Slashdot Mirror
Macs May No Longer Be Immune to Viruses
Bill writes "MSNBC reports that the combination of Apple's growing market share and their recent switch to x86 processors has made Mac OS X a new target for viruses. Unfortunately, it seems that many Mac users are in denial. '[Computer security expert Tom] Ferris said he warned Apple of the vulnerabilities in January and February and that the company has yet to patch the holes, prompting him to compare the Cupertino-based computer maker to Microsoft three years ago, when the world's largest software company was criticized for being slow to respond to weaknesses in its products.'"
One might wonder why this (non-)story is featured on the front page of MSNBC... ;-)
:%s/Open Source/Free Software/g
YTARY!
However, what sounds most MS-like was this:Thanks Natalie, we'll take your word on it.
There are shills on slashdot. Apparently, I'm one of them.
They never were immune. It's just that most virus writers don't give a crap about Macs.
Maybe we'll be seeing x86 and PPC virus fat binaries?
Never underestimate the power of stupid people in large groups.
What a load of rubbish - viruses infect via operating system and application vulnerabilities, the chipset those are running on has very little relevance.
I'm not even a Mac user and I still call FUD on this one. TFA was so slim on detail it was impossible to work out what had actually happened, and after searching for real info it turns out the virus, Leap.A, needs a root password to do any damage. Better article here: http://edition.cnn.com/2006/TECH/04/30/apple.secur ity.ap/index.html
"I've got more toys than Teruhisa Kitahara."
They have just been less targeted.
I cannot see the change to x86 having a significant impact on this situation. An increase in popularity, however, certainly will.
Why does Slashdot continue to post Apple-related non-stories? Every time Steve Jobs farts or some idiot proclaims the coming Mac-Virus-Mayhem (tm), Slashdot takes the bait.
This MSNBC(!) story contains no facts whatsoever. No piece of significant OS X malware has been discovered so far, and I believe it's highly likely that there won't be any in the immediate future. WTF does the Intel switch have to do with that?
The funny part is what x86 would have to do with it? The x86 ABI of Mac OS X (which is SYSV like) preclude the usage of ordinary Windows tools, and getting a OSX/x86 targeting toolchain based on GCC is (slightly) harder than getting a PPC one has been.
Sensasionalist piece. Hanging is too good for them
Anyone knows you don't get something for nothing.
Viruses for all different operating systems exist.
There are holes and exploits for practically everything known to man.
Now, if I walk into the dodgiest parts of town (with my turtle neck sweater on) and ask the shady guy at the street corner for a forbidden secret preview of the next big thing do you really think I will survive with the same number (and size) orifices as I started with?
Once you leave the beaten track, you cannot be sure what lurks in the shadows.
liqbase
CNN is carrying this article and so is msnbc, however no one mentioned the viruses name. I swear this is old, it sounds like the OSX/Leap-A incident that occurred back in early February. It wasn't even a virus is was a trojan horse. Apple will patch for this like they did the others and life will go one. At least Apple patchs for these unlike Microsoft that just recommends installing its "beta" program to "fix" the problem or some other 3rd-party software that may or may not cost even more money.
Steve Jobs farted? I'll get the gas capture bags! We can sell it as a perfume for Mac addicts!
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla
If your new powerbook is running BootCamp and your currently using XP then you need to lower your expectations, its a Mac, its running a flawed OS, so unless your careful you are going to end up with a virus, just like the other X Million windows users, regardless of hardware.
If your running OS X then I'd say your risk is just that bit lower, its a less flawed OS. My last check showed 4 viruses aimed at OS X; (Symantec) OSX.Leap.A; OSX.Inqtana.A; OSX.Inqtana.B; MacOS.MW2004.Trojan; Which is a few orders of magnitude less than for Windows XP (Nevermind all the other versions).
Sure the OS X on intel has shown a few flaws and sure some of them will be exploited but its a world away from the threat to a Windows Machine. I dont think that there is an OS out there in common usage that isnt succeptable to infection, its all about how prevelent the threat is.
Take your chances and see where it leaves you.
No-one can deny that with growing popularity of OS X that it becomes an increasingly attractive target. Malware writing works on similar economics to regular software: this implies that malware will exist but be a niche deployment. So it is a concern, but not the end of the world, or of Apple, as the world likes to regularly predict.
/less/ vulnerable than the mainstream desktop OS. The thesis that using an intel processor increases security risks is not true - OSen don't allow direct hardware access as such, and how many script kiddies write x86 microcode?. Running Windows on a IntelMac may potentially increase security probems, and reduce the Macintosh (not OS X) brand reputation for security. It depends on how the 'wall' between x86 file access and OSX file access is implemented.
The article was mixed in accuracy. Many Mac users believe themselves to be invulnerable - the truth is they are currently
Nothing in IT or anywhere else is 100%. Currently OS X is more secure in many areas than its competitors. To maintain or improve on this, constant vigilence and innovation are required by Apple, ISVs and most importantly users.
I wonder what percentage of some anti-virus software company's profits are a direct result of this article.
I'm in denial about invisible pink unicorns too. Put up or shut-up.
Direct away from face when opening.
Don't worry there isn't a virus. The article says there will be one because apple switched to intel. That makes sense right?
BTW. RE your sig. I think it's amusing to quote from religious texts. My favorite is where the bible says to kill adulterers, homosexuals, people who have sex with their daughter in laws (and their daughter in law), all three people in a manage a trois if the manage trois involves a daughter and a mother, and of course all parties in any kind of beastality.
That last one kind of makes me mad though. I mean if you want to off some homosexuals fine but why punish the poor animal just because some pervert molested it?
evil is as evil does
The Year of the Linux Desktop
or
The Year of The OS X Viruses
Inquiring minds want to know.
I gots ta ding a ding dang my dang a long ling long
The only saving grace for Apple/Steve Jobs is that even if he (if given the chance) would do exactly the same as MS/Bill Gates is that he can't and just by being there puts a tiny brake on the MS Juggernaut.
But make no mistake. If positions were reversed in terms of sales then MS would be just as an important a brake. Perhaps even more important.
Think about this. How many of you believe that is the media part of Sony that has been crippling the company by insisting on DRM that hardware consumers don't want?
Right, so now exactly how do you think Steve "Disney" Jobs would be on the subject of DRM if he had MS like control off the desktop.
A lot of people argue that iTunes limited DRM was the maximum he could get away with in his negotiotations with the record labels. This is true. The records labels are insane and would have chosen DRM that would be unaccaptable to the consumer.
Steve Jobs isn't insane but I am convinced that the Limited DRM for iTunes is also what he thinks is the maximum he could get away with.
Put more simply, I don't he was trying to get the least drm. I think he was trying to get the maximum DRM he could get consumers to swallow and then convince the record labels (who wanted even more) that it was this or nothing.
If you look at other parts of Apples business practices you really don't get the idea they are the mythical good guy. There support sucks, their warrenties got more loopholes then US wiretapping laws and they are as sue happy as the RIAA.
Just that Apple is for now to small to really make an impact. Doesn't mean that they don't want too.
So I am not at all suprised that Apple sounds exactly the same when it comes to dealing with flaws in their products wich leave their customers vulnerable.
Business as usual. Everybody does it. Only opensource can afford to say "oops, yeah that is a HUGE risk we are going to patch it right now so every single one of our users needs to get of their ass now".
Opensource does indeed patch much faster BUT it is a lot more work and worry for the user.
What sells better. You car manufacturer pulling you over with flashing lights to impound your car to have your brakes fixed OR having it quietly fixed when you next bring it in for service. WRONG. Don't fix it all, just settle with the dozen or so families of the person killed in the crash. That is good business.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
This is completely off-topic so will doubtless be modded as such. You will actually find that the lines: "And magnify Mohammed and his followers as thou didst magnify Abraham and his followers..." "And bless Mohammed and his followers as thou didst bless Abraham and his followers..." are recited (at least) thirteen times _per day_ in the compulsory Muslim five daily prayers. Now what use would these lines be if you didn't know whom Abraham or his followers were? The key is context, in order to find out what those lines are teaching, you have to go and do a little bit of historical homework on Abraham and why he was such a good pal of God's, to the extent that people living thousands of years after Abraham are still being taught to behave like him and his congregation. Similarly, for the verses mentioned above, context is needed otherwise the lines can easily appear to be contradictory. The verse about not taking Jews and Christians as friends is very often misused by Muslims and non-Muslims alike. But the actual historical reference (remember, that histroy homework again is needed), actually refers to when the northern Arabian tribes were becoming politically unified through their common adherence to Islam. Just as the Vatican or Israel would hardly trust its affairs to, eg, Iran or Saudi Arabia, and not necessarily because of antagonism but merely due to sensible political considerations, the same was true at the time for the fledgling Arab-Muslim state. Political Islam, or indeed Christianity or Judaism, is somewhat divorced from how you should treat your neighbour: it is how one nation should treat another. The verse about taking Christians as friends is the non-political way in which Man should deal with his brethren in the world, holding up the pious Christians of the time as an example to be followed. One can therefore easily ascertain how consistency is not lacking between the two verses, merely that people do not do their homework.
Even an Associated Press article, it makes you wonder what gains Microsoft would possibly have for putting it on the front door of MSNBC.
I mean with Vista being such a slam-dunk, why would they need to engage in FUD?
Granted - Apple has warnings of running windows on their boot-camp page and what fun awaits the end user so the reported denial is obviously massive from Cuppertino and that would create a massive pile of denial from the Apple-user community no doubt.
God bless the press for keeping everyone informed of the latest threat to Mac OSX users, and to the homeland security department for keeping those colors coming. I guess I'll have to keep vigilant - albiet productive - while my neighbors reinstall windows every couple of months from all the malware slowdowns. Also special thanks for the heads-up Semantech, you're doing a great job keeping the windows world safe for NT users. Your service is no-doubt going to be needed on the Mac and boy will we be thankful.
Just about the time hell freezes over.
Were exactly did you read this in the bible? In no place does it say kill this or that.
So when they continued asking him he lifted up himself and said unto them He that is without sin among you let him first cast a stone at her -John 8:7
The bible is quite tolorent of sinners, while at the same time it is quite clear on what is defined as a sin. I understand your POV when targetted at religeous zealots, but the book itself very tolorable of sinners...
Do not judge, or you too will be judged. For in the same way you judge others, you will be judged, and with the measure you use, it will be measured to you. -Matthew 7:1
That one was for the hypocrits. Picking on other's sins while they resemble a grave. Clean on the outside, but rotten and smelly on the inside...
MSNBC is a Microsoft shill. They're also the ones that started the completely lie that Linux would be just as plagued by viruses as Windows is, if it ever became as widely used. This has no foundation in reality, and belies the fact that Windows is constantly adding unix-like security features, just to try to catch up.
warning us the sky is falling.
I know as well as anybody the Mac OS was never immune from viruses, that's impossible.
But how many times do I have to read articles where the alarmists are warning us that the big one is finally coming and we're all going to die horrible deaths.
Yeah, I expect a virus or three may come one day. But Windows and it's users has survived thousands without the apocolypse on a world-wide. Hell, many of my friends run windows without anti-virus and mostly don't have infections (can't say the same for malware).
So why should it be different for Mac? Why will a single virus there bring about such alarmists? Apple's record on security is better than MS.
Just remember, any OS is vulnerable, if not to viruses, then to Murphy's law, shit happens. So make regular backups, sit back, and relax.
... until somebody starts a flamewar by saying that Macs are not immune to viruses after all and they've only managed to stay relativelly safe because there are so few of them, to which a horde of Mac religious fanatics angrily reply that Windows is much worse at which point the flames start flying back and forth all the while drowning the only 2 posts that make sense, one saying that the only mainstream OS purposelly made with security in mind was OpenBSD and the other that says that stupid users running with admin rights that open executable attachments in mails from unknown sources are, independently of the OS, the biguest cause of virus infections.
.... nevermind, already started.
3, 2,
Perhaps a new line of malware will come along as the new macs grow in popularity, but it will be much different than the PC line of viruses. Mac OS X just doesn't have room and the customization to leave the gap for viruses. What I mean is that the software is written completely different. Safari is debatebly a very decent browser, but it's not customizable like IE is in Windows. There is no activeX, registry, plugins, etc. It runs alone, which greatly affects the difficulty of writing malicious software to take advantage of it. This is really how the majority of software in OS X is. I think the only true way that OS X could be at risk is stand-alone executables that could be downloaded and ran on their own, which of course is dependant entirely on the end-users.
Macs No Longer Thought To Be Immune to Viruses
An anecdotal tale of an unconfirmed in-the-wild exploit on a site run by a corporate rival? MAN THE LIFEBOATS! Mac OS X is no longer secure! No better than Windows with Microsoft's few... ahh... few thousand virii and exploits in the wild, no sir! Panic! Mass mayhem! Purchasing of Dells!
Pfft.
The Tech Punditocracy has been banging the drum on Mac OS X's insecurity pretty heavy these past few months. I'm beginning to believe it's just a scam to sell AV software to gullible IT managers, and to protect windows VARs from a growing corporate push to switch to a more secure platform than Windows.
I have yet to be bit by any sort of malware in all my years of using a Mac. The same cannot be said of my Windows experience... virii, spyware, worms... it's a vast and growing problem. On the Mac, it's a tiny and controlled problem. The difference is mainly in software architecture and in corporate attitudes to fixing software issues. Apple comes out ahead on both counts. It ain't no OpenBSD, sure, but it beats running two AV scanners and three spyware detectors just to check your email.
...share growth handbook.
Create a great OS with just a few security flaws to force paid upgrades.
Oh wait...
What does it say? How does it explain the fact that MSNBC also runs stories on Microsoft-based exploits? Hmm... this says a lot.
Daines, a 29-year-old British chemical engineer who once considered Macs invulnerable to such attacks,"... this makes him a qualified source how?
Probably something to do with the fact that 99% of users of systems, be they Mac or Win, are about as knowledgeable about viruses as he is, for better or worse?
Who the fuck is Tom Ferris again?
Who the fuck is bulldogzerofive?
If they are running XP on them now, but this is irrelevant of the hardware platform. The x86 issue has nothing to do with vulnerabilities other than portability or binary compatibility of the virus/worm itself. The biggest problem with virus/worms/phishing is plain old fashioned ignorance, and that is the most portable vulnerability that can be found on every hardware/software platform.
Join the Slashcott! Feb 10 thru Feb 17!
This article was on CNN last night as well, under the headline "Viruses catch up to the Mac."
Uh, yeah. Sure. Two guys get hit by something, the articles are not even clear about exactly what, and it's, "Oh noes! The sky is falling!"
Yeah, viruses are really catching up to the Mac. One down (maybe), a few tens of thousands more to go to catch up to the quantity available for Windows. Look at all the crap you need to do properly secure an XP box. Even if this alleged Mac virus is the real thing, you can stay safe simply by not going to dodgy sites, and thinking for a moment about why that thing you downloaded from said dodgy site is asking for your admin password.
The antivirus vendors must have realized that we just laugh at their press releases touting the dire threats to the Mac, so now they're funneling their fearmongering drivel through the Associated Press in a laughable attempt to turn it into Real News. Nice try, guys.
~Philly
In the interests of full transparency the news article should state if the author, news organization, or parent of the news organization (if it has one) owns ANY stock in Symantec who makes (as far as I know) the only Mac Anti-virus product.
Macs May No Longer Be Immune to Viruses Say it ain't so!
"manage a trois"
Uhh... That's when three people try to run a company...
If you use such terms, at least get the spelling right.
...why won't they tell me what it is?
That whole article is based on one key event. Mac users did SOMETHING, and got a virus that did SOMETHING. What did they do? And did it involve giving an admin password?
If they have a story, why aren't they telling it?
The argument about market share is just stupid. In order to write a virus you have to be something of a programmer. In order to write a Mac virus you have to be a Mac programmer. And who becomes a Mac programmer unless they like the Mac platform?
There are plenty of people working on Windows who hate and despise it. They work on it because there's lots of work out there. There aren't a similar number of people working on Mac who hate Mac OS.
Seriously, it's way too easy to have a go at this MSNBC BS. What is more worthy to note is the frequency and desperation with which these articles keep appearing, claiming sleeping beauty mac-users are in imminent danger if they continue to refuse to take part in the virus paranoia of the Windows world.
I have been using W2K with no anti-virus software for years with no side effects. Sadly and with amusement do I follow the antics of my fellow XP users with their shiny anti-virus crapware popping up redundant warnings and notifications and slowing the machine to a crawl. And to top the irony they have to turn off anti-virus whenever they install anything or run certain software. And when you go to your workplace or school the machines there have been made almost entirely useless by over zealous protection software.
Having a go at Macs for security is either stupidity or plain propaganda. Security doesn't come from anti-virus programs. It comes from the underlying architecture of the OS and the third-party software having to comply with the security principles of the underlying architecture. Anti-virus software only protects the computer against clueless users and thus it can be claimed that any computer/OS architecture requires some.
And as for the age old user base threshold argument I'm still waiting. OSX has been for some time the most common UNIX based OS. It is remarkable how little vulnerabilities have been found considering the amount of software and services running on OSX by default. Thus, comparatively, statements involving OSX and poor security continue to be plain ludicrous.
As for me I'll merrily continue running my apparently 'immune' W2K box (behind two tailor made firewalls) and wave my greetings and encouragement to my fellow mac users.
www.tribalnetworks.org - helping tribal people around the world to own their own means of high-tech communications
I'll believe that when I see water running uphill!
Join the anonymous, help develop the network: http://www.i2p2.de
I was sarcastic. I am a proud Debian user, you know. I was just doing the same analogy as the authors of the article do.
is a good open source cross platform virus/worm!
no system is 100% virus free. there may be systems that have probability that is very low.
people supporting alternative systems such as linux and unix (including mac os), etc. should avoid claiming they are not able to be infected with virus and worms. such false advertising may cause people to abandon the adoption at the end because they will just think "hey, why spend all the fuss when you get the same problems.)
ignorance is the problem. education is the solution. it may be easier to avoid getting worms and viruses in linux than windows but educating a user might be able to avoid the same with windows as well.
Live your life each day as if it was your last.
I knew once apple switched to x86 this would happen. I bet IBM is saying, "Biggest mistake of your life" -Some movie....
For one the target people are the ones who had the biggest marketing and deployment base. Which was
the people who were using the windoze software. In other words why even bother with people who used a
mac because the majority uses windoze software. Its still only a small base who use a mac compared to
the latter.
Although the article claims that they may no longer be immune, the reasons it states are that the mac market has grown which is equivalent to saying that the reason no one made viruses for mac before is that hackers didn't give a crap.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
I've been running sophos anti virus software on my mac since, well, since they became available. Thing is, apart from updating itself once in a while I haven't had ONE virus showing up. Every now and then I even scan my system. Just for kicks (I'm easily excited).
Apart from all the other "usual crap", I wonder how this type of articles make it to mainstream news outlets. Even Steve Jobs' brand of underwear would be more newsworthy than this kind of FUD.
There is - like in most of this type of journalism - no real defense against it. Whatever argument you use against "two guys encountering something weird" in "serious news outlets", you must be a mac zealot in denial. Right?
I think, therefore I am...I think.
Antivirus vendors are looking for new markets to expand. Especially with looming Microsoft extrance into anti-virus market.
This story is bullshit but regardless, if you use Mac OS X, Linux or BSD or whatever, a periodic AV scan doesn't hurt anything. The software is inexpensive. I can't really think of a good excuse not to do it, even if only ever compile 100% of the code you run it's an easy extra layer of security.
Maybe you mean increasing install base? Apple worldwide marketshare hasn't been over 3% for many years.
Most of what I've seen on /. and other sites about Vista has been extremely negative, majorly centering around MS continuing to ignore the voices of consumers and implement draconic DRM while losing several promised features and delaying the release for the umpteenth time...
Unless I was in a coma when the press release came out stating Vista suddenly became the best coded OS of all time, where's the "slam dunk"?
Seems much more likely that this is a result of MS shitting bricks over Apple gaining popularity and switching to a chip platform that will continue to bolster their market share.
Ex nihilo nihil fit.
Apple users were Just (much) safer then windows. And less of a target. But in no way were we ever immune.
---- Booth was a patriot ----
Nothing to see here, move along. This has already been covered to death EVERYWHERE, why is it being talked about again YAWN!
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common.
You don't see a lot of mac viruses because virus writers are looking for a large population to spread their malware, and macs are few and far between.
It's not the x86, it's Safari and Launchservices.
Stupid beggars. Microsoft proved that trick never works in 1998.
And why do we have to see this same story about Macs and viruses every month?
-- Boycott Shell
The mother-daughter menage-a-trois is in verse 14 and the bestiality is in verse 15.
Don't you hate meta-sigs?
Yes, well said!
Because burglars do not evaluate whether there is anything of value inside of a house at -all-.
Here is one for you:
Car thieves break into the most popular cars (and, not coincidentally, the ones that have the most value and, hence, the alarm systems with which they are most familiar) and not into the cars with the most vulnerable alarm systems.
-Noone- tries to steal my old piece of s**t. And I do not even have an alarm system. And I leave the keys -in- it.
Does the Apple switch to Intel really mean anything to a virus writer? I thought it was Microsoft's crap software [IE, Outlook Express, Windows] and their associated APIs that the were the real targets? Its not like VBScript is going to run on a Mac just because the chip is a Core Duo.
Since I have a G4 iBook, it is not x86 based, and viruses that target that will not target my iBook... *Plugs ears* I can't hear you. Universal binary virii will not happen.
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
"Daines was the victim of a computer virus .. He and at least one other person who clicked on the links were infected by what security experts call the first-ever virus for Mac OS X".
What was the name of the originating web site.
Who was the one other person who caught the 'virus`.
Can we see a sample of this 'virus`.
"In Daines' infection, a bug in the virus' code prevented it from doing much damage. Still, several of his operating system files were deleted, several new files were created and several applications, including a program for recording audio, were crippled."
Does a default Mac installation run applicions by clicking on an icon on a web page. Does the application require root to do any damage. Can a Mac be configured to not clack and run. If the home directory was made noexec would any of these alleged exploits work.
The article is a little short on real facts. Just a case of some 'security` company fudding up some business.
davecb5620@gmail.com
It's important to "throw poorly researched stories to the wolves" once in a while, so people can pick them apart.
I, for one, am happy when Slashdot finds these stories with ridiculous claims or patently false information and brings them to our collective attention. Otherwise, as an I.T. professional, it can become really frustrating when a client drags one of them out as ammunition to back up a potentially bad business decision. If you're previously unaware of such an article and it suddenly gets thrown in your face - you're put on the spot to defend against it.
This is the same "virus" that we talked about in February. link 1, link 2. The CNN (AP, really) article mentions Benjamin Daines as finding it. MacRumors forum post from Benjamin Daines dated Feb 13 whining about how he was duped by someone posting a link to said trojan. We've gone over this before. This is nothing new. Must be a slow news day at AP...
This sig intentionally left justified.
Remember how Ken Thompson hacked the compiler to always compile in a backdoor in the login progam, and compile the hack into itself? Well it turns out they did it with "Hello, World" programs as well. They even hooked it into a stealth SUID root bit. So if anyone passes the secret arguments to "Hello, World", they get a root shell prompt.
"The bottom line is we still feel more comfortable using a Mac than a (Windows) PC," said Alan Paller, director of research for SANS.
But as Daines can attest, there are no guarantees.
"We're all sort of waiting with bated breath to see if any problem will happen and the jury is still out," said Thayer, the independent security consultant. "I don't think you'll find a consensus."
The article seems to be saying, "look, two people with Macs got infected with a virus! Now Windows is more secure than the Mac." For some reason, I trust the director of research at SANS more than this British chemical engineer or the "independent security consultant." Macs have never been immune to viruses, it's just that there are thousands of times fewer Mac viruses than PC viruses. And this is still the case.
Real car thieves respond to market forces and steal the car that either needs the most repair parts or will sell the easiest on the black market. For a while, Hyundais were a popular theft car, not the most popular on the road, but needed the most parts...
That's why I remember running like Virex or something on an Mac SE with system 6 - of course it was a parsing scanner - no real time protection. But at that time you pretty much KNEW what was going into your computer 'cause you had to INSERT THE FLOPPY..
Can't be held accountable if someone running OS X is too ignorant to believe that just because they have a "Mac" they don't need antivirus.. Of course, good luck finding the Mac version on the shelf at local office supply store.
Fascinating.So
Machines can only be infected by:
Worms
Viruses
Trojans
Worms spread via open ports. If Macs have no open ports by default, then the worm threat should be near zero for Macs.
But you say that it is just because there aren't a lot of Macs out there. So
Fascinating.
Still, I WOULD like to see Apple try to do more to keep OSX secure. The system should only allow its system directories to be modified in single user mode -- I'm pretty sure BSD has a flag for that. I'd also like to see downloaded applications run as some other user that isn't allowed administrative access to the system at all, password or no. They'd probably have to make some changes so that the user could be restricted from changing its user ID to minimize the damage of people providing their passwords blindly when the dialog comes up. Allow the user to take explicit action if they want the application to be able to run as the regular user.
It still wouldn't be a perfect defense, but nothing can help you if the user's going to bend over backwards to give an application access to the system. Operating system companies really should err on the side of paranoia whenever possible.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
You're right, perhaps contradictions was too strong a word, I was objecting to that quote in the grandparent poster's sig seeming to show that Muslims are told not to associate with people of other faiths when it's a lot more complex than that.
How many people in real life have gotten an actual honest-to-goodness virus on Mac OS 10.0-10.4 in the wild and have lost data or had their machine turned into a zombie (with no interaction on their part such as typing in their password when double clicking a jpeg or something)? The answer: 0 Nothing to see here, move along. As it currently stands, the only way to become infected by an actual Virus (not a trojan or malware) on a Mac is by running windows in boot camp - although it won't likely harm the OSX partition. Slow news day = OMG teh Mac viruses are coming1111 oh noes look out11! Maybe iIt could happen someday. But it is not an issue now. And if it does, it will be nothing compared to windows' problems. Mostly, this is simply windows users' "sour grapes" to using OSX
I've been upgraded to "bad"!
Microsoft is the most often TARGETTED because of their marketshare.
Microsoft is the most often COMPROMISED because of their design.
I have Apache servers that are often TARGETTED by worms running on Microsoft machines. But my servers are not COMPROMISED by those worms.That may be correct. But "targetting" a platform is NOT the same as being able to "compromise" that platform.
Anyone can write a virus or worm or trojan for Linux. That is "targetting" Linux.
It's very difficult to get that virus / worm / trojan to spread to other Linux machines. This is "compromising" Linux. And the reason for that is because Linux's security model and implementation is better than Windows.
The same with Macs.I'll disagree.
If it were 100x harder to compromise a Windows box than a Mac, but Windows boxes were 10x more common than Macs, you wouldn't see the same results you see now.
"Marketshare" in this instance means nothing WITHOUT the vulnerabilities.
The only thing that marketshare determines is the SPEED at which the virus / worm / trojan spreads. That's because with 90% of the market, the odds of any one infected machine finding an uninfected machine within a minute are very high.
The odds of one infected Mac finding another Mac with the same vulnerability within a minute is low. But given enough time, that one machine can scan the entire IP address range of the Internet.
Here's another version from a pro-Mac paper:
/ 05/01/BUGK7IHGOC1.DTL
http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2006
Sourced mainly from SANS, which is for real.
Whenever I hear the word 'Innovation', I reach for my pistol.
'Cause they generate such great discussion/trolls/flamewars! Thanks Slashdot!
This sig kills fascists.
Macs May No Longer Be Immune to Viruses
Nobody with a functioning brain thought that Macs were ever immune to viruses.
Unfortunately, it seems that many Mac users are in denial.
/. pretty much backs up that statement.
Reading through the comments for this story on
Reminds me of the Seinfeld episode where Jerry finally gets the dry cleaner store owner to admit that they shrunk one of Jerry's shirts.
Intel Chip-Based Macs
It is funny... not as funny as the first time I read it, but funny.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
If the installed base size is the critical factor for exploit success, then why are there more successful exploits for Microsoft IIS than there are for Apache?
Take care,
brad
I recall reading somewhere the first person executed when Europeans colonized North America was for bestiality, and they did commonly hang animals for their part in the offense. Sadly that is no where near the pinnacle of the ridiculous things done in the name of christianity.
Yes, but why do they want to steal cars that are more common?
Because it makes it easier to fence the parts.
There's no corresponding issue for virus writers. If you have a botnet of 10,000 hosts, it doesn't matter what platform those hosts run, so long as they can send spam.
If a virus writer had a good chance of putting a rootkit on 10,000 network-connected OS X Macs, he'd do it.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common. You don't see a lot of mac viruses because virus writers are looking for a large population to spread their malware, and macs are few and far between.
That has to do with reasons that do not carry over to computers! The two reasons that the commonness of those cars makes a difference is because: 1. They are easier to sell for parts, because the parts are more commonly needed, and 2. A stolen Accord is unlikely to be noticed among the millions of Accords, whereas a stolen Ferrari is going to draw much more attention.
This AP story is all over the press, not just MSNBC
l / 04/21/financial/f080720D78.DTLo cal/states/california/northern_california/14397469 .htm0 012-ca-applesecurity.htmlR ITY?SITE=KFWB&SECTION=HOME&TEMPLATE=DEFAULT&CTIME= 2006-04-30-15-15-12
For example:
http://www.foxnews.com/story/0,2933,193749,00.htm
http://sfgate.com/cgi-bin/article.cgi?f=/n/a/2006
http://www.mercurynews.com/mld/mercurynews/news/l
http://www.signonsandiego.com/news/tech/20060424-
http://hosted.ap.org/dynamic/stories/A/APPLE_SECU
-- "I never gave these stories much credence." - HAL 9000
So. Not Accords. But get the picture? Nine year old Civics? The most common cars stolen are those which are owned by people living in the neighborhoods where thieves operate.
What really matters is no the most common car stolen but the car with the highest rate of theft. And for that, the top ten are: 1999 Acura Integra, 2002 BMW M Roadster, 1998 Acura Integra, 1991 GMC V2500, 2002 Audi S4, 1996 Acura Integra, 1995 Acura Integra, 2004 Mercury Marauder, 1997 Acura Integra, 1992 Mercedes-Benz 600. Someone likes those Integras.
Thing is, theft rate doesn't help your dorky argument. Because not only are there few Macs being broken into or zombied or attacked by virii, but Apple's *rate* is nearly zero as well.
It's on msnbc, cnn, and foxnews (as well as newspaper sites like sfgate.com, mercurynews.com, sandiegowhatever.com) because it's an AP story. Those that are saying this is MSNBC propaganda are just the type of Mac users that the article describes as being "in denial".
-- "I never gave these stories much credence." - HAL 9000
From the article:
-- "I never gave these stories much credence." - HAL 9000
>I have been using W2K with no anti-virus software
Good work, congratulations on your success. I used to try the same approach. It worked until I got infected by *selecting* a piece of frelling email. Not (of course) opening an executable attachment, not opening an executable attachment with a non-executable extension, not opening a non-executable attachment (because those can exploit image handling bugs), not even *opening* the email, but simply having it appear in the preview pane. Someone's certain to call me "stupid", but fact is that is a routine operation and would be safe on any sane application suite.
Microsoft has fixed that "feature", and I've added antivirus software and a policy of not using Internet-facing software from them until they accumulate a *long* clean track record. To run without antivirus I'd feel obligated to add a no-email policy and a no-Web policy (even with Firefox).
I keep reading posts in this thread that OS X doesn't have viruses and exploits because of this or that. Wasn't there a recent spate of OS X exploits, including a virsus or trojan of some sort? Did I simply dream that?
Just about a week before that rash of exloits happened, an article was posted on Digg that there security vulnerabilities on OS X. Some of us *nix-users pointed out that no OS is totally secure and that Mac-users do tend to take security for granted, even more than Linux/ BSD-users do. Over twenty people posted to that article claiming that OS X was completely secure, entirely dismissing the idea that OS X could possibly have any vulnerabilities. The, BAM!, a bunch of exploits pop up on the net right after that. And here we are at /., where lots of people like to say Digg-users are stupid teenagers, doing the exact same thing. If you're one those, take heed: it's you guys the script-kiddies will target. That's exactly what happened before, exploits aimed at the users who will carelessly run something that contains an exploit or malware of some sort.
One thing I'll never understand is why Linux/ BSD-users take security seriously and so many Mac-users don't. I think it's because of the way these OSes are designed, in that they require you take an active hand in security, although the more user-friendly guide you in doing so. Linux and BSD teach the user more aobut Unix-type OSes and their security procedures. OS X, despite being a BSD, doesn't seem to do that. If I were a Mac-user, this is soemthing I'd be hoping they'd change -- DesktopBSD and several Linux-distros have proven that it's possible to keep the user aware of security while maintaining ease of use. And just remember, exploits can and do happen, and it can happen to even the most secure types of *nix OSes. Carelessness will eventually result in harm to your system no matter what OS you're running.
I dream of a better world... one in which chickens can cross roads without their motives being questioned.
>because OS X is only 5 years old, and NT has had 10+ years to mature, that Windows should be more secure than OS X is. We all know this isn't the case.
We're getting into philosophy here and it's unclear how much this affects user experience, but...
OS X's Unix infrastructure has 30 years of experience behind it, most of that networked. Since 1988 Unix developers have had to consider the network hostile.
...that these "gloom and doom" articles are being planted by security software companies (and possibly other OS and hardware companies?) in an effort to--literally--scare up more business. Hmmmmmmm. Must mean that Apple is doing something right!
Well the point is there might be files out there for dumbasses to download other than .exe. So many piss poor and obvious viruses are done on .exe...anyways, despite the claim, there are a suprizingly high number of people on macs who have no fuckin' idea how to use a computer. I'm the only one in my class of like 100, in one of the top architecture colleges in the country, who even knows the basics of HTML, FTP, etc...
And there are tons of people running around with "cute powerbooks" or "cool powerbooks" whose (referring to the computer) sole purpose in life is bittorenting anime.
Ginga no Rekshiya Mata Each page.
Anybody that has, knows ofd someone that has a virus on their Mac please post a reply here.
thieves steal honda civics and accords because they can be easily broken in to. take a flathead screw driver, push it into the car door keyhole, and turn. do the same with the ignition. it really is that easy. now, i also admit they are very common cars. combining the two is a great reason why thieves target them. you'd think some would rather go for high end cars, like mercedes, bmw, etc. the more experienced thieves can and do. but the time and effort is not worth it to many. now, replace the cars i've mentioned with windows and mac os x...
hackers of the world unite!
PearPC is a PowerPC emulator that is capable of running versions of OSX up to 10.3. Since developing and testing exploit code should not take much resources, any cracker can run OSX well if they have a relatively modern PC.
---- "XML is like violence. If it doesn't fix the problem, you aren't using enough."
Just wait.
I've waited for the first MacOS X virus for many productive and fun years now.
Meanwhile, the wait for a freshly installed Windows machine to be infected was counted in minutes last I heard.
That is just a difference in degree, in the same way that the difference between my income and Bill Gates' is.
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common.
Actually that's not true. Hondas are stolen more often because they are easy to steal. For example, most Honda Preludes from the 90s have a window that can be pushed in without breaking it, allowing easy entry. Also, actually starting the car without a key is relatively easy.
The people who target these cars steal them because it is easy. Often they will just steal them to show off to their friends or something, then after a joy ride dump them. In some places 90% of stolen cars are recovered because of this. These people are basically the car thief equivelent of script kiddies.
If you don't believe it, come to Modesto CA and I will show you what I mean.
Qxe4
Changing processor architectures changes NOTHING about the good and careful design of the Darwin/BSD/OSX software stack.
This is just wishful thinking on the part of people who still respect Microsoft in spite of everything M$ has done to them.
Dog is my co-pilot.
Pssst... I have a secret for you...
Macs were NEVER immune to viruses.
Seems weird especially for a christian. What they are admitting is that the animal actually made a conscience and moral decision to have sex with a human and must be punished as a human. Christians don't normally recognize animals as having souls. We are supposed to have dominion over them.
Weird, but then again it's religion.
evil is as evil does
OK, the story isn't new and it's a bit FUD, too. But the story is based on a true incident with a shell script disguised as a GIF file.
I really don't like the fact that files with any suffix and custom icons can contain a shell script and are opened with Terminal.app on double-click. Apple should change this. There should be a warning dialog if a script file is to be opened by Terminal. At least if it has a custom icon and/or an unusual suffix. Apple provides warning dialogues for new executibles. So why not just extend the warnings to scripts.
Such disguised scripts are not viruses but trojan horses. Still they constitute a risk for the average user.
My personal workaround for the issue is to work as a normal user, not an administrator, and to set permission for Terminal.app to none. That might be not suitable for Terminal fans, though.
PowerPC is not Harvard architecture. It has seperate L1 instruction and data cache, but that's it. Harvard implies that the instruction memory is in a distinct address space from the data address space, and that no instructions exist to allow one to write to the program memory.
As far as I know, Apple does not have a "lifecycle" policy for their OS. However, their unspoken policy seems to be to provide security updates only for the current version (10.4) and previous version (10.3) of OS X. According to Apple's "Apple security updates" web page, the last security update (or any OS update) for OS X 10.2 (released August 2002) was over 14 months ago. Since then, OS X 10.3 and 10.4 have gotten many updates.
Are users of OS X 10.2 still getting security updates like you claim?
And nowhere near even the ground floor of the ridiculous things done in the name of atheism. Read The Black Book of Communism lately?
/.ers are capable of the level of face-to-face human interaction required to commit murder. HHOS.
Proven historical fact: People will kill each other for any damn fool excuse, or for none at all. Although a pissing contest over one's favoured OS has yet to yield any reported homicides, probably because few
Ah yet another prediction that Mac OS X is going to be swarm with viruses. Yawn!!! What is this, the 10000th one? This article should be modded -1 Redundant. Here the theme, "As soon as its it marketshare get bigger, the viruses will come. Apple won't be ready. You'll see". But, if I go online and search today for Mac OS X viruses, I can't find any information about specific viruses or stories about infection. Hell, I couldn't infect my Mac if I wanted too!!! It is obvious we are still in hypothetical land. Equally obvious, virus writers are going to attack the platform with the largest marketshare and Apple has been in single digits for the past 8 years. So, why am I going to spring money for antivirus subscription when there is no virii out there. But, I'll bet one day that they will be right. Shit, a broken watch is right twice a day. Until then, I going to keep on computing with an extra $60 in my pocket.
You don't have to be smart to use a Mac, you just have to be smart enough to buy one
Not to say anything about the fact that macs being more expensive, scrip kiddies don't always have their hands on one to learn to to exploit the system....so unfamiliarity with and os X and the g4 processor. I am not a programer but I believe I can safely assume that you have to have some intimate knowledge the of the target system hardware to take advantage of things such as buffer overflows and the likes. Most people who use the ibm power processor are likely to be professionals, not some one in some basement.
... Duke Nuken Forever will go gold first!
A virus is OS dependant not processor dependant and therefore there is equal chance of PPC OS X getting the same virus as Intel OS X if the virus writer has any degree of skill - although very few virus writers seem to be anything more than just little pathetic script kiddies.
Bring back the good old days where viruses destroyed your BIOS and knackered the bootsectors of your drives.
Virus writers are writing viruses to make profit; either by stealing information, creating botnets, or proliferation of unwanted advertising. They make more profit by exploiting more machines, so it's no wonder that the most common OS is also the most targetted.
Bullshit for two reasons: you have many millions of computers in business and government that wont have credit card data to steal, as opposed to personal machines. The second reason: Macs cost more than your bargin basement PC's. So going after Macs would be a much better investment on your hacking dollar, because your number of false positives would be reduced enourmously, and the numbers you WOULD get would be from people with better finances (and credit ratings). Besides, if viruses writers go where the money is, why has IIS had far more exploits than Apache? Apache has more marketshare and runs commerce sites all over the globe.
Furthermore, the main reason people write viruses isn't to collect information, it's to make an impact on the world and for "props", as other posters have pointed out. Say you write a show stopping Windows virus that brings millions of Windows boxes to their knees. BFD. It's been done a thousand times before. However, if you wrote the first show stopping Mac virus, you'd go down in history as the first guy to do so.
So, once again: marketshare has nothing to do with it. If Apple had 95% of the industry, they still wouldn't have Outlook, Active X, piss poor privledge separation, or dozens of ports and services open by default. Microsoft would.
Not because Accords are better, but because they are more common.
No, not because they are more common. Because they are easy to break into (see other posts), and because Hondas hold their resale value very well.
Well sonofagun - Apple's running Windows viri ads on their website and tv this week. By qwinkydink! What a coincidence. Think someone in Redmond got a leak-tape early and went into dammage control.
Naw - they're too smart for spite FUD. Too - too - smart.
Not that I'm saying you might be wrong, but various sources on the net say otherwise:
And he that is the high priest among his brethren, upon whose head the anointing oil was poured, and that is consecrated to put on the garments, shall not uncover his head, nor rend his clothes -Leviticus 21:10
Neither shall he go in to any dead body, nor defile himself for his father, or for his mother -Leviticus 21:11
Also:
A widow, or a divorced woman, or profane, or an harlot, these shall he not take: but he shall take a virgin of his own people to wife. -Leviticus 21:14
Neither shall he profane his seed among his people: for I the LORD do sanctify him. -Leviticus 21:15
Could you post a link to the bible you are reffering to?
Are you seriously suggesting that Windows NT was around before Unix? You do realize that Unix dates back to 1971, don't you?
Some people like to point out that Windows NT inherited a lot of its concepts from VMS, which did predate Unix. However, while NT on paper took a lot of concepts from VMS, in implementation it tended to sacrifice them in the interests of perceived at-keyboard performance.
And even that said, VMS was first seen on the VAX in 1977, and its first non-beta release was in 1978.
Other, older OSes did have different multi-user paradigms, but they were far, far more baroque than the simple file/directory ownership one that most modern OSes inherited from Unix and tended to be based more on volume ownership than file ownership (because they in turn tended to look at the world as a series of mounted tapes rather than random access hard drives).
"It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
No offence, but you sound like a user, not someone who actually knows much about operating systems. As someone who knows a fair amount about operating systems, I conclude Windows is very useful, but it is poorly designed with a good deal of rushed implementations. It doesn't compare favorably to Unix in terms of design.
I'd like an OS expert to comment, but I've yet to meet one who isn't zealoted in proposition of Unix, or something really obscure (Plan9 anyone?), so it's hard to get a decent comment out of them. In my experience.
> Macs May No Longer Be Immune to Viruses
Ireevelant, the Apple MAC does not exist any longer. An IBM-compatible x86 architecture machine is just a PC, no matter how much neon and silk plastic covering you put on it! It is the "Charlie Chaplin architecture" under the hood that matters, it is no more and no less then a grey painted metal box you pick up at any corner shop or Dell for that matter. Victory of the x86 is the best thing that ever happened to capitalism since Adam Smith.
While not a kernel hacker, I do know a good deal about operating systems, having studied them relatively instensly in college.
The reason that you find UNIX zealots is because the UNIXes were written so many years ago and still represent the best in OS design and development. Plan9 was also an incredibly solid OS, although the laptops it ran on were a ton if they were a pound.
My point was in relation to the parent of my original post, who insisted that Windows ability to be hacked was because it was a piece of shit. On the contrary, for the amount of third party drivers, software, and backward compatability in Windows XP and 2000, the Windows OS is indeed quite an achievement. Would I like to see MS concentrate more on security? Sure. But one of the reasons that OSX may be more secure is that they own a lock on driver interaction, hardware compatability, and have several times shunned backward compatability in the OS.
My point was simply that there is still a lot of improvement to the security model that all OSes could use. Windows is hardly alone in the world of insecure OSes.
Excuse my speling.
Making The Bar Project
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Er, then what do you call the Administrator account?
Granting that I may hold a misconception of the definition of 'super-user'. But you can't hide anything from Administrator, nor can you deny any permissions to the Administrator.
http://undecidedgames.blogspot.com
Yes I have to agree, nix security is just waiting for attention. I imagine bash or just plain sh could produce a fair amount of malware. Bash is powerful and is basically installed on all *nix which removes the "heterogenous environment" argument.
You could always use wget to grab a platform specific version of yourself if you were spyware/malware anyway.
And anyway, it's mostly social techniques that get most malware on boxes nowadays. All those activex controls tend to require dialog confirmation, but they target kids sites and the kids just ok everything.
I don't think Vista plans to address that, but of course, Macs don't either.
Your points raised a number of things worth mentioning.
:P
I think using W2K/FF/Eudora/Pegasus instead of XP/IE/Outlook has benefitted me greatly over the years. First of all a virus arriving at my email client doesn't have a chance since it's so old it cannot even open attachments or view complex html. W2K has been patched up pretty well with SP4+SR2. IE on my machine is disabled as far as possible and its internet connection is banned. A small program sits on the registry and notifies me if some process wants to change it. And finally a software firewall, and in the end my hardware firewall on the router will block any attempts by unknown software doing anything I don't like.
So as you can see, I'm not just complacent about not using anti-virus software but I've actually found a better alternative. This way I'm in control and don't overburden or impede the machine's daily functions. BTW: I do also run an Apache/SSL and SSH servers on this same machine so those firewalls are there for a reason.
I would comment on your doubt as to the security of Firefox. Indeed it is very likely that vurnerabilities will be found in it. However this does not make it unusable. Any kind of virus software won't protect you against birthday viruses so as long as you keep uptodate with news on the current vurnerability situation out there while keeping your nose clean of unrealiable sites you're very unlikely to be the first one hit by it and consequently will have warning in advance to avoid and patch up any such vurnerabilities.
At the end of the day you have to balance your needs and requirements in the altar of security vs. usability. I've found that virus-software impedes usability too much without giving me much security in return. But taking regular backups and having a spare machine also helps.
www.tribalnetworks.org - helping tribal people around the world to own their own means of high-tech communications
Now THAT was an informative comment. I learned something today.