Slashdot Mirror
Computer 'Worms' Turn on Macs
Carl Bialik from WSJ writes "Macs have been laregly immune to the viruses, worms and malware that have plagued PCs, but the Mac's recent popularity uptick has meant that 'bad guys appear to be casing the joint,' the Wall Street Journal reports. Among the signs: two recently discovered worms and the discovery of a vulnerability in Mac OS X that leaves Safari open to a hack. A Symantec engineer predicts a 'gradual erosion' of the idea that Macs are a safer operating system than Windows. 'Some security experts believe hackers are becoming more interested in writing nasty code for Macs precisely because of reports of its relative immunity to security woes,' the WSJ reports. 'Apple itself has gone out of its way not to promote the Mac's relative safety, lest it tempt hackers to prove the company wrong. Apple declined to discuss the topic of security in depth for this article.'"
A Symantec engineer predicts a 'gradual erosion' of the idea that Macs are a safer operating system than Windows.
Now there's a neutral party with no agenda when it comes to security!
Honestly, the worst Mac malware I've seen so far had a Symantec sticker on the box.
Fleur de Sel
seriously if you have to manually download the program and enter your admin password, it is not a virus or a worm. I dont know why people keep calling it that. It is a Trojan and those have existed since the first rm -rf / script.
The war with islam is a war on the beast
The war on terror is a war for peace
Windows has had what, like 200,000 Virus's in the last year? Apple has had two or three theoretical exploits that either require the user to run code by hand or else target services that most mac users don't turn on. Sounds like Apple is doing its job to me. And honestly this idea that as Apple gets more popular there will be more viruses is largely a load of crap. The notoriety of writing the first real virus for OS X would be vastly more than for writing yet another windows virus. The reason why no one writes viruses for Apple is most likely because people like Apple and want them to succeed. I think if people start writing viruses for Apple it will be because Apple gets lazy and stops innovating, or else stops at least trying to fix the bugs in its software. Because right now both the means and the motive or there, but it's just not really happening.
but don't think that running an "obscure" OS makes you safe
*sigh* We don't. We think running an operating system with proper security makes us safe.
"The dew has clearly fallen with a particularly sickening thud this morning"
It's never been that (at least for most people). The advantage of Mac OS X is that it is less vulnerable than Windows (making Windows an easier target), and that Apple made decisions in the design process that mean that the typical consequences of a flaw are less severe. In recent years, Microsoft has attempted to harden Windows further and reduce their exposure - in W2K3 Server, for instance, they've done a pretty good job of it.
Even if Apple magically pulls some sort of super OS-jujitsu that reverses their market share and Microsoft's, the basic architecture will stay the same underneath - and that means Apple will have their relative advantages intact for the foreseeable future. Windows is, as its heart, an OS that has traded off many security options for ease of access and ease of programming. Apple had the advantage of seeing what was already happening to Windows when they made their decisions about how OS X would be designed, plus the system it was derived from was pretty robust to begin with.
There will be viruses that attack Mac OS X. Some will do a pretty good job of attacking. I'm kind of surprised it's taken this long to get there. But I'm also not expecting it ever to compare to Windows in that regard.
-- Josh Turiel
"2. Do not eat iPod Shuffle."
From the linked article:
The reason why no one writes viruses for Apple is most likely because people like Apple and want them to succeed.
Considering that the main incentive for virus writers these days seems to be economic (profitable criminal activity such as spamming, phishing, DDOS blackmail, identity fraud), it seems unlikely to me that these criminals care if Apple succeeds. More likely, the profit motive isn't there, probably a result the combination of greater security on OSX, and smaller installed base.
The only supporting argument for this oft-repeated fallacy is that Windows has the biggest market share and the biggest number of security holes.
Far be it for me to shatter your little bubble, but Apache Web Server is more popular than IIS, and has significantly less critical exploits.
God, it feels like Karma whoring just pointing out something so bloody obvious.
"The dew has clearly fallen with a particularly sickening thud this morning"
Agreed: If you want Mac malware, you have to go to a store and buy it.
It's completely unacceptable that Slashdot editors would post this garbage. From the referenced article:
"In the past two weeks, information-security companies like Symantec Inc., Sophos PLC and McAfee Inc. have identified several security issues related to the latest version of Apple's Mac operating system, called OS X. Among the concerns: two "worms," programs written by unknown hackers that were designed to spread themselves to other Macs through Apple's iChat instant-messaging software and Bluetooth wireless-communications capability."
Translation: Some public relations drone, with no technical knowledge, paid the Wall Street Journal to post the article. The Wall Street Journal is a "What the rich want you to think" publication, and, in my experience, usually unreliable for anything useful. Note that the article jumps from subject to subject rapidly, apparently to hide the fact that there are no actual incidents of Mac infections to report.
Another translation: Symantec, a maker of very buggy security software of poor design, and other "security" companies want Mac users to buy their products.
Some people, in my opinion, spend their entire working lives being dishonest, trying to trick other people. In my experience some of them work for WSJ.
-
Cheney's company is rapidly building prisons for the U.S. government.
Now is it right for me to say that my linux computers are more secure just because they are running linux? No, that's stupid.
Why is that stupid? There are real architectural, operational, testing, and implementation differences between Windows and Linux. Obviously one of them is more secure and less likely to be compromised than the other. There is nothing stupid about looking at those differences and at the track record of both OS's and making predictions and making usage decisions based upon that information. "They're all the same," is the argument of a lazy man or someone trying to justify a bad choice by trying to make all choices look equally bad.
The same thing applies with this story - Macs can be exploited because that is the nature of the business. We usually find the holes because some numbnut exploits it.
No one is arguing that Macs can't be exploited. They certainly can be and are. We do not, however, find most exploitable holes by seeing exploits in the wild. The majority of holes are discovered by developers coding the products. The next largest chunk are found by users and legitimate security researchers. Then a few are found when they are exploited in the wild by hackers. How many zero day exploits have their been for Linux or OS X? The answer is very, very few if any. There have been some for Windows, but most of the underlying vulnerabilities were probably discovered by MS, but they just did not get around to fixing them.
Sure there will be exploits and even zero-day exploits for OS X, but they are just not likely to spread widely or be much of a problem for the average user. If they are a large threat they will be well-known and quickly fixed. A major worm for OS X would be news and it would be unusual. For Windows it is business as usual.
But don't assume that just because no one has broken into your house yet that your house is completely secure.
This is a very good analogy. My house is concrete block and was built with only glass block windows on the first floor. Actually the block is two thick on the first floor. Before I bought it, someone had wired a security system and outdoor flood lights. A few months back someone busted into my shed, but ran off without getting anything. The items in my shed are relatively large an not all that valuable.
I'd say that is a good analogy for OS X. It is built with security in mind on well tested, industrial grade framework. They have added onto it and made it more secure in some ways and less secure in others, but it will likely never be as insecure as the neighbor's ranch style place with two plate glass doors and a key under the mat that you see the kids get out every day.
OS X had someone break into the shed (try to distribute a trojan) but nothing has been taken. It is a good sign that maybe Apple and OS X users should be paying attention and maybe doing some more security reviews, but it is in no way comparable to the apartment complex down the street that have been burgled at least once a month for several years and where we always hear about people getting shot.