Computer 'Worms' Turn on Macs

Carl Bialik from WSJ writes "Macs have been laregly immune to the viruses, worms and malware that have plagued PCs, but the Mac's recent popularity uptick has meant that 'bad guys appear to be casing the joint,' the Wall Street Journal reports. Among the signs: two recently discovered worms and the discovery of a vulnerability in Mac OS X that leaves Safari open to a hack. A Symantec engineer predicts a 'gradual erosion' of the idea that Macs are a safer operating system than Windows. 'Some security experts believe hackers are becoming more interested in writing nasty code for Macs precisely because of reports of its relative immunity to security woes,' the WSJ reports. 'Apple itself has gone out of its way not to promote the Mac's relative safety, lest it tempt hackers to prove the company wrong. Apple declined to discuss the topic of security in depth for this article.'"

Comments

not a worm or a virus!

[minus_273]

seriously if you have to manually download the program and enter your admin password, it is not a virus or a worm. I dont know why people keep calling it that. It is a Trojan and those have existed since the first rm -rf / script.

Man bites dog journalism

[plopez]

Typical 'man bites dog' approach. If it is unusual, it is news. Microsoft Windows is a bug ridden unsecure OS, but since everyone (or at least 90% of users) use it it is not news. No one questions why a defective product exists or what it is actually costing in lost productivity. It is normal in most users' worlds, those users who never have experienced anything else.

OS X exploits are news only because they are unusual (though it does serve as an early warning, I sincerely hope Apple is busy auditing their code base). The fact that they are not as severe as Windows exploits, requires more user intervention and are often limited in scope are not discussed or probably understood by most people.

Re:Symantec?

[John Newman]

Unlike Windows, it's perfectly safe to run full-time as the "Administrator" user, and nearly every OS X user does.

It's mostly safe, not perfectly safe. The iChat virus/trojan suggests one reason why. Since an admin has free access to /Applications, a bug running under that user's permissions can modify apps in that folder, helping the bug to spread itself either locally (next time another user on the machine opens an infected app) or remotely (e.g. via a modified iChat). A second reason is that admin users can sudo with their own password. If the admin account's password is compromised by a bug or hacker, root control of the machine goes with it. This is not the same as running as root, like Windows admins do, and viruses running under the admin user's permissions do not have root access. A regular user must enter an admin's username/password to sudo, making the virus/hacker's job more complicated.

Nearly ever OS X user on a single-person machine runs as admin, and that's what Apple sets up by default. But it's not a bad idea to reocnsider.