

I don't think that is possible at *nix systems

Yes it is...

[Anonymous Coward]

It will upset the frothing Linux zealots who keep insisting you cant have both - thats their excuse for liking a GUI (doesnt matter which - Gnome / KDE - take your pick) that is less intuitive to use than even Win95

Re:Yes it is...

[Anonymous Coward]

"The one thing that bothers me about KDE is the fact that every application's name begins with a "K""

Ive always wanted to make some software named something like "Usable Network Toolkit" and have it added to KDE - just to see if they persist with the K prefix ;)

Re:Yes it is...

[aichpvee]

iLife, iMovie, iTunes, iPod, iMac... iKnow I'm forgetting a lot of them...

Re:Yes it is...

[jessecurry]

I never said that the "i" didn't bother me either, but it's slightly less annoying(at least to me) because you get an idea of what the application does from its name.
Looking at names such as Krusader doesn't help me to know what the application does. The same goes for kdissert, kdar, Krita, Kate, KLibido, knoda, Konstruct, KlamAV, etc... basically what I'm getting at is that the prepended K seems to make developers try to come up with Kreative names for their applications rather than informative ones.
About the only applications that I am familiar with that have descriptive names are KMyFirewall and KText. I'm sure that there are plenty of others with descriptive names, but the vast majority of Kapplications seem to be named simply for the K.

Viruses and Word

[mr.dreadful]

The only real issue I have with OS X and viruses is with MCSFT Word macro viruses. Its worth having something that can sort those bad boys out because they can be spread to other users. I have one user who is constantly propagating macro-viruses, but I think I found the solution.

I'm moving him to Apple's Pages software.

Seems to handle doc files just fine, and no macro issues.

Re:Hypotheticals....Hypotheticals

[Knobby]

The WORST you could do is trash your user environment. NOT the OS.

Who cares about the OS? The OS can be reinstalled in about an hour. I have 40GB stored in my user environment. It gets backed up every day, but a virus, worm, or trojan that wiped out the user environment could cost me a days work without too much trouble. That's a much larger concern to me.

FUD.

[sakusha]

There may have been 37 alleged vulnerabilities identified in MacOS X, but there have been ZERO exploits of those vulnerabilities. Apple has often released patches within 48 hours of discovery of a vulnerability.

At the current time, there are NO known exploits for MacOS X. NONE.

What a crock of Shit!

[ravenspear]

Anyone who has been a Mac user for any length of time and has used Symantec products can testify to the horrid filthy mutilated piece of code that is a Symantec product on the Mac.

This is NOT A TROLL.

I have seen (and experienced myself) Symantec products CAUSE more problems than they fix (if they are even successful at fixing any) on the Mac platform.

I pity the poor soul who has no experience with Symantec on the Mac and falls for this pathetic ad piece.

Re:What a crock of Shit!

[Mr Bubble]

I have been tempted to respond to this thread and you have drawn me in with a spirited "hear hear!".

I used to use Norton products before I knew better. Now, I have to talk people out of installing anti-virus, FileSaver and all that other crud. I have spent a lot of time on problems caused by these programs, but no time on viruses.

I say run a hardware firewall if you can, software firewall if you can't, choose a good password, don't turn shit on for no reason, apply Apple and 3rd party security updates, and read the Mac news regularly for anything that comes up like the Quicktime Autoplay vulnerability.

I have had zero problems with viruses and the like on the Mac, buut I feel like I need a shower after surfing the Net on Windows.

Re:What a crock of Shit!

[drinkypoo]

Anyone who has used any Symantec product for any length of time can testify to that, on ANY platform. Symantec antivirus is crap. I have a license for it and I actually switched to AVG free because it was less of a bitch. For one thing, the autoupdater actually works.

Re:What a crock of Shit!

[Bones3D_mac]

Agreed. Anyone who has ever been a victim of Norton Utilities trashing their hard drive knows this all too well.

As for viruses, I got by using the freeware software "Disinfectant" ever since system 7... arguably one of the best virus blocking/removal solutions ever made.

Re:Safari runs like crap

[chromaphobic]

First off, check and make sure popup blocking is enabled. I only see MAYBE one popunder a week, if that (and add the offending site to my mental blacklist, never to be visited again.) Go to the Safari menu and make sure there's a check next to the "Block Pop-Up Windows" item.

Secondly, yes, Konfabulator can really bog down a system if you have too many widgets running. They eat up memory and CPU power, even sitting idle. I have seven I keep open with little peformance imapct, but that's on a Dual 2Ghz G5. If you haven't discovered it yet, Activity Monitor (in Applications/Utilities/) can be very useful in tracking down where your CPU cycles and memory are going. It even lists all the Konfab widgets seperately, though it doesn't tell you which one is which. So if there's a widget that's being a hog, it'll let you know!

I'd bet that it's a low memory issue, Apple has a tendency to shortchange the memory in their systems, especially consumer level stuff like the iBook & iMac. Running OS X on less that 512MB will bring things to a snail's pace frequently, so a simple memory upgrade might help greatly.

Windows is unique

[Sloppy]

The only reason Windows has had mass exploits written for it is the sheer number of connected devices that are present on most networks.

I gotta call bullshit on that.

Quite simply, Microsoft's operating systems and applications are unique within the industry -- no, not just the industry, but almost unique in post-1989 history itself -- in the careless way they treat data as code. Nobody else would have deployed ActiveX, or deliberately made executing a mail attachment as easy as clicking on it.

I can believe MacOS (or any other platform) has its share of bugs that can be exploited, but you just can't find anything as dangerous-by-design as Windows. Windows will always (even as its marketshare fades) be a comparatively unsafe platform, relative to what is normal. It's not just about code quality, it's about amazingly dumb ideas, combined with business practices that resulted in a situation where users' happiness is not a significant market force.

And of course, there's the obvious counter-example: where are all the BIND and Apache worms? Talk about "sheer number of devices"!

The real statistics for Symantec

[PepeGSay]

10 years on the Internet, 24x7 for eight of those years. No antivirus. Not a single infection....

I do install one copy every few years to verify this personal protest against virus company scare tactics

More scared people -- more sales

[EmbeddedJanitor]

Symantic are surely drumming up some FUD to sell their product.

Apple fans are the perfect audience. Most are technically non-savvy arty types who are easier to FUD.

Re:More scared people -- more sales

[Ibanez]

You're just joking right? I can't decide whether to respond, mod you down as a troll, or mod you up for being funny.

Seriously, you think the average Apple user is less savvy than a PC user? Most of the graphics artists I know are SIGNIFICANTLY more knowledgable than most PC users...

Blake

Re:More scared people -- more sales

[Bellyflop]

Sure, but most Apple users aren't graphic artists. Apple has home user market penetration too you know. Most mac users are probably people who bought their iMac because they liked how it came in different colors, like my friend. She's not an idiot, but she's definitely not a savvy computer user. She just likes how her Mac looks and doesn't do much but websurf and word process.

Re:More scared people -- more sales

[arminw]

..Symantic are surely drumming up some FUD...

Indeed true! Unlike Windows, Mac Apps do NOT require admin privs in order to work correctly. If a user downloads a file that tries to execute, a window will come up warning the user and recommending to not allow this execution. If a malware wants to install something, the Mac asks for an admin password, which if the user doesn't know it or give it if he/she does know it, cannot get any further. There are millions of Mac users already, and I know of no malware that affects Macs that don't require some social engineering to trick a user into giving some kind of OK or password in order for that nasty to have any effect.

Windows still is and always was in effect a single user system where the software writers ASSUME that the user has total access to any spot on the hard drive, as it has always been with a PERSONAL computer. Many programs, especially malware, write to the registry for example, so the malware will run when the computer boots. If and when MS decides to finally change that FACT, backward compatibility with most existing programs will disappear, forcing all users to upgrade most, if not all of their software apps. *NIX OS come from a true multi-user heritage and have always been more secure by neccessity.

Re:More scared people -- more sales

[vwjeff]

Apple fans are the perfect audience. Most are technically non-savvy arty types who are easier to FUD.

I believe general stereotypes are bad but do have an example that fits this.

I work for the local school district as a computer tech. Recently, the art department bought a Powerbook for every art teacher. I got a call last week from an art teacher and said she was having problems installing a program. I told the user I would help her install it.

I get to the computer and ask her where the software is. She said she got it in an email from a friend. The subject was "Spring screensavers for you."

Of course the attachment was a zipped .exe containing a keylogger trojan. If this would have been a Windows box she would have unknowingly attempted to install a trojan. (All of our Windows boxes have AV software centrally managed)

I guess my point here is what if that trojan was coded for a Mac? A multiuser system is pointless if the user knows the admin/root password. (Our users do not have admin access.) In my experience, entering a password is more of an annoyance than a security measure for many users.

Ok, now I'm going off to another story but it is worth reading. A person of importance in the district recently got a new computer with XP Pro. She had previously had a Windows 98 PC and was in a habit to cancel past the Microsoft login. I don't blame her. There is not security there. Her new computer is shared between two people so I made an account for each of them like I do on every new computer. This person did not like the idea of having to type her password in just to get into her computer.

On Friday at 3:45 (work ends at 4:00) I got a call from the user demanding that the password be taken off the computer. She just wanted to turn on her computer and be at the desktop.

I did as she asked but also took the liberty to change her important documents to hidden. I was hoping I would get a call today. I did.

After getting a desperate voicemail for the user, I slowly made my way to her office. There she asked me what had happened to her documents. I played stupid and asked what documents. She said all of her important files were in the My Documents folder on Friday and there are not there anymore. I then came up with some bs about how I would need to recover them because someone must have been using the computer over the weekend and must have deleted them by accident. (Strangely enough there were children in that room over the weekend. Perfect scapegoats.)

I waited for about ten minutes and when she left the room I removed the hidden property from the documents. I then said I could enable the password so no one could get into her computer. She was more than willing.

Was my action unethical? Perhaps. Was it funny? I think so. I'm just happy I got my point across with no damage done.

Re:More scared people -- more sales

[jcr]

Well, you got her to understand why logging in is a Good Thing, but I think that in your shoes, I would have refused to comply with the initial, irrational request.

-jcr

Re:More scared people -- more sales

[Weirdsmobile]

Most mac users are probably people who bought their iMac because they liked how it came in different colors, like my friend. And most home PC users bought their computers because they liked the bargain basement prices. I don't know what kind of Windows platform utopia some of the posters in this thread are living in, but have you ever listened to some of the people buying PCs at CompUSA or Best Buy? I don't think fans of either platform can necessarily crow about the superior computer savvy of their users.

Re:More scared people -- more sales

[jschoenberg]

My sister bought her Mac Mini specifically because she's not savvy. She rightfully feels that she should not HAVE to be savvy to own a computer.

Re:More scared people -- more sales

[Gilmoure]

Apple fans are the perfect audience. Most are technically non-savvy arty types who are easier to FUD.


My Mac users are mostly faculty at a small college. They range all the way from the CompSci prof who just started installing Macs in his lab (wife got a Mac for Xmas and he liked it) to a fine art professor who has difficulty sending .jpgs in email and didn't know what an iPod was but she bought it with her laptop 'cus the guy at the Apple store said there would be a discount buying them together (really, she's that clueless).

The biggest problem I see is that a lot of people have been switching to Macs, believing that they are totally secure. They don't follow basic secure practices, clicking on anything they receive in email. I've seen proof of concept Applescript apps that, while asking for a user's password, go and wipe out their user directory and a html link that would fire up the terminal app and then list the user's directory (could have done much worse in user land, of course).

Until people stop walking around thinking they have a titanium dick and sticking it into every hole they see, there will be vulnerabilities.

I hate my users. Won't someone give me a job for surfing the web, watching movies and drinking beer?

Counter PR

[Paladin144]

I think that Symantec is merely responding to this little bit that slipped out (grabbed it from Macintouch):

David Coursey writes for eWeek about the lack of Mac OS X malware: How do I know there are no Mac OS X viruses and malware out there? Because the Mac product manager of one of the major security software companies told me so. And when people tell me I don't need their product, I usually take them at their word. I won't identify the person since he thought he was talking to me for a book project, but people at Apple were happy to confirm this to me. They don't put it in their advertising for obvious reasons.

Um...yeah. Can you say "Oops"? Now they've responded with some vague fears, but that's just to stir up some sales, as everyone has already guessed.

Next anti-virus companies will start writing their own viruses in order to drive up sales. Sheesh.

Re:style over function

[carpe_noctem]

I said the same thing about my ex before she gave me herpes. =(

Macs are secure but not invulnerable

[goombah99]

for the past 20 years, having a virus checker was useless on a mac and only served to avoid passing along pc viruses. At one brief point you could get word macro viruses.

If someone can get root on a mac you can install a root kit. But youhave to get root first. It's not good enough just to get user level or even admin user level. You have to get the admin user to enter their password to elevate to root.

The ppc played role too as I have read that until last year there was no widely know compact way to exploit a buffer overflow to execute arbitrary code. I beleive that is now solved and published so one might see these cropping up. :-(

Since the security model is better you dont have problems like active-X waiting to ruin your day, or auto execute on mous-over e-mail subject lines, or registry changes needed to install applications. Or other bonkers stuff.

But despite all the default security, nothing will stop a determined used from trojaning themselves good and hard. And if they are admin and enter their password your rooted. Nothing will withstand unrestricted physical access either. You can at least ward off limited physical access by using the firmware password but this can be overridden by a determined user.

and of course there have been security holes and always will be. SSH, quick time, and even JAVA had had security holes. Fortunately no one has manged to exploit these before apple fixed them and given apples default services-off settings and lack of root access, its going to be harder for these things to spread like wild fire.

on the other hand Macs are very homogenous so once a virus does finally break loose, if it can get in without requiring any services its going to spread quickly.

Re:Macs are secure but not invulnerable

[phillymjs]

for the past 20 years, having a virus checker was useless on a mac and only served to avoid passing along pc viruses.

Not true. In the olden days, there were a handful of Mac (Classic Mac OS) viruses. Some of them were even malicious, though those were extremely rare. The only ones I ever personally saw were benign, and easily eradicated by simply rebuilding the desktop file on the infected floppy.

From 1989 and well into the 90s (possibly even until 1998 when it was discontinued), the most popular Mac antivirus software was Disinfectant, a free utility written and maintained by one guy-- so that should tell you the non-severity of the Mac virus problem even then. The developer threw in the towel when cross-platform Word macro viruses hit the scene and quickly became too numerous to keep up with.

Since the time of Mac OS 8 or 9 until the present, however, I would agree with your sentiment that the only reason to use Mac antivirus software is as a courtesy to Windows users with whom you exchange files.

~Philly

Mac Os9 has never once been exploited remotely !

[Anonymous Coward]

Despite many high profile web sites and servers using OS9 for many years, not one database entry in the large BugTraq database documents a remote explloit for Mac OS in the history of the internet.

Even the US Army used macs exclusively (mostly MacOS 9 until recently) after being rooted rouitinely using unix and MS Windows NT. For many many years www.army.mil has been run on macintoshes exclusively.

The same is true of many colleges that were rooted and defaced too often on Linux. They installed WebStar and OS 9 and never had to worry again.

http://uptime.netcraft.com/up/graph/?host=www.ar my .mil

http://www.google.com/search?q=army+webstar+"os- 9"

Check it out yourself. This entire post is full of factual citations and 100% facts.

No mac in the history of the internet hosting a web server has ever been rooted or defaced remotely.

Why?

Because not one version of Mac OS has ever had a single exploitable hole ever discovered. (classic mac os now up to version 9.2.2 on currenlty sold g4 towers). OpenBSD has had no less than 5 holes (not one) in the default install in the last two years. Mac OS has had ZERO in over 8 years, even when paired up with its preferred web server app.

In fact in the entire SecurityFocus (BugTraq) database history there has never been a Mac exploited over the internet remotely. Scan it yourself.

That is why the US Army gave up on MS IIS and got a Mac for a web serve. Currently it is a honeypot for OSX testing, and US Army use regular Mac OS on other internal servers

This post is not talking about FreeBSD derived MacOS X (which already had a more than a 50 exploits and potential exploits in BugTraq database, and in the news yesterday with Symantec claiming in March 2005 of OSX having remote exploits) I am talking about current Mac OS 9.x and earlier which are highly sophisticated abstract-OS models.

Why is is hack proof? These reasons :

1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT. Apple uses an object model for procces to process communication that is heavily typed and "pipe-less"

2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidian's birthday into certain registers and make a special call). By always being root there is no false sense of security, and programming is done carefully.

3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not. In case you are not aware of what a "pascal string" is, it usually has no null byte terminator. Additionally certain types of compilers can check range on assignments to prevent out of bounds. Furthermore many good programmers ensure that the bounds are not overwritten.

4> Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not mere file name extension). File types on Macs are not easily settable by users, expecially remotely. Apache as you know has had many problems in earlier years preventing wayward execution.

5> Macs never run code ever merely based on how a file is named. ".exe" suffixes mean nothing, nor are there lame single 'x' executable bits! For example the file type is 4 characters of user-invisible attributes, along with many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with dat

"But it's a Mac..."

[Punk Walrus]

The Mac mentality can be harmful. I had to go onsite to one place where a guy had managed to get the entire office hacked because of his "invulnerable Mac."

What did he do?

He hooked up an Airport wireless station to the network so he could use his "invulnerable Mac" from anywhere in his roomy office. But didn't encrypt anything. So he opened up the whole office network to a wireless node that anyone could log into.

In a shipyard.

Near a military base.

Surrounded by vacant lots in a bad part of town.

So... when we got to the office, every Windows machine was compromised, the DSL router had been reconfigured to DNS in Taiwan (because it had the default password), servers had all their root passwords changed, and there was steady traffic from who knows what back and forth. It was a mess. We ended up having to do a full DnR on all the servers and workstations (luckily, it was a small office, so it was only 6 machines).

Yes, his iBook was FINE. His "invulnerable Mac" was just GREAT! I doubt there was a single compromised thing on his creamy white laptop.

And he kept saying, "My Mac can't be hacked into, you Windows folks don't know a damn thing about how great the Mac is."

"Good thing I use Linux, then," I said, trying to capture and trace packets from my Knoppix-STD Live CD. "Care to tell me how to explain to your boss why you exposed the corporate network to an unsecured wireless connection?"

"But... you don't understand, it's a Mac! It doesn't do those things..."

When I finally sat him down and explained what the Airport does, he turned real pale. And quit a week later. He assumed because it was "an invulnerable Mac," that meant he didn't have to understand security.

Man, what a mess that was.

Re:"But it's a Mac..."

[rokzy]

I don't get it? did anything bad happen to the Mac? what you're saying is that using non-Mac products can get you owned?

yes setting up a wireless network was maybe a bit stupid given such poor company security, but with that kind of bad IT administration something was bound to happen sooner or later.

also, look at how many Windows users don't think they need to understand security (the Windows box said is was more secure than ever!).

the moral here is that YOUR COMPANY SYSTEMS SHOULD BE DESIGNED TO BE SECURE in the first place so even the most retarded employee can't fuck everything up.

I hope you took the hint and moved everyone to Mac/linux. no? "fool me once, shame on you..."

Re:"But it's a Mac..."

[RatBastard]

No, the problem is that user was a raging moron. I've seen similar things happen with Linux users. Stupidity exists on all platforms.

Re:"But it's a Mac..."

[multiplexo]

You still haven't said anything about the Mac though. The guy set up an unsecured AirPort base station, he's a fucking idiot, this is like plugging a 100 foot CAT 5 cable into an active network jack and then throwing the other end out the window onto a busy street. I've got some news for you sunshine, if he was a PC user and had purchased a Linksys or Netgear WAP you would have had exactly the same problem. Out of the box Linksys gear ships with SSID broadcast on, the admin password set to admin and the SSID name set to Linksys. From what I've heard Netgear isn't any better. This wasn't a Mac problem, it was a networking problem.

Re:"But it's a Mac..."

[Marful]

Correct me if I am mistaken, but the network was accessed through an unsecure wireless access point. Not his Mac Laptop? If that is correct, then this incident has nothing to do with OSX vulnerabilities. This is the fault of an unsecured wireless access point. Since there was no security in the first place, there was no breach in "security". Besides the fact that wireless accesspoints are not secure using WEP or WPA encryption schemes (IIRC my facts correctly). It wouldn't of mattered if it was a Lynksis, Netgear or Belken wireless access point instead of an Airport model. If no security measures were implemented the incident would of still happened. So, the post, however humorous, in a cynical sort of way, is F.U.D. However, there is no question that the person responsible for this incident was at fault due to misguided beliefs, namely: "all mac products being invincible".

Re:"But it's a Mac..."

[Punk Walrus]

The point I was trying to make is that his "Macs don't spread viruses" philosophy was based only on brand recognition. If Mac made an automobile, he would have assumed in never crashed, no matter how badly he drove it.

The Mac and Airport he was using didn't cause the problem, it was how he had his Airport set up that caused the problem. He assumed, based solely on the fact these were Mac products, that he couldn't be to blame.

Free AV ClamXAv

[rockhopper]

The popular ClamAV for Mac OS X. http://www.clamxav.com/. Free!

Re:Free AV ClamXAv

[koehn]

Please, please please be sure to donate to the creators of this software (not only clamxav, but also clamav on which it is based). These folks work their butts off making our lives better (I cannot even imagine how many hours this software has saved when installed on a mail server (it hooks straight into amavis)), and I can't think of any free software more deserving of my money.

If you want to see more great, usable free software, donate! You can't imagine the impact you'll have.

MS moved into symantic's space...

[WindBourne]

and now, Norton and all the rest are looking to Apple and Linux to be insecure.

While Apple, Linux, BSD, etc. have their security issues, it does not really start to compare with MS. In addition, it is safe to say that an anit-virus is NOT the solution to a Non-MS problem. All of the *nix have various issues, but in the end, the single biggest one is getting an auto updater running for security issues. IOW, the largest threat to MS (Unknowledgable, lazy, or incompatent admins) is also the largest threat to all other systems.

use ClamXav (free virii scanner for OSX)

[bad_outlook]

Use Clam, I run ClamAV on my linux server, but they have a OS X client (GUI) out now: ClamXav is a free virus checker for Mac OS X. It uses a slightly modified version of the tried, tested, and very popular clamav open source antivirus engine as a back-end.

http://mac.softpedia.com/get/Antivirus/ClamXav.sht ml

bo

it's not market share!

[Anonymous Coward]

This whole market share angle is mostly bogus. There is what, about 10 million OS X users? Why hasn't there been a worm (or trojan, anything!) attacking them? Witty has a very successful worm: it hit all 12,000 vulnerable hosts.

How can you say 10 million is too small? The population of Canada (where I live) is about 33 million. The installed OS X based is then (about) 1/3 the population of Canada. That's not far from the population of New York city (~15M).

If a worm can hit only 12,000 hosts like Witty did and be called "successful" (it was basically a 100% infection rate), then surely the OS X population is vulnerable.

John Gruber has some articles on this.

uh oh

[Heisenbug]

I try sticking to the bash prompt, but I keep seeing Safari through the translucent Terminal window and coming back to check Slashdot.

Maybe I'm doing it wrong.

Re:uh oh

[aichpvee]

This should help.

In teh case of malware?

[Sycraft-fu]

Yes, obsucrity is absolutly he only reason it hasn't been targeted. Remember malware comes in the front door, not the back one. It either piggybacks on an app you want, or simply is an app you want. Well you can't secure against that, OSes don't know by magic which apps are good and which are bad. If you have permissions to install apps, you can install ones that fuck the system up.

That's different than exploits, which rely on finding bugs in code. If the code has less bugs and/or less services where one could try to find them, it is more secure.

However, there's basically nothing you can do about malware other than make scanners for it and try to educate users. Without some kind of trusted computing, signed application deal, there's no way you can make an OS that only allows users to install safe apps, since there's no way to know what is and isn't safe.

Hell some people don't even care about spyware, they want their dumb little free screensaver or whatever and don't care if it spys on them. You can tell them it's bad and they'll just ignore you.

Re:In teh case of malware?

[arminw]

...Yes, obsucrity is absolutly he only reason it hasn't been targeted...

I don't believe that even for one CPU cycle time. There are millions of Macs and hackers love challenges. A hacker who could penetrate a Mac would and could feel very proud, but aside from some clever social engineering, tricking the user into giving some sort of OK, it is not likely to happen. If a user downloads some file onto a Mac, and if that file is a program that has never run before on that system, a dialog comes up warning the user not to click OK unless he/she KNOWS that it is a safe program. If there is any doubt, the user is advised to click cancel.

Re:In teh case of malware?

[krunchyfrog]

Hell some people don't even care about spyware, they want their dumb little free screensaver or whatever and don't care if it spys on them. You can tell them it's bad and they'll just ignore you.

True. I know at least three persons that like to have smilies in their emails and just reinstall the spywares I removed about a day ago. I explain what the bad and evil spywares do, but hey, it's got smilies.

This is still just FUD

[argent]

The only exploit they point to is a rootkit... which is something you install *after* you've exploited the box... there are no active threats that any antivirus software will work aaginst.

This is like their attempt to talk up a manually-installed program that deleted all your files on the Palm as an exploit, to push their useless PalmOS antivirus. And then their Pocket PC antivirus actually caused people data loss from false alarms.

Until there's an active threat in the wild, AND it's been analysed and an identifying signature discovered, antivirus software's only result is to make your computer less stable and less reliable because of its deep hooks in the OS.

This is not to say that the OS is magically perfectly secure, but anything any AV company tells you about ANY platform but Windows, at the moment, should be taken with a sackful of salt.

The new version...

[lullabud]

...finds and cleans 5 different viruses which exploit vulnerabilities that were all patched in the latest point release of OS X 10.2 and 10.3.

Mac users' wallets may be under threat

[saltydogdesign]

This just in: Noting that Apple's market share is starting to grow again, Symmantec sees an opportunity to pry some dollars out of Mac users by hyping a bunch of laboratory experiments.

Wow. Isn't that a surprise?

This article mentions *one* exploit from last year, and 37 alleged proof-of-concepts, none of which are detailed.

I understand as well as anyone that the Mac is not bulletproof, but this really smells a lot more like a press release than news... Methinks Symmantec must have a new product waiting in the wings.

I have Symantec AV Corp 9.03 for OS X

[ellem]

and it kinda sucks. Every now and again (and not when it is scanning) it just takes over all the CPUs attention. So you kill it and then it comes back. So you kill it and then it comes back. So you disable it and this story comes out.

Looks like this is my fault. Sorry.

Malware Schmalware

[jimfrost]

This is kind of ridiculous. Oh, sure, malware on OS X is possible and perhaps even really growing in numbers. But the problem is not and cannot be anywhere near as severe as Windows because Apple, like all the other UNIX vendors, ships their systems in a (reasonably) secure state by default.

The malware problem on Windows is not primarily the result of the system's popularity, no matter how many times Microsoft claims that is so. Early attacks on the Internet did not target the most popular system; rather, the most attacks have always targetted the easiest systems to crack. That started out with SunOS and, by the mid-90s, was Linux. (If you think Windows has much better penetration that Linux today, just think how much more lopsided the numbers were in 1995-2000 when Linux was the most popular target.) These days Windows systems are easiest by far because at this point they are the only systems which ship without basic filesystem protections (now that it finally has a halfway decent firewall, a mere five years after everyone else).

If Windows had basic filesystem protection enabled by default on all critical filesystem areas, mandated nonprivileged user accounts, and an installer that required a password, suddenly Windows wouldn't get infected every time you sneezed in its general direction.

Maybe the future will prove me wrong but I will be very surprised to find OS X malware become a serious problem no matter how popular the OS gets. I don't suspect that its users are any smarter, but the barriers are a lot higher.

Re:Malware Schmalware

[Sebastopol]

Windows because Apple, like all the other UNIX vendors, ships their systems in a (reasonably) secure state by default.

Really?

I just installed XP Pro and ActiveX was off by default and the firewall was turned on by default. And it yelled at me for not having AV software installed. (F-prot all the way!)

Re:Malware Schmalware

[jimfrost]

So, can you modify files in c:\windows in that XP installation? Yes? Then the system is an open book to anything that can get even a toehold.

Re:Malware Schmalware

[jimfrost]

My point is that normal users typically have write permissions to that directory, one way or another.

I just checked the box I'm on (a generic WinXP Pro install) and found that c:\windows is writable by "administrators" and "power users". The former is appropriate, the latter isn't, but the whole thing is rendered moot by the fact that the accounts are, by default, created with administrator privileges.

That's largely of necessity, I realize. On one of my home XP boxes I decided that my 2 year old daughter's account really shouldn't be privileged, so I didn't make it so. The result? Nearly all of her children's games failed to operate. When I called vendors about that, I was told that I'd just have to give the account the necessary privileges. (Can't return the software, of course, nobody allows software returns.)

So: We have a system that, if configured securely, doesn't work very well -- and if configured so it works, is so wide open that any little application error can lead to a compromised system.

It's a disaster and the only solution to it is going to be to have Microsoft turn the security way up by default so the software vendors are forced to write their code accordingly. Like, say, every other major OS out there.

The transition is going to suck, but until it's made Windows is going to remain a really easy target.

WOW

[electricdream]

This is such a deep insightful article! Do I understand it correctly? Here's what I think it says:

A virus proctection and half-ass security company says that as the marketshare of one of the platforms it supports increases so should sales for the products it creates for that platform.

Did I get that correct?

The only thing?????

[wickedsteve]

"the only thing that's protected Apple users from exploits so far has been the small number of Macs on the net." The only thing? What, the only thing besides the more secure default settings out of the box and authorization for every installation?

Symantec....

[Electroly]

Yeah, yeah, there aren't any Mac viruses NOW... but don't even think we aren't writing some as we speak!!

Re:Mac Os9 has never once been exploited remotely

[phillymjs]

Actually, there was an exploit, once.

It was some time ago, and I believe it was the result of a "hack the server, get a prize" type contest.

I'm too lazy to Google it right now but IIRC, the server that was hacked was running the classic Mac OS, WebSTAR, and Lasso, a tool that lets you webify FileMaker databases. There was a vulnerability in Lasso that was used to, per the contest rules, successfully alter the contents of a certain page on the WebSTAR-hosted site.

The prize was awarded, the vulnerability was quickly fixed, and that's the first, last and only time I have ever heard of any server on a classic Mac OS based machine getting hacked.

~Philly

There's several reasons MacOS X is more secure

[jht]

Yes, a major reason it's safer is because OS X isn't targeted often due to the low market presence. But it's also a matter of effort versus payoff. By default, MacOS X has a much smaller attack surface than Windows, and even compared to most "stock" Linux distros. Virtually all server services are turned off by default on the Mac. Root is disabled. So to find a vulnerability and attack it takes a lot of effort, and then if you do so there are fewer Macs to take advantage of. So why not target Windows - it's easier!

I do know of people who've had their MacOS X systems compromised - but only among MacOS X Server users who've turned on services without knowing the implications, and then running them without the benefit of a firewall (because "everyone knows Macs are secure". Through bad setup and misconfiguration it's pretty easy to turn a server into "just another Unix box" that's just as vulnerable as any unpatched Linux server.

But that's not the default, and that's not how the client works. Hence at this time, Symantec is just blowing smoke and wondering why they don't sell any copies of NAV and Systemworks for Mac anymore.

Re:There's several reasons MacOS X is more secure

[jht]

Yeah, but the days of plain old "viruses" are pretty much over. Nowadays, most malware seems to be targeted at turning Windows boxes into zombies - and that's where the reward is (because those zombies are being monetized). So a successful Windows exploit can return potentially millions of machines, while a Mac exploit will return a fraction of that number.

Combined with the substantially greater effort needed to attack the Mac, that's why nobody's doing it so far. If Apple starts nibbling away more market share (as some indicators say they might be doing), you may see an increase in activity, but again - it makes the most sense to fish where the fish are.

Well that's cool if you've installed SP2 already

[SuperKendall]

SP2 is a lot more secure. But even now lots of people are installing from copies of SP1. Yes Windows can be made secure, but it takes that little bit of extra effort - and if the firewall is ever compromised (like malware turning it off) you are quite screwed. OS X needs no firewall to stay quite happily connected without security issues because it does not ned any services running to function.

Which virus in the last five years targets data

[SuperKendall]

Viruses do not target data for destruction any longer. Data is only seen as a vector for further infection, or possibly information valuable to the attacker. But viruses simply don't destroy things anymore because using your computer as a zombie is far more valuable to them.

I can't wait for an OS X virus or...

[bob670]

spyware outbreak to show up so that...
1. Windows users can say "told ya' so"
2. Mac users will be, albeit breifly, completely silenced
3. People can start submitting new "Apple Death Knell" articles.

And who wants to use Symantec anyway

[JonahLee]

I mean I gave up on their Norton Products with OS X because all they did was screw up my computer. Then my .Mac account gave me Virex for free, but all it did was screw up my computer, so I decided to try clamAV and for a front end their is the excellent ClamXav which lets you schedule Virus scans and updates. And best of all it is shareware based on open sourced virus protection software.

I picked up about 12 PC viruses that I had, and could have sent to a PC user, though they don't affect me at all.

Plenty of Hate for Macs

[tomdoe]

It's a fact that Mac users recieve a disproportionate amount of hate from the nerd community for their supposed lack of computer savy.

I could be wrong but isn't it the mentality of hackers, malware writers, and delinguents in general to prey on the gullible and unsuspecting?

Especially the ones with those annoying white earbuds dangling from their ears brandishing their pretentious little white iBooks everywhere they go?

If I was a virus writer, I'd be malwaring all over thier obnoxious asses! Unless, of course, the OS was rock-solid in which case I'd probably move on, maybe write a MS address book exploit or something.

This is only OK under one circumstance...

[gt_swagger]

The malware has a slick looking, brushed gray metal GUI... and is clean, sipmle, effective, efficient, and beautiful.

Good going Symantec

[Porter Doran]

Now I'll be sure to keep NAV on all the Macs in my business, since Symantec has deliberately insulted Macs (only safe because of dumb luck) and Mac-users (only buy for style, not legitimate reasons). Symantec sure knows how to attract customers, I'll give them that.

code and data

[jesterzog]

no, not just the industry, but almost unique in post-1989 history itself -- in the careless way they treat data as code.

I don't disagree with you in general, but could you please clarify what you mean about this more specifically? I realise that separating data and code is a big security thing, but I'm not particularly a security enthusiast beyond what I need to know.

As far as I'm aware, any system that supports scripting languages, Linux included (consider the number of scripts in your typical /usr/bin directory that'll be executed as root one day) is treating code as data and data as code. Things that are definitely executables can easily be kept protected in memory by an operating system, but not everything's obviously an executable.

Is the main difference here just that most scripting interpreters don't offer default access to volatile things like pointers, that might let a script get direct memory access?

Re:As an IT person ... www.ARMY.mil uses mac

[flonker]

Really old post. A quick bit of googling reveals:

http://books.slashdot.org/comments.pl?sid=75257&ci d=6734660 from Aug 19, 2003
http://slashdot.org/comments.pl?sid=67477&cid=6188 308 from Jun 12, 2003
http://groups-beta.google.com/group/comp.sys.mac.a dvocacy/msg/7a80fe09794d6331 from Jan 12, 2003
http://slashdot.org/comments.pl?sid=45793&cid=4761 155 from Nov 26, 2002
http://slashdot.org/comments.pl?sid=37389&cid=4009 006 from Aug 4, 2002

And I seem to recall seeing it floating around long before then. If anyone knows of the original, please respond. Also, if the original troll could please fix the numbering? 4 isn't supposed to repeat again after 5 and before 7, I'd greatly appreciate it.

Mmmm... tentacles.

[Shag]

Let me just tweak com.lovecraft.fhtagn.cthulhu.plist real quick.

Ding ding ding!

[Colol]

Symantec has everything to gain by trying to drum up sales of Norton Antivirus for Macintosh -- Apple's got a distribution deal with McAfee for Virex (prior to which it was impossible to get a single-seat license for Virex), so they're potentially losing sales for every .Mac subscription that's purchased.

Convince people that the big bad monster is coming, and maybe they'll buy your product on top of it. Or maybe the users who have no interest in .Mac will pick up your product, since they can't get Virex separately. And at what Symantec is charging for their Mac version...

It's reminiscent of the hullabaloo surrounding the "trojan" advisory Intego issued for OS X a couple years ago, arguably only to punch up sales of their VirusBarrier product.

Windows software dying art?

[laird]

I started a company a few months ago that's building consumer software that runs on MacOS X and Windows (and Linux, etc., eventually). Our strategy is to build the core in tight C code, and then build platform-specific applications in the appropriate language, so the result is a great ObjC Mac app, a great C++ Windows app, etc. While I like Java, Ruby, etc., our goal is to make the app small and efficient, so asking people to install 30 MB runtimes is out. Interestingly, it was easy to recruit first-class Mac and Java (server) developers, and nearly impossible to recruit a really great Windows developer. It turns out that the best CS students are _all_ working in modern cross-platform environments (e.g. Java, Python, Ruby), most use Mac's, almost none are using C++, and nobody even _considers_ writing Windows applications any more. While this is kinda neat in one respect, it's a bit surreal that the vast majority of great developers won't write software that runs natively for the platform on 95% of desktops. Weird.

From a cracker's/hacker's perspective

[Orion Blastar]

if you were going to control someone's box, and you wanted to make sure that they have valuable information to steal. Would you target the PC user who bought the cheap PC, or the Mac User who paid more for his/her Mac? Chances are the Mac User has a much higher income, being in a creative content or some other weathier profession. The Mac User would typically own more credit cards with larger credit limits, and have more money in their bank accounts. Sure, anyone could write a Windows virus, even 13 year-old kids do it. The Switchback virus showed that OSX is vulnerable, and also that OSX virus writers have little to no competition.

Also chances are the PC User already has a virus scanner, and knows enough about his/her PC to protect it. The Mac User, on the other hand, thinks he/she is safe from viruses and does not even have a virus scanner installed. Usually the typical OSX user uses default OSX settings, thinking that they are good enough. The OSX user is also more likely to click on attachments than the Windows user in email, thinking that no file infection exploits exist for OSX. The OSX user is also more likely to use the default email and web programs that come with OSX, and the Windows user is switching to Opera, Firefox, Thunderbird, Eudora, after the ton of exploits that exist for IE and Outlook and Outlook Express.

Best tactic of a cracker/hacker is to hit someone who does not expect to be hit.

Infect the typical PC, and you are more likely to discover someone's porn collection. Infect the typical OSX and you are more likely to find Intellectual Property and other goodies. Therefore, should you go for the swampland (PC) or the gold mine (MAC)?

Built-in Security Helps (But Avoid Installers)

[Killer Eye]

Mac OS X will never be in as bad a position for malware as, say, Windows, because it is inherently harder to install unintended files on a system where multi-user is done right (as it is in Mac OS X). Not only does administrative privilege protect many things, but various network ports are closed by default, etc.

However, the Installer paradigm is still present on Mac OS X, for some software. Users should seriously question software that requires an installer with administrative privilege, as this is exactly the time a questionable file can be added to your system (and for that matter, gives software a free ticket to do certain other things).

I've sent a suggestion to Apple asking that it be more transparent what installers actually change in the system. I hope they take this seriously.

Slashdot user dspisak 'at risk from attack'

[dspisak]

Symantec has warned that as dspisak's Slashdot mind share increases his PC will start to come under increased attack from trolls

Security vendor Symantec is warning that dspisak's Slashdot posts are increasingly becoming a target for hackers and malware authors.

In its seventh bi-annual Slashdot Internet Security Threat Report, Symantec said over the past year, security researchers had discovered at least 37 serious typos and duplicate story submissions in dspisak's Slashdot useage. According to Symantec, as dspisak increases his mind share -- with new low content posts such as the Comment mini -- his fanbase is likely to come under increasing attack.

"Contrary to popular belief, the Slashdot discussion forums have not always been a safe haven from poor spelling and grammar," Symantec said. "Out of the public eye for some time, it is now clear that dspisak is increasingly becoming a target for the malicious activity that is more commonly associated with Jon Katz and various Slashdot editors like timothy," the report said.

"dspisak has become a target for new attacks... The appearance of a -1 Troll rating for a post called "Boo-Fuching-Hoo" in October 2004, serves to illustrate the growth in vulnerability research in dspisak's comments... The various dspisak comment vulnerabilities allow attackers to carry out information disclosure, punctuation bypass, troll execution, comment escalation, and IQ attacks. Symantec believes that as the popularity of dspisak's new paradigm continues to grow, so too will the number of attacks directed at it," the report said.

Symantec's concerns were echoed by James Turner, security analyst at Frost & Sullivan Australia, who said many of the people who read dspisak comments were not concerned about factual correctness, which left them wide open to attack.

"The duplicate story submissions, funny in-joke humor and mini Comments are cool creations," Turner said. "The by-product is that people are agreeing with these comments for style over actual usefulness. They say it looks pretty and then read it but don't fact-check it. As dspisak increases his mind share, he will be a legitimate target for the Secret Service".

Trend Micro senior systems engineer Adam Biviano said all complex comments had grammatical flaws and the more popular the person, the more likely he would be attacked.

"All sophisticated comments -- dspisak, bperens, goatse or anything else -- especially Natalie Portmans hot grits will have vulnerabilities," Biviano said. "The only reason goatse has had mass exploits written for it is the sheer number of connected people reading it that are present on most networks. As soon as you start seeing mass deployment of any comment mind share you are going to see exploits".

According to Biviano, while there have not been any mass outbreaks of viruses targeting dspisak, the potential does exist.

"You don't see dspisak trolls in mass outbreaks but you do see them in the labs as proof of concepts. There aren't any outbreaks because there are simply are not enough [dspisaks] out there. For a troll to be successful it needs a combination of a worthy jab and a large target audience," said Biviano, who nominated the mobile phone market as an example of malware writers targeting the comment, not goatse's mind share.

"Look at where mobile comments are going and they are not targeting goatse -- they are targeting the market leader, which is cmdrtaco," he said. The Symantec report found in the second half of last year, an increasing proportion of malware was designed to expose spelling errors. The report also found that phishing attacks increased by 366 percent while the number of goatse-based worms and viruses increased by 64 percent, when compared to the first half of 2004.

I should write a virus scanner for Mac OS X

[Laconian]

1. Write a Cocoa app that makes a progress bar that fills to 100% and says "No viruses found!"
2. ... (spread FUD)
3. Profit!

Anti-virus software harmful to Macs

[sjonke]

Until one of these anti-virus software vendors can prove that their software is less harmful to Macs than the alleged/pending viruses, I'll continue to leave Virex 7.2 installed just to make the admin's happy, but sure as hell won't upgrade (again) to version 7.5.x, which causes innumerable and far-reaching problems. It has always been the case and continues to be the case, that on Macs, virus protection software is far more harmful than the alleged viruses they allegedly protect against.

hogwash

[Anonymous Coward]

Look, I'll make this short: I'm a non-grunt Symantec employee. NAV is crap, and I can't figure out what NAV on OSX is actually looking for. It's just scare-ware. We're dealers to people with a predisposition for addiction, and your discounted copy of NAV is a dime-bag.

Imagine that Windows is a house with the roof shingles installed upside down creating pockets for rain, and UN*X including OSX has a properly-installed roof. NAV is a subscription service for a new bucket of Henry's roof patch every week. (SP2 is a nice tarp in this analogy, but it's still just a mask for terrible security arcitecture.) On windows, the "roof patching" quickly becomes the main activity of the system. On OSX, not so much. The threats/vulns just arent there (yet), and the underlying architecture is basically sound. NAV-OSX just wastes cycles IMHO. Shit, a tripwire-for-dummies install would be a lot more useful.

Personal note: I'm provided a fully-Symanticised WinXP system to use for corporate email etc. And when I'm out of the office, I have to use Symantec's own amaturish VPN to connect to Notes ( of all godforsaken things...) sorry guys, four passwords to get into the main information repository of the company is four iterations of a single factor... This really shows how little Symantec collectively understands information security (as opposed to system security).

Yeah, I use a mac for personal stuff, and run my production (non-day-job) systems on Linux. Working for Symantec has taught me that the solution to endless repairs on a broken system is to get another system.