Slashdot Mirror
Mac users 'too smug' Over Security?
wild_berry writes "Bill Thompson, one of the BBC's technology commentators and presenter of Go Digital on the BBC World Service, expresses his concerns that Mac users assume their safety in the face of trojans, worms, keyloggers and other malware. As a Mac user he is most concerned about the lack of herd immunity that is needed to stop a few infections becoming an epidemic, fully explained in his column week for the BBC technology site. Is he right, and what actual products exist for OS X that would protect against infections?"
This article was dead on.
My first ever encounter with this mentality was in high school when my music theory instructor told us that she loved her Mac and when I tried to argue with her about a number of things, she'd repeatedly reply with "No Mac has ever been hacked or had a virus on it."
Now, at the time, I was a young nooblet and probably should have let it slide but instead I snuck into her office and opened up her Macintosh's word editing software with the intent of some lil' bastardry. I found the option to replace a mistyped word with another that the user entered. After that, whenever she typed the word "the", it was replaced with "WARNING! VIRUS DETECTED! PULL PLUG FROM OUTLET AS SOON AS POSSIBLE!" Unfortunately, her son knew enough about computer to fix it so my fun didn't last very long (only one or two lunges at the wall).
Back to the issue--I think it is a grave mistake for anyone to ever feel 100% invulnerable when it comes to computers that are connected to the internet in anyway. I would diagnose this as a standard case of a false sense of security. This is something that has plagued many people throughout history and often led to their downfalls.
What message am I trying to get across to Mac users? First, realize you're not invulnerable. Second, just browse around and look at what's out there for you to use as anti-virus and virus blocking tools. And if you don't want to, read some horror stories, perhaps that will motivate you to become aware of possible worms in your Apple.
My work here is dung.
Mac users are too smug about... everything ;]
That's Mac OS X.
There's no substituting an OS that doesn't let the average user have administrator rights all the time.
The windows users state that they don't need to run as administrator, but then ask them what hurdles they have to go through to make their software "just work".
Help! I'm a slashdot refugee.
there are numerous anti virus programs out there for the Mac, but what virus are they scanning for? There are no known viruses for OS X, so how can they update the virus definitions if they have nothing to base it on? They've seen a vulnerability here and there, but nothing has been exploited yet. So it's like the chicken and the egg. you need an AV program to protect yourself from viruses, but you need a virus for the program to detect.
The day i see a virus on OS X is the day I buy an AV program.
A platform which doesn't have Active-X, doesn't have services running out of the box, doesnt' have autorun for CDs with Sony Malware, and doesn't have an unfortunate legacy meaning almost all apps require continual admin access, is more secure in my book. There's a couple of operating systems that fit the bill, one of which you seem to hate : )
Having no known viruses at this point is an extra bonus.
Not immune of course, but then I don't hear many people claim that, in fact, I've never heard anyone say that, just heard it repeated as a truism (Mac users think this) on websites.
It's just a shame that for them to be proven wrong, a lot of people and their PC's have to get hurt
A lot of people and their PCs get hurt continually at present, but they come back for more and keep running the same broken system.
Just to name some of the obvious... OS X can't use ActiveX, it's actually useful when you run a non-administrator account, it doesn't come with Swiss-cheese services enabled by default, it doesn't automatically trust machines on its own subnet, and there's no real equivalent on it to VB scripting.
With that in mind, I absolutely agree that Mac users are too smug and that a dedicated malware author could bring many of us to our knees. (Hell, I run as administrator just to save time, despite knowing the risks. It's a gamble, although I keep good backups.) But an OS X (or Linux) malware author would have to be much more skilled than most Windows-targeting skript kiddies to do a lot of damage.
In today's real world, if you run a Mac (or Linux), you're going to suffer far less than your average Windows user. If you use an out-of-the-box Mac to do typical home-user tasks, which probably include visiting shady corners of the Internet, you won't have the spyware infestations you would with an out-of-the-box Windows box. And most of the routine worms out there have no effect on a Mac.
So, is there a profile of a Mac virus writer???
Judging by the amount of viruses out for Mac OS X he's one lazy fucker.
Is he right, and what actual products exist for OS X that would protect against infections?
Today, wild_berry was the billionth story submitter to place an annoying question at the end of his submission. Despite the pleas of nearly a million Slashdot users, wild_berry took part in the timeless tradition of Kindergarten Teachers and Coffee Talkers everywhere, and gave us a topic to discuss amongst ourselves.
What about YOU, what is your opinion of annoying questions at the end of postings? What do YOU think about them? Do YOU have any solutions to the problem?
I don't know who the guy is, but the article is completely useless. There are absolutely no hard facts in there. Please point us to ONE SINGLE virus, keylogger, adware, or any type of malware at all before making ridiculous claims like the old and completely bogus "it's just because of low market share". It's just not true. I haven't come across anything dodgy so far and I've _actively_ looked for it. Nothing except some shell-script with a highly hypothetical threat. Also, keep in mind that OS X users tend to get a large percentage of their software from centralized sources like apple.com and VersionTracker, which wouldn't post or quickly pull any infected software. IF there was any kind of outbreak, it would be all over the Mac-web within an hour at the maximum.
I will be adding some extra security to the system. But the average user cannot do what I will be doing.
Why don't you enlighten us oh gifted one?
- Sighuh?
You can keep waiting for the Mac folks to be proven wrong, but chances are good that you'll be waiting a long time. You see, just like biological viruses computer viruses need two things before they will take off. The first thing that they need is an exploitable weakness. The Mac has enough of those that a worm is certainly possible. The second thing that you need is a large enough body of susceptible hosts that the worm can spread. Macs *don't* have that. Without a large body of susceptible hosts the entire population is safe. That's why it doesn't matter that my neighbors don't immunize their children. The fact that their children are susceptible to immunizable diseases doesn't really matter because there aren't enough luddites to create a viable population of carriers.
Interestingly enough, most of the same effects can be had simply by not using Outlook and IE on Windows as these two programs are the main vectors for infection.
You're not vulnerable if you're not a target. Macs are not targets. And I fix all computers, Windows, Linux, Macs. Mac people are no more or less smug than those other users. Most Windows people don't have a clue about firewalls, virii, trojans, or worms fyi. Computer users are all the same. They just want something that works. BTW I haven't had to remove a virus, trojan, or a worm from a Mac yet. I've done that for Windows machines all the time and make good money doing it. You do the math.
IIRC, Word macro viruses on a Mac tend not to be nearly as damaging as their Windows counterparts (less ties into the system and other Office apps, etc). However, the big problem is that Word for Mac acts as a vector of transmission. Word docs that contain macro viruses that don't affect the Mac in any way can wreak havoc as soon as they're opened on a Windows machine (assuming someone clicks the 'run macros' button on opening the file).
This guy's the limit!
> So again how is it a safer OS if these exploits existed in the first place? Go stick you head in the sand until the great Mac worm hits that erases everyone's OSX drives. Then maybe people will realize that NO Operating System is completely safe. PERIOD.
If you look at the OS X `exploits' (quotes because that's not what they are), most of them are holes in software that doesn't even run by default. Are you using Apache 2 (not 1.3) on your desktop? If so, the security update will prevent a malicious trusted (!) proxy server from crashing one thread of your Apache instance.
If you're using Windows, you need the security update to prevent the web browser from downloading an image that puts a rootkit on your machine.
It's all about severity, and OS X's "holes" just aren't that bad. However, MS consistently manages to provide a multitude of auto-infection routes to virus writers.
My other car is first.
A couple of men went camping. They camped at a remote site, new to them, where they didn't really know everyone else who was camping there. After setting up, one of the men put a little, teeny tiny lock on their tent flap door. His friend looked at the flimsy lock and remarked, "That lock is nowhere near good enough to keep out anyone who might want to get into your tent! Why, I bet I could get through that lock in less than a minute.". The first man replied, "The lock doesn't need to be the best lock in the world; it just needs to be better than that guy's" -- and he pointed to the tent next door, without a lock at all.
The point being, surely Mac OS X is not the end-all and be-all of security, but Apple has by all accounts gotten increasingly serious about security as Mac OS X has matured. It's not ever going to be possible to have a 100% perfect level of security, but as long as it's better than that guy's (points to Redmond, WA), in most people's minds it'll be the most secure commercial OS on the market. ~jeff
Because most weren't critical vulnerabilities and there are no exploits. Show me an exploit for a Mac OS X vulnerability. Now, show me one in the wild. Can't? The only thing you have to do to wipe the smug look of a Mac users face is to release an exploit in to the wild. Go ahead. What are you waiting for?
If just one person who thinks Macs are just as vulnerable as PCs would just write a worm/trojan/virus, we could end these f*@&!#g trolls and all agree that security is hard. Really, please, someone write an OS X exploit and spread it. Make it benign if you're uncomfortable with writing viruses. Just get something out there.
I'd like to see it just so people will stop using the lame "there are more Windows PCs" arguments. I'm sorry but this whole issue has gotten so blown out of proportion that the first person to show a really bad Mac vulnerability with an exploit would be on every geek blog and quite possible the NYT. You'd be f*@&!#g famous.
The rest of your regime is foolish. Virus and anti-spyware software on the Mac is a case of the problem being worse than the cure. Several of the anti-virus software packages for the Mac actually make your machine less secure. You're not just wasting your time and processor cycles, you are actually making yourself more vulnerable.
Use a firewall, backup regularly, and don't open executables from untrusted sources. That's my whole regime. Perhaps Mac users are a little smug, but hey... this article is six years old and we're STILL considerably safer than our Windows counterparts. Perhaps we deserve to be a little smug.
No amount of software can replace common sense, and common sense never let a virus onto somebody's computer (unlike certain anti-virus software).
There's no substituting an OS that doesn't let the average user have administrator rights all the time
Yes, because as we all know the really valuable data on the computer is the OS and installed programs. You know, the stuff that can be replaced in a few hours.
All that user data that's completely and utterly irreplacable? Worthless. Who cares if a virus or trojan destroys it? And it obviously doesn't matter if a keylogger running in userspace sniffs out all your bank passwords and sends them to a 3rd party (what, you don't need admin privs to open a socket?!?!), because, hey, the OS itself is still secure!
The amount of real damage that a virus, worm, or trojan can do is not substantially affected by whether or not it can get administrator privledges. It may be easier to remove, but that's about it. And, frankly, if your average user runs in a lower privledged account then they're likely to get used to typing in the admin password when prompted, without even thinking about it.
And that's what it ultimately boils down to -- the user. Clueless users will get hit by crap all the time regardless of the platform. Clued users will not, again regardless of the platform. I've been using PCs for over 20 years now, most of that time on DOS or Windows (although I've also used OS/2, Linux, FreeBSD, Solaris, and several others) and I've been hit with a virus exactly once -- and that was about 18 years ago. It infected very little too, because I was running a virus scanner that caught it quickly (back in the days when McAfee was free(ish) for personal use). Nor have I ever had to remove spyware, malware, etc. on any of my personal or work systems.
OS X has a rather high percentage of non-technical users, just as Windows does. Do you really think that they're immune to doing stupid things?
Insightful? who mod'ed this?
;-)
one of the rules of security is "don't make it easy and obvious" -- OS X does that, Windows doesn't. Windows is the "honey pot" for the world. With all the unsecure machines any script kit can bust it. OS X would take some real work, so the hackers go elsewhere.
another rule: layered defense -- OS X does it, Windows doesn't. With Windows, break into an app or file and you are at the OS core -- see WMF.
It is not about market share, it is about market share of *unsecure* machines. The Windows "not secure" architecture and legacy will haunt it for years to come. If OS X gets 50% market share, those remaining Windows machines will still be just as unsecure and will still get just as hammered by malware, etc. It doesn't follow that overall malware will equally affect OS X.
Try this analogy: there were more robberies of homes than banks....and it ain't because there are so many more homes. Banks are just more difficult to rob, risks are greater and penalties greater. OS X is the bank -- it can be robbed, but I don't spend my time worrying about it. My home, on the other hand, has "windows" -- and I worry about that a lot!
Two observations:
a) do a market share observation of security folks and technical folks at generic computer conferences: the market share of OS X is more like 30-40% for people in the know.
b) as much "negative reaction" as folks have to Steve Jobs and Apple, if someone could write a virus, etc. for OS X, they would have done so by now, just to throw it in his face and make headlines across the tech world. I am still waiting.
Why don't you enlighten us oh gifted one?
I imagine he's using Mac user standard precautions; place router inside wall safe, wrapped in tinfoil, and smothered with secret sauce. Nothin' beats that. We've been discussing it on the official Apple Fanboy List and have deemed this to be the best approach.
(Also we use characters like ü, ç, (TM) and © in our passwords which are nearly impossible to type in Windows.)
If Jesus wants me it knows where to find me.
Name one.
C'mon. You just spent a lot of time telling us that there are a lot of viruses out there for OS X and that we should just research it. Well, I'm sure you've researched it, so enlighten us, please. Name one.
Oh, I know about the "opener" trojan. A shell script that never went anywhere. BTW here is a much more destructive "Mac OS X trojan" called "runme.sh" that also affects Linux and Unix! Oh my. Here it is, read with caution:
The only viruses I've seen on macs are word macro viruses - namely Claude.ASo, oh wise one, educate me and the rest of use please. I am aware that there are security weaknesses which could be expoited. But so far, none have. I agree, that we have to be vigilant, but for now, you are just talking out of your ass.
"terrorism" and "pedophilia" are the root passwords to the Constitution