Slashdot Mirror
Macs May No Longer Be Immune to Viruses
Bill writes "MSNBC reports that the combination of Apple's growing market share and their recent switch to x86 processors has made Mac OS X a new target for viruses. Unfortunately, it seems that many Mac users are in denial. '[Computer security expert Tom] Ferris said he warned Apple of the vulnerabilities in January and February and that the company has yet to patch the holes, prompting him to compare the Cupertino-based computer maker to Microsoft three years ago, when the world's largest software company was criticized for being slow to respond to weaknesses in its products.'"
One might wonder why this (non-)story is featured on the front page of MSNBC... ;-)
:%s/Open Source/Free Software/g
YTARY!
They never were immune. It's just that most virus writers don't give a crap about Macs.
Maybe we'll be seeing x86 and PPC virus fat binaries?
Never underestimate the power of stupid people in large groups.
What a load of rubbish - viruses infect via operating system and application vulnerabilities, the chipset those are running on has very little relevance.
I'm not even a Mac user and I still call FUD on this one. TFA was so slim on detail it was impossible to work out what had actually happened, and after searching for real info it turns out the virus, Leap.A, needs a root password to do any damage. Better article here: http://edition.cnn.com/2006/TECH/04/30/apple.secur ity.ap/index.html
"I've got more toys than Teruhisa Kitahara."
Why does Slashdot continue to post Apple-related non-stories? Every time Steve Jobs farts or some idiot proclaims the coming Mac-Virus-Mayhem (tm), Slashdot takes the bait.
This MSNBC(!) story contains no facts whatsoever. No piece of significant OS X malware has been discovered so far, and I believe it's highly likely that there won't be any in the immediate future. WTF does the Intel switch have to do with that?
The funny part is what x86 would have to do with it? The x86 ABI of Mac OS X (which is SYSV like) preclude the usage of ordinary Windows tools, and getting a OSX/x86 targeting toolchain based on GCC is (slightly) harder than getting a PPC one has been.
Sensasionalist piece. Hanging is too good for them
Anyone knows you don't get something for nothing.
Viruses for all different operating systems exist.
There are holes and exploits for practically everything known to man.
Now, if I walk into the dodgiest parts of town (with my turtle neck sweater on) and ask the shady guy at the street corner for a forbidden secret preview of the next big thing do you really think I will survive with the same number (and size) orifices as I started with?
Once you leave the beaten track, you cannot be sure what lurks in the shadows.
liqbase
Nor even markedly more resistant. They have just been less targeted.
Nonsense. Microsoft is the target of viruses and spyware because of Microsofts moronic design decisions and security policies, not because of marketshare.
CNN is carrying this article and so is msnbc, however no one mentioned the viruses name. I swear this is old, it sounds like the OSX/Leap-A incident that occurred back in early February. It wasn't even a virus is was a trojan horse. Apple will patch for this like they did the others and life will go one. At least Apple patchs for these unlike Microsoft that just recommends installing its "beta" program to "fix" the problem or some other 3rd-party software that may or may not cost even more money.
Steve Jobs farted? I'll get the gas capture bags! We can sell it as a perfume for Mac addicts!
If Mr. Edison had thought smarter he wouldn't sweat as much. --Nikola Tesla
If your new powerbook is running BootCamp and your currently using XP then you need to lower your expectations, its a Mac, its running a flawed OS, so unless your careful you are going to end up with a virus, just like the other X Million windows users, regardless of hardware.
If your running OS X then I'd say your risk is just that bit lower, its a less flawed OS. My last check showed 4 viruses aimed at OS X; (Symantec) OSX.Leap.A; OSX.Inqtana.A; OSX.Inqtana.B; MacOS.MW2004.Trojan; Which is a few orders of magnitude less than for Windows XP (Nevermind all the other versions).
Sure the OS X on intel has shown a few flaws and sure some of them will be exploited but its a world away from the threat to a Windows Machine. I dont think that there is an OS out there in common usage that isnt succeptable to infection, its all about how prevelent the threat is.
Take your chances and see where it leaves you.
No-one can deny that with growing popularity of OS X that it becomes an increasingly attractive target. Malware writing works on similar economics to regular software: this implies that malware will exist but be a niche deployment. So it is a concern, but not the end of the world, or of Apple, as the world likes to regularly predict.
/less/ vulnerable than the mainstream desktop OS. The thesis that using an intel processor increases security risks is not true - OSen don't allow direct hardware access as such, and how many script kiddies write x86 microcode?. Running Windows on a IntelMac may potentially increase security probems, and reduce the Macintosh (not OS X) brand reputation for security. It depends on how the 'wall' between x86 file access and OSX file access is implemented.
The article was mixed in accuracy. Many Mac users believe themselves to be invulnerable - the truth is they are currently
Nothing in IT or anywhere else is 100%. Currently OS X is more secure in many areas than its competitors. To maintain or improve on this, constant vigilence and innovation are required by Apple, ISVs and most importantly users.
I wonder what percentage of some anti-virus software company's profits are a direct result of this article.
I'm in denial about invisible pink unicorns too. Put up or shut-up.
Direct away from face when opening.
Don't worry there isn't a virus. The article says there will be one because apple switched to intel. That makes sense right?
BTW. RE your sig. I think it's amusing to quote from religious texts. My favorite is where the bible says to kill adulterers, homosexuals, people who have sex with their daughter in laws (and their daughter in law), all three people in a manage a trois if the manage trois involves a daughter and a mother, and of course all parties in any kind of beastality.
That last one kind of makes me mad though. I mean if you want to off some homosexuals fine but why punish the poor animal just because some pervert molested it?
evil is as evil does
The advisory is from 9 days ago. It is from a company that would like to sell you stuff related to its advisories. No known instance of the alleged flaws exist publicaly. The descriptions of the flaws do not support the conclusion of either a DOS attack being possible or compromising of one's system. As such, I invite you to use this flaw to do anything to my Mac.
Or, even present me with a URL where I can observe the alleged flaws in the wild.
Your handle, Whiney Mac Fanboy (963289), should be a tip-off that you are not posting about this matter in good faith.
I'm calling bullshit on that. True, Macs haven't been tested with a huge market share like Windows has, but you seem to be using that as proof that Macs have as bad-a security model as Windows. My favourite analogy to this is asking which one is more bulletproof, an apple or a kevlar vest. You'd shoot the apple into smitherines then say "Obviously the kevlar vest would crumble similarly if I shot it therefore neither are bulletproof".
You're right that they have never been "immune" to viruses. I don't expect you to say something stupid like that *nothing* is immune to viruses unless you can successfully hack my hello world program, but macs definitely aren't. That doesn't mean they're as bad as Windows though, so if you say something like "Nor even markedly more resistant" how about you back up that comment...
The Year of the Linux Desktop
or
The Year of The OS X Viruses
Inquiring minds want to know.
I gots ta ding a ding dang my dang a long ling long
This is completely off-topic so will doubtless be modded as such. You will actually find that the lines: "And magnify Mohammed and his followers as thou didst magnify Abraham and his followers..." "And bless Mohammed and his followers as thou didst bless Abraham and his followers..." are recited (at least) thirteen times _per day_ in the compulsory Muslim five daily prayers. Now what use would these lines be if you didn't know whom Abraham or his followers were? The key is context, in order to find out what those lines are teaching, you have to go and do a little bit of historical homework on Abraham and why he was such a good pal of God's, to the extent that people living thousands of years after Abraham are still being taught to behave like him and his congregation. Similarly, for the verses mentioned above, context is needed otherwise the lines can easily appear to be contradictory. The verse about not taking Jews and Christians as friends is very often misused by Muslims and non-Muslims alike. But the actual historical reference (remember, that histroy homework again is needed), actually refers to when the northern Arabian tribes were becoming politically unified through their common adherence to Islam. Just as the Vatican or Israel would hardly trust its affairs to, eg, Iran or Saudi Arabia, and not necessarily because of antagonism but merely due to sensible political considerations, the same was true at the time for the fledgling Arab-Muslim state. Political Islam, or indeed Christianity or Judaism, is somewhat divorced from how you should treat your neighbour: it is how one nation should treat another. The verse about taking Christians as friends is the non-political way in which Man should deal with his brethren in the world, holding up the pious Christians of the time as an example to be followed. One can therefore easily ascertain how consistency is not lacking between the two verses, merely that people do not do their homework.
Even an Associated Press article, it makes you wonder what gains Microsoft would possibly have for putting it on the front door of MSNBC.
I mean with Vista being such a slam-dunk, why would they need to engage in FUD?
Granted - Apple has warnings of running windows on their boot-camp page and what fun awaits the end user so the reported denial is obviously massive from Cuppertino and that would create a massive pile of denial from the Apple-user community no doubt.
God bless the press for keeping everyone informed of the latest threat to Mac OSX users, and to the homeland security department for keeping those colors coming. I guess I'll have to keep vigilant - albiet productive - while my neighbors reinstall windows every couple of months from all the malware slowdowns. Also special thanks for the heads-up Semantech, you're doing a great job keeping the windows world safe for NT users. Your service is no-doubt going to be needed on the Mac and boy will we be thankful.
Just about the time hell freezes over.
I'd take an Apple spokeswoman's word over Tom Ferris's word. He's fairly good at finding crash bugs, but he frequently reports zero dereferences as "buffer overflows", etc. See his record in bugzilla.mozilla.org, for example, starting with bug 303433. I have no idea why the media keeps calling him a security expert.
Perhaps they have marketshare because of those moronic design decisions - the tail wagging the dog so to speak, sacrificing safety for superficial ease of use (of course, I abadoned MS when I saw how many anti-malware/spyware/etcetera programs I had to run to keep my "ease of use").
warning us the sky is falling.
I know as well as anybody the Mac OS was never immune from viruses, that's impossible.
But how many times do I have to read articles where the alarmists are warning us that the big one is finally coming and we're all going to die horrible deaths.
Yeah, I expect a virus or three may come one day. But Windows and it's users has survived thousands without the apocolypse on a world-wide. Hell, many of my friends run windows without anti-virus and mostly don't have infections (can't say the same for malware).
So why should it be different for Mac? Why will a single virus there bring about such alarmists? Apple's record on security is better than MS.
Just remember, any OS is vulnerable, if not to viruses, then to Murphy's law, shit happens. So make regular backups, sit back, and relax.
... until somebody starts a flamewar by saying that Macs are not immune to viruses after all and they've only managed to stay relativelly safe because there are so few of them, to which a horde of Mac religious fanatics angrily reply that Windows is much worse at which point the flames start flying back and forth all the while drowning the only 2 posts that make sense, one saying that the only mainstream OS purposelly made with security in mind was OpenBSD and the other that says that stupid users running with admin rights that open executable attachments in mails from unknown sources are, independently of the OS, the biguest cause of virus infections.
.... nevermind, already started.
3, 2,
I call bullshit.
By your logic, because Apple now has a much higer visibility, it is a more likely target for viruses.
This is true, and I'm not going to argue with it. However, your reasoning behind it is faulty. Just because it is now being targeted more, does not mean that we are going to see huge numbers of viruses cropping up for OS X.
Heck, the "virus" described in the article isn't a virus at all. It's a trojan, and a shitty one at that. The guy downloaded an executable from an unknown source, and willingly ran it. "strange commands ran as if the machine was under the control of someone -- or something -- else."
Not only did the guy make a boneheaded move that would effect even the most secure operating system in the world, it was obviously apparent that the file being run was a virus the second he opened it. I don't think this is any cause for concern.
What's more, in order to inflict any serious damage on an OS X machine, you've got to provide the Administrator password. It is impossible to run OS X as root. If a program's trying to screw with your settings and files, you're going to know about it! Likewise, unlike Windows, file permissions are properly implemented (it's Unix after all...).
By your logic, because approximately 70% of the internet's web servers run Apache, we should be seeing tons of apache exploits, hacks, and viruses cropping up. The reason we don't is because Apache is a well-written and secure program, and because administrators are generally not stupid enough to run unmarked executables.
OS X and unix are inherently more secure by design than Windows is. This is a known fact that has been proven by time. I'll go a step further and say that because OS X is only 5 years old, and NT has had 10+ years to mature, that Windows should be more secure than OS X is. We all know this isn't the case. 95% of Windows viruses, trojans, and spyware would not be possible on OS X or unix simply due to the design of the OS.
Likewise, the article points out seven new vulnerabilities that were discovered two months ago that have yet to be patched, and draws the conclusion that "They didn't know how to deal with security", but later admits that the vulnerabilities wouldn't actually allow someone to execute malicious code on your machine, and that they're being rolled up into the next OS X security update. (Coincidentally, I've got to praise apple for their cumulative and bundled security updates. It makes it TONS easier for end users and administrators to install the updates, avoids confusion, and makes it significantly more likely for these people to install the updates to begin with, compared to the many crypticly-titled windows security fixes and the ActiveX horror that is Windows Update)
In short, the entire article is a piece of crap. Sure, OS X isn't perfectly safe, and it's a given that any system is vulnurable to a stupid user. However, it's damn better than anything else out there. Shame on slashdot for posting such a poorly-researched piece like this.
PS. Do not blame MSNBC for the content of the article. The article came through via the Associated Press, and appears on Cnn.com in addition to a plethora of other sites.
-- If you try to fail and succeed, which have you done? - Uli's moose
Perhaps a new line of malware will come along as the new macs grow in popularity, but it will be much different than the PC line of viruses. Mac OS X just doesn't have room and the customization to leave the gap for viruses. What I mean is that the software is written completely different. Safari is debatebly a very decent browser, but it's not customizable like IE is in Windows. There is no activeX, registry, plugins, etc. It runs alone, which greatly affects the difficulty of writing malicious software to take advantage of it. This is really how the majority of software in OS X is. I think the only true way that OS X could be at risk is stand-alone executables that could be downloaded and ran on their own, which of course is dependant entirely on the end-users.
Macs No Longer Thought To Be Immune to Viruses
An anecdotal tale of an unconfirmed in-the-wild exploit on a site run by a corporate rival? MAN THE LIFEBOATS! Mac OS X is no longer secure! No better than Windows with Microsoft's few... ahh... few thousand virii and exploits in the wild, no sir! Panic! Mass mayhem! Purchasing of Dells!
Pfft.
The Tech Punditocracy has been banging the drum on Mac OS X's insecurity pretty heavy these past few months. I'm beginning to believe it's just a scam to sell AV software to gullible IT managers, and to protect windows VARs from a growing corporate push to switch to a more secure platform than Windows.
I have yet to be bit by any sort of malware in all my years of using a Mac. The same cannot be said of my Windows experience... virii, spyware, worms... it's a vast and growing problem. On the Mac, it's a tiny and controlled problem. The difference is mainly in software architecture and in corporate attitudes to fixing software issues. Apple comes out ahead on both counts. It ain't no OpenBSD, sure, but it beats running two AV scanners and three spyware detectors just to check your email.
As such, I invite you to use this flaw to do anything to my Mac.
Errr, you'll actually have to provide me with an IP address to do that.
Furthermore, your handle, (Anonymous coward), should be a tip-off that you are not posting about this matter in good faith.
There are shills on slashdot. Apparently, I'm one of them.
What does it say? How does it explain the fact that MSNBC also runs stories on Microsoft-based exploits? Hmm... this says a lot.
Daines, a 29-year-old British chemical engineer who once considered Macs invulnerable to such attacks,"... this makes him a qualified source how?
Probably something to do with the fact that 99% of users of systems, be they Mac or Win, are about as knowledgeable about viruses as he is, for better or worse?
Who the fuck is Tom Ferris again?
Who the fuck is bulldogzerofive?
If they are running XP on them now, but this is irrelevant of the hardware platform. The x86 issue has nothing to do with vulnerabilities other than portability or binary compatibility of the virus/worm itself. The biggest problem with virus/worms/phishing is plain old fashioned ignorance, and that is the most portable vulnerability that can be found on every hardware/software platform.
Join the Slashcott! Feb 10 thru Feb 17!
This article was on CNN last night as well, under the headline "Viruses catch up to the Mac."
Uh, yeah. Sure. Two guys get hit by something, the articles are not even clear about exactly what, and it's, "Oh noes! The sky is falling!"
Yeah, viruses are really catching up to the Mac. One down (maybe), a few tens of thousands more to go to catch up to the quantity available for Windows. Look at all the crap you need to do properly secure an XP box. Even if this alleged Mac virus is the real thing, you can stay safe simply by not going to dodgy sites, and thinking for a moment about why that thing you downloaded from said dodgy site is asking for your admin password.
The antivirus vendors must have realized that we just laugh at their press releases touting the dire threats to the Mac, so now they're funneling their fearmongering drivel through the Associated Press in a laughable attempt to turn it into Real News. Nice try, guys.
~Philly
In the interests of full transparency the news article should state if the author, news organization, or parent of the news organization (if it has one) owns ANY stock in Symantec who makes (as far as I know) the only Mac Anti-virus product.
Nonsense. Microsoft is the target of viruses and spyware because of Microsoft's moronic design decisions and security policies AND because of marketshare.
Virus writers are writing viruses to make profit; either by stealing information, creating botnets, or proliferation of unwanted advertising. They make more profit by exploiting more machines, so it's no wonder that the most common OS is also the most targetted.
The fact that it's so trivial to exploit Microsoft software is purely because of the moronic design decisions and security policies, not because of marketshare. But the fact that Microsoft is so frequently the target of virus writers is a function of marketshare as well.
"manage a trois"
Uhh... That's when three people try to run a company...
If you use such terms, at least get the spelling right.
Incorrect. OS 9 and prior certainly had viruses, despite a market share comparable to OS X based machines. Not as many as Windows, but enough to cause problems for Mac users. Hell, I remember virus problems on Macs when the only way of distributing a virus was by floppy disk and the operating system was held in a ROM.
OS X is substantially more resistant to virus attack than all prior Mac operating systems, and most default Windows installations.
That doesn't mean it's 'immune'. Equally an increase in popularity will almost certainly raise the threat level - but that doesn't change the fact that the underlying system provides better protection by default. Failing to be 'immune' does not mean 'equally vulnerable'.
The default installation implements much of what corporate Windows admins have to implement to secure a Windows system / will be implemented by default in Vista.
Obviously there are other Unix systems that are still more secure - some security has been sacrificed for ease of use. It would be much more secure if new startup services and firewall changes had to be manually configured - but users won't stand for it. (Hence why we got in this mess in the first place).
'Capitalists of the world, unite! Oh
...why won't they tell me what it is?
That whole article is based on one key event. Mac users did SOMETHING, and got a virus that did SOMETHING. What did they do? And did it involve giving an admin password?
If they have a story, why aren't they telling it?
The argument about market share is just stupid. In order to write a virus you have to be something of a programmer. In order to write a Mac virus you have to be a Mac programmer. And who becomes a Mac programmer unless they like the Mac platform?
There are plenty of people working on Windows who hate and despise it. They work on it because there's lots of work out there. There aren't a similar number of people working on Mac who hate Mac OS.
Seriously, it's way too easy to have a go at this MSNBC BS. What is more worthy to note is the frequency and desperation with which these articles keep appearing, claiming sleeping beauty mac-users are in imminent danger if they continue to refuse to take part in the virus paranoia of the Windows world.
I have been using W2K with no anti-virus software for years with no side effects. Sadly and with amusement do I follow the antics of my fellow XP users with their shiny anti-virus crapware popping up redundant warnings and notifications and slowing the machine to a crawl. And to top the irony they have to turn off anti-virus whenever they install anything or run certain software. And when you go to your workplace or school the machines there have been made almost entirely useless by over zealous protection software.
Having a go at Macs for security is either stupidity or plain propaganda. Security doesn't come from anti-virus programs. It comes from the underlying architecture of the OS and the third-party software having to comply with the security principles of the underlying architecture. Anti-virus software only protects the computer against clueless users and thus it can be claimed that any computer/OS architecture requires some.
And as for the age old user base threshold argument I'm still waiting. OSX has been for some time the most common UNIX based OS. It is remarkable how little vulnerabilities have been found considering the amount of software and services running on OSX by default. Thus, comparatively, statements involving OSX and poor security continue to be plain ludicrous.
As for me I'll merrily continue running my apparently 'immune' W2K box (behind two tailor made firewalls) and wave my greetings and encouragement to my fellow mac users.
www.tribalnetworks.org - helping tribal people around the world to own their own means of high-tech communications
I'll believe that when I see water running uphill!
Join the anonymous, help develop the network: http://www.i2p2.de
However, what sounds most MS-like was this: ...
She disagreed that the vulnerabilities make it possible for a criminal to run code on a targeted machine.
Have you ever read the short description of a MS security patch? They quite frequently contain language similar to "A security issue has been identified that could allow an attacker to remotely compromise a computer running Microsoft® Windows® and gain complete control over it."
I was sarcastic. I am a proud Debian user, you know. I was just doing the same analogy as the authors of the article do.
is a good open source cross platform virus/worm!
no system is 100% virus free. there may be systems that have probability that is very low.
people supporting alternative systems such as linux and unix (including mac os), etc. should avoid claiming they are not able to be infected with virus and worms. such false advertising may cause people to abandon the adoption at the end because they will just think "hey, why spend all the fuss when you get the same problems.)
ignorance is the problem. education is the solution. it may be easier to avoid getting worms and viruses in linux than windows but educating a user might be able to avoid the same with windows as well.
Live your life each day as if it was your last.
I knew once apple switched to x86 this would happen. I bet IBM is saying, "Biggest mistake of your life" -Some movie....
My favourite analogy to this is asking which one is more bulletproof, an apple or a kevlar vest. You'd shoot the apple into smitherines then say "Obviously the kevlar vest would crumble similarly if I shot it therefore neither are bulletproof".
Your choice of fruit for the analogy helps make your point quite nicely.
I have discovered a truly remarkable proof of this theorem that this sig is too small to contain.
From a technical perspective, they have a *worse* security model.
(Note to standard responders: default configuration of user accounts for a certain subset of installations has *nothing* to do with the security *model*. It's a configuration semantics issue, nothing more.)
That doesn't mean they're as bad as Windows though, so if you say something like "Nor even markedly more resistant" how about you back up that comment...
Simply by observing that there's no technical aspect that *makes* them more resistant. A somewhat better default configuration ? Yes. Technical barriers ? No.
Errr, you'll actually have to provide me with an IP address to do that.
172.25.123.154
No, I'm not the AC from above.
Although the article claims that they may no longer be immune, the reasons it states are that the mac market has grown which is equivalent to saying that the reason no one made viruses for mac before is that hackers didn't give a crap.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
I've been running sophos anti virus software on my mac since, well, since they became available. Thing is, apart from updating itself once in a while I haven't had ONE virus showing up. Every now and then I even scan my system. Just for kicks (I'm easily excited).
Apart from all the other "usual crap", I wonder how this type of articles make it to mainstream news outlets. Even Steve Jobs' brand of underwear would be more newsworthy than this kind of FUD.
There is - like in most of this type of journalism - no real defense against it. Whatever argument you use against "two guys encountering something weird" in "serious news outlets", you must be a mac zealot in denial. Right?
I think, therefore I am...I think.
That also describes the majority of Windows "viruses".
Don't bother with silly semantic games that only Slashbots care about. In the media when they say virus, they're talking about malware in general. Most Windows malware falls into the "trojan" category and requires varying levels of user interaction to get started.
Not only did the guy make a boneheaded move that would effect even the most secure operating system in the world, it was obviously apparent that the file being run was a virus the second he opened it. I don't think this is any cause for concern.
I do, because it's by far the most common vector for malware and, indeed, all security breaches.
It's also damn near impossible to defend against programmatically.
What's more, in order to inflict any serious damage on an OS X machine, you've got to provide the Administrator password.
Bollocks. For a start, any user can delete files they own - ie: the most important data on the machine.
Secondly, any user's account can turn the machine into just about anything an attacker might want, include allowing a remote login for further attempts at privilege escalation (because the OS X firewall is disabled by default).
Finally, any user in the Admin group (the default for most users) can delete (or modify !) not only just about everything in /Applications, but also other "system" files in /Library and /System.
It is impossible to run OS X as root.
Actually it's trivial. Running code as root is marginally easier than actually logging in to the GUI as root, but neither are particularly difficult to do.
If a program's trying to screw with your settings and files, you're going to know about it!
Highly doubtful. Most users have no ideas what processes run on the systems and even fewer actually monitor them.
Likewise, unlike Windows, file permissions are properly implemented (it's Unix after all...).
Windows's file permissions - indeed its security capabilities in general - are vastly more capable that OS X's.
In short the whole "but root is disabled" argument (and variants) is largely irrelevant. Elevated privileges are simply not required for the vast majority of things malware wants to do.
By your logic, because approximately 70% of the internet's web servers run Apache, [..]
(Wow, the good old Apache argument, what a surprise.)
Websites != Servers.
Also People Running Apache != People Running IIS. The bar for running an Apache server is set higher.
[...] we should be seeing tons of apache exploits, hacks, and viruses cropping up. The reason we don't is because Apache is a well-written and secure program, [...]
Actually we do. For the last few years, Apache has had a worse security record than IIS.
[...] and because administrators are generally not stupid enough to run unmarked executables.
Users are not administrators. Users have *extreme* difficulty identifying malicious code before running it.
OS X and unix are inherently more secure by design than Windows is.
False. There are many aspects of traditional UNIX "design" - including that in OS X - what are inherently less secure than Windows. For example, the concept of 'root'.
I'll go a step further and say that because OS X is only 5 years old, and NT has had 10+ years to mature, that Windows should be more secure than OS X is. We all know this isn't the case.
Firstly, the product OS X was is actually a touch older than NT. Secondly, it was basically yet another reimplementation of the flawed unix "design".
The one thing that is true is that Apple don't know how to deal with security, although they seem to be learning. You can't ignore the press and hope that the facts are good enough.
Especially when there an army of 'security researchers' out there, with a story to tell, and a public who can't tell the difference between 'immune' and 'robust'.
Say 9/11 and Saddam in the same sentence enough times and people will start believing there is a link - even if your sentence is 'There is no known link between 9/11 and Saddam'.
'Capitalists of the world, unite! Oh
Antivirus vendors are looking for new markets to expand. Especially with looming Microsoft extrance into anti-virus market.
Maybe you mean increasing install base? Apple worldwide marketshare hasn't been over 3% for many years.
Not even *close* to as many as DOS and Windows. Heck, I don't think the number of MacOS Classic viruses even hit triple figures.
Even taking out the obligatory fifty-odd minor variants of every DOS/Windows virus, there would still be an order of magnitude plus more pieces of malicious code on that platform.
Added to that, MacOS - particularly in its heyday - had much more marketshare than it has now. Indeed, it's only relatively recently OS X has exceeded MacOS Classic in marketshare and both must share the relatively smaller MacOS pie.
OS X is substantially more resistant to virus attack than all prior Mac operating systems, and most default Windows installations.
Not really. Marginally more resistant, yes - many areas of the system are protected. Just about everything in /Applications and many parts of /Library, however, are writable by Admin users (the default for most users). Not to mention any files - both local and networked copied and/or created by the user themselves.
So, OS X *isn't* especially more resistant. Certain parts of the system will withstand an attack from malicious code, but many won't and neither will any of the user's own data (the most important on the machine).
Failing to be 'immune' does not mean 'equally vulnerable'.
Neither does "exploited more frequently" mean "less secure", but try explaining that to the typical slashbot.
The default installation implements much of what corporate Windows admins have to implement to secure a Windows system / will be implemented by default in Vista.
A default *corporate* Windows install is reasonable, assuming even a barely competent IT department. It's the default *non-corporate*, unmanaged install where OS X has a superior configuration (although realistically the additional protection is marginal).
Most of what I've seen on /. and other sites about Vista has been extremely negative, majorly centering around MS continuing to ignore the voices of consumers and implement draconic DRM while losing several promised features and delaying the release for the umpteenth time...
Unless I was in a coma when the press release came out stating Vista suddenly became the best coded OS of all time, where's the "slam dunk"?
Seems much more likely that this is a result of MS shitting bricks over Apple gaining popularity and switching to a chip platform that will continue to bolster their market share.
Ex nihilo nihil fit.
Apple users were Just (much) safer then windows. And less of a target. But in no way were we ever immune.
---- Booth was a patriot ----
Nothing to see here, move along. This has already been covered to death EVERYWHERE, why is it being talked about again YAWN!
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common.
You don't see a lot of mac viruses because virus writers are looking for a large population to spread their malware, and macs are few and far between.
Like what ?
It's not the x86, it's Safari and Launchservices.
Stupid beggars. Microsoft proved that trick never works in 1998.
And why do we have to see this same story about Macs and viruses every month?
-- Boycott Shell
Does the Apple switch to Intel really mean anything to a virus writer? I thought it was Microsoft's crap software [IE, Outlook Express, Windows] and their associated APIs that the were the real targets? Its not like VBScript is going to run on a Mac just because the chip is a Core Duo.
"Daines was the victim of a computer virus .. He and at least one other person who clicked on the links were infected by what security experts call the first-ever virus for Mac OS X".
What was the name of the originating web site.
Who was the one other person who caught the 'virus`.
Can we see a sample of this 'virus`.
"In Daines' infection, a bug in the virus' code prevented it from doing much damage. Still, several of his operating system files were deleted, several new files were created and several applications, including a program for recording audio, were crippled."
Does a default Mac installation run applicions by clicking on an icon on a web page. Does the application require root to do any damage. Can a Mac be configured to not clack and run. If the home directory was made noexec would any of these alleged exploits work.
The article is a little short on real facts. Just a case of some 'security` company fudding up some business.
davecb5620@gmail.com
It's important to "throw poorly researched stories to the wolves" once in a while, so people can pick them apart.
I, for one, am happy when Slashdot finds these stories with ridiculous claims or patently false information and brings them to our collective attention. Otherwise, as an I.T. professional, it can become really frustrating when a client drags one of them out as ammunition to back up a potentially bad business decision. If you're previously unaware of such an article and it suddenly gets thrown in your face - you're put on the spot to defend against it.
This is the same "virus" that we talked about in February. link 1, link 2. The CNN (AP, really) article mentions Benjamin Daines as finding it. MacRumors forum post from Benjamin Daines dated Feb 13 whining about how he was duped by someone posting a link to said trojan. We've gone over this before. This is nothing new. Must be a slow news day at AP...
This sig intentionally left justified.
"The bottom line is we still feel more comfortable using a Mac than a (Windows) PC," said Alan Paller, director of research for SANS.
But as Daines can attest, there are no guarantees.
"We're all sort of waiting with bated breath to see if any problem will happen and the jury is still out," said Thayer, the independent security consultant. "I don't think you'll find a consensus."
The article seems to be saying, "look, two people with Macs got infected with a virus! Now Windows is more secure than the Mac." For some reason, I trust the director of research at SANS more than this British chemical engineer or the "independent security consultant." Macs have never been immune to viruses, it's just that there are thousands of times fewer Mac viruses than PC viruses. And this is still the case.
First, how about moving to least privileged users? Separating binaries and data: Program Files and Documents and Settings (usr/bin, /etc, /home). Shipping with only the necessary services turned on. Detaching IE from the OS. Sure, some of these have to wait for Vista, but they've already made improvements. Whether it is enough or is effective is up to debate, but Microsoft are making efforts.
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Real car thieves respond to market forces and steal the car that either needs the most repair parts or will sell the easiest on the black market. For a while, Hyundais were a popular theft car, not the most popular on the road, but needed the most parts...
Fascinating.So
Machines can only be infected by:
Worms
Viruses
Trojans
Worms spread via open ports. If Macs have no open ports by default, then the worm threat should be near zero for Macs.
But you say that it is just because there aren't a lot of Macs out there. So
Fascinating.
Still, I WOULD like to see Apple try to do more to keep OSX secure. The system should only allow its system directories to be modified in single user mode -- I'm pretty sure BSD has a flag for that. I'd also like to see downloaded applications run as some other user that isn't allowed administrative access to the system at all, password or no. They'd probably have to make some changes so that the user could be restricted from changing its user ID to minimize the damage of people providing their passwords blindly when the dialog comes up. Allow the user to take explicit action if they want the application to be able to run as the regular user.
It still wouldn't be a perfect defense, but nothing can help you if the user's going to bend over backwards to give an application access to the system. Operating system companies really should err on the side of paranoia whenever possible.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
You're right, perhaps contradictions was too strong a word, I was objecting to that quote in the grandparent poster's sig seeming to show that Muslims are told not to associate with people of other faiths when it's a lot more complex than that.
It is impossible to run OS X as root.
No, it's not.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Microsoft is the most often TARGETTED because of their marketshare.
Microsoft is the most often COMPROMISED because of their design.
I have Apache servers that are often TARGETTED by worms running on Microsoft machines. But my servers are not COMPROMISED by those worms.That may be correct. But "targetting" a platform is NOT the same as being able to "compromise" that platform.
Anyone can write a virus or worm or trojan for Linux. That is "targetting" Linux.
It's very difficult to get that virus / worm / trojan to spread to other Linux machines. This is "compromising" Linux. And the reason for that is because Linux's security model and implementation is better than Windows.
The same with Macs.I'll disagree.
If it were 100x harder to compromise a Windows box than a Mac, but Windows boxes were 10x more common than Macs, you wouldn't see the same results you see now.
"Marketshare" in this instance means nothing WITHOUT the vulnerabilities.
The only thing that marketshare determines is the SPEED at which the virus / worm / trojan spreads. That's because with 90% of the market, the odds of any one infected machine finding an uninfected machine within a minute are very high.
The odds of one infected Mac finding another Mac with the same vulnerability within a minute is low. But given enough time, that one machine can scan the entire IP address range of the Internet.
Here's another version from a pro-Mac paper:
/ 05/01/BUGK7IHGOC1.DTL
http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2006
Sourced mainly from SANS, which is for real.
Whenever I hear the word 'Innovation', I reach for my pistol.
'Cause they generate such great discussion/trolls/flamewars! Thanks Slashdot!
This sig kills fascists.
Macs May No Longer Be Immune to Viruses
Nobody with a functioning brain thought that Macs were ever immune to viruses.
Please take a look at the verified attacks and defacements of today.... http://www.zone-h.org/ I guess you don't know much about operating system design either,you just like to repeat something you heard somewhere...
Intel Chip-Based Macs
It is funny... not as funny as the first time I read it, but funny.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
If the installed base size is the critical factor for exploit success, then why are there more successful exploits for Microsoft IIS than there are for Apache?
Take care,
brad
I recall reading somewhere the first person executed when Europeans colonized North America was for bestiality, and they did commonly hang animals for their part in the offense. Sadly that is no where near the pinnacle of the ridiculous things done in the name of christianity.
Yes, but why do they want to steal cars that are more common?
Because it makes it easier to fence the parts.
There's no corresponding issue for virus writers. If you have a botnet of 10,000 hosts, it doesn't matter what platform those hosts run, so long as they can send spam.
If a virus writer had a good chance of putting a rootkit on 10,000 network-connected OS X Macs, he'd do it.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common. You don't see a lot of mac viruses because virus writers are looking for a large population to spread their malware, and macs are few and far between.
That has to do with reasons that do not carry over to computers! The two reasons that the commonness of those cars makes a difference is because: 1. They are easier to sell for parts, because the parts are more commonly needed, and 2. A stolen Accord is unlikely to be noticed among the millions of Accords, whereas a stolen Ferrari is going to draw much more attention.
This AP story is all over the press, not just MSNBC
l / 04/21/financial/f080720D78.DTLo cal/states/california/northern_california/14397469 .htm0 012-ca-applesecurity.htmlR ITY?SITE=KFWB&SECTION=HOME&TEMPLATE=DEFAULT&CTIME= 2006-04-30-15-15-12
For example:
http://www.foxnews.com/story/0,2933,193749,00.htm
http://sfgate.com/cgi-bin/article.cgi?f=/n/a/2006
http://www.mercurynews.com/mld/mercurynews/news/l
http://www.signonsandiego.com/news/tech/20060424-
http://hosted.ap.org/dynamic/stories/A/APPLE_SECU
-- "I never gave these stories much credence." - HAL 9000
Largely I would agree, except I would not describe the additional protection as marginal - realistically it has proven sufficient.
.Mac subscription is completely underhand.
I'd have to say that being callous I have little concern for the user's own data. They should be backing it up anyway*. Nor can I see an easy way of protecting it (a database style approach may work, where the data is owned by another user and only accessible via specific client applications, but this would be annoying for many reasons).
However, it's been a long time since your typical virus merely damaged user data. Installing automatically executing code that survives between reboots, without alerting the user, is not something anyone has yet achieved - despite the fact that there have been known auto-execution AND privilege escalation issues, no one has yet been able to combine the two in a dangerous way.
(They came close with the 2-week window where sites could auto-install Dashboard widgets).
Of course, viruses aren't the only threat. Trojans are increasingly significant (especially as virus-delivery becomes harder on Windows) - and the Mac is not substantially more 'trojan-proof'. An idiot installing a p2p program will not be stopped by an admin password, and a family are as likely to set up every user as Admin on a Mac as on Windows.
Actually the whole discussion on security is generally crap.
Vulnerabilities in IE where 'viewing a web page can allow execution of arbitrary code' sound bad to ignorant users - they don't understand they need to visit a specially crafted page rather than Amazon or ebay. Security sites don't help by calling such issues 'critical'.
We need to distinguish between risks that result from user action (visiting a specific web page, downloading p2p software) and user inaction. The ability to exploit the default installation of an OS through open ports, or transmit a virus through reading an email is at least an order of magnitude greater in risk.
On those grounds, OS X has always been a much lower risk platform (Windows continues to improve with each SP).
Instead the discussion has largely deteriorated into throwing vuln counts at each other.
* Apple, like Microsoft, deserve shooting for not incorporating backup as a standard feature in their consumer operating system - selling it as part of a
'Capitalists of the world, unite! Oh
So. Not Accords. But get the picture? Nine year old Civics? The most common cars stolen are those which are owned by people living in the neighborhoods where thieves operate.
What really matters is no the most common car stolen but the car with the highest rate of theft. And for that, the top ten are: 1999 Acura Integra, 2002 BMW M Roadster, 1998 Acura Integra, 1991 GMC V2500, 2002 Audi S4, 1996 Acura Integra, 1995 Acura Integra, 2004 Mercury Marauder, 1997 Acura Integra, 1992 Mercedes-Benz 600. Someone likes those Integras.
Thing is, theft rate doesn't help your dorky argument. Because not only are there few Macs being broken into or zombied or attacked by virii, but Apple's *rate* is nearly zero as well.
It's on msnbc, cnn, and foxnews (as well as newspaper sites like sfgate.com, mercurynews.com, sandiegowhatever.com) because it's an AP story. Those that are saying this is MSNBC propaganda are just the type of Mac users that the article describes as being "in denial".
-- "I never gave these stories much credence." - HAL 9000
From the article:
-- "I never gave these stories much credence." - HAL 9000
>I have been using W2K with no anti-virus software
Good work, congratulations on your success. I used to try the same approach. It worked until I got infected by *selecting* a piece of frelling email. Not (of course) opening an executable attachment, not opening an executable attachment with a non-executable extension, not opening a non-executable attachment (because those can exploit image handling bugs), not even *opening* the email, but simply having it appear in the preview pane. Someone's certain to call me "stupid", but fact is that is a routine operation and would be safe on any sane application suite.
Microsoft has fixed that "feature", and I've added antivirus software and a policy of not using Internet-facing software from them until they accumulate a *long* clean track record. To run without antivirus I'd feel obligated to add a no-email policy and a no-Web policy (even with Firefox).
>because OS X is only 5 years old, and NT has had 10+ years to mature, that Windows should be more secure than OS X is. We all know this isn't the case.
We're getting into philosophy here and it's unclear how much this affects user experience, but...
OS X's Unix infrastructure has 30 years of experience behind it, most of that networked. Since 1988 Unix developers have had to consider the network hostile.
Well the point is there might be files out there for dumbasses to download other than .exe. So many piss poor and obvious viruses are done on .exe...anyways, despite the claim, there are a suprizingly high number of people on macs who have no fuckin' idea how to use a computer. I'm the only one in my class of like 100, in one of the top architecture colleges in the country, who even knows the basics of HTML, FTP, etc...
And there are tons of people running around with "cute powerbooks" or "cool powerbooks" whose (referring to the computer) sole purpose in life is bittorenting anime.
Ginga no Rekshiya Mata Each page.
Actually we do. For the last few years, Apache has had a worse security record than IIS.
I call shenanigans.
Apache 2.2.x and IIS 6 have no open bugs in Secunia. But those are brand new. However:
IIS 5
Apache 2.0
For those who don't want to click, IIS5 is "Moderately Critical", and Apache 2.0 AND 1.3 are both "Less Critical". Being as these are the most popular versions of these servers... I think you're just a shill. Stop spreading FUD.
My blog. Good stuff (when I remember to update it). Read it.
"Whether it is enough or is effective is up to debate,"
No, it's really not up to debate. It's a massive charlie foxtrot, and has been since 1995.
"but Microsoft are making efforts"
Not good enough for my money. I pay for solutions, not attempts.
Why yes, I AM a rocket scientist!
"What's more, in order to inflict any serious damage on an OS X machine, you've got to provide the Administrator password. It is impossible to run OS X as root. If a program's trying to screw with your settings and files, you're going to know about it! Likewise, unlike Windows, file permissions are properly implemented (it's Unix after all...)." Keep in mind that most people are stupid enough to download unknown files and run them with the Admin password... Linux is more protected than OS X not because of superior design, but because of superior users. Most people on this site are protected even if they use Windows... just like car theft, virus issues come to those that have their Windows down or their doors unlocked.
thieves steal honda civics and accords because they can be easily broken in to. take a flathead screw driver, push it into the car door keyhole, and turn. do the same with the ignition. it really is that easy. now, i also admit they are very common cars. combining the two is a great reason why thieves target them. you'd think some would rather go for high end cars, like mercedes, bmw, etc. the more experienced thieves can and do. but the time and effort is not worth it to many. now, replace the cars i've mentioned with windows and mac os x...
hackers of the world unite!
PearPC is a PowerPC emulator that is capable of running versions of OSX up to 10.3. Since developing and testing exploit code should not take much resources, any cracker can run OSX well if they have a relatively modern PC.
---- "XML is like violence. If it doesn't fix the problem, you aren't using enough."
Since Windows NT 3.51, desktop objects have been the security barrier for USER and GDI objects like the window objects required for a shatter attack. Each desktop has a security desciptor which makes them fully securable. Microsoft documentation clearly specifies that privileged processes shouldn't create windows on the default interactive desktop. According to the design, it is a security error to put two windows on the same desktop which belong to processes of different privilege levels, the exact situation that a shatter attack requires to work. The fact that many pieces of software choose to disregard this is not a problem with the design of Windows's security system.
Since Windows 2000, the JOB_OBJECT_UILIMIT_HANDLES job restriction can be used to put unprivileged processes into a UI sandbox on a desktop where privileged processes have windows open. Shatter attacks won't work when the malicious process can't get a handle to the target window.
There have been no true virus that I have heard of, although the media reports anything and everything as a virus. There was a trojan horse, but I do not consider stupid users to be an OS vulnerability. To install anything on OSX requires you must enter your admin password, unlike XP which will install anything with no warning at all. What more can Apple do? This whole thing reeks of carefully planned and released FUD against an OS that has evolved far beyond its competition and is gaining in favorability.
Just wait.
I've waited for the first MacOS X virus for many productive and fun years now.
Meanwhile, the wait for a freshly installed Windows machine to be infected was counted in minutes last I heard.
That is just a difference in degree, in the same way that the difference between my income and Bill Gates' is.
It is impossible to run OS X as root.
I've done it. Set the login window to text input for username and password, and type in "root" and your root password.
In Repressive Burma, it's not just your connection that dies. slashdot.org/comments.pl?sid=314547&cid=20819199
Thieves steal honda accords more than any other car. Not because Accords are better, but because they are more common.
Actually that's not true. Hondas are stolen more often because they are easy to steal. For example, most Honda Preludes from the 90s have a window that can be pushed in without breaking it, allowing easy entry. Also, actually starting the car without a key is relatively easy.
The people who target these cars steal them because it is easy. Often they will just steal them to show off to their friends or something, then after a joy ride dump them. In some places 90% of stolen cars are recovered because of this. These people are basically the car thief equivelent of script kiddies.
If you don't believe it, come to Modesto CA and I will show you what I mean.
Qxe4
Changing processor architectures changes NOTHING about the good and careful design of the Darwin/BSD/OSX software stack.
This is just wishful thinking on the part of people who still respect Microsoft in spite of everything M$ has done to them.
Dog is my co-pilot.
Good, then don't give them your money. I think Microsoft still fall short of making a secure operating system, however, that's not my point. My point was in reponse to the parent poster, saying that they are borrowing some ideas from Unix. I was not referring to Windows being secure, but their improvements being satisfactory compared to the Unix features they emulate.
24 beers in a case, 24 hours in a day. Coincidence? I think not!
You've got a pretty low bar for "satisfactory".
Why yes, I AM a rocket scientist!
I was not stating that it was satisfactory, but saying that's the issue. Actually, with some of the nitpicking in this thread, I've already forgotten what I was talking about.
Microsoft tries to improve security by borrowing from Unix. I think they fail. But they are making progress. Windows still isn't worth paying for.
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Seems weird especially for a christian. What they are admitting is that the animal actually made a conscience and moral decision to have sex with a human and must be punished as a human. Christians don't normally recognize animals as having souls. We are supposed to have dominion over them.
Weird, but then again it's religion.
evil is as evil does
Actually it's trivial. Running code as root is marginally easier than actually logging in to the GUI as root, but neither are particularly difficult to do.
Not sure how you define trivial. The root user is disabled by default and can only be enabled by going into the network utility. The vast majority of users have no idea the root user even exist. The administrative user, which can su to root, is not the user default either. Even if someone is running as admin, they are presented with password request for every process launched. Most Macs spend most of their time running in standard user space making it hard to seize control of the machine remotely.
I would say that the biggest problem windows permissions is not the permissions model per se but rather the large number of legacy/poorly written apps that will not work under it. A lot of windows boxes are running exposed because their apps won't work any other way.
PowerPC is not Harvard architecture. It has seperate L1 instruction and data cache, but that's it. Harvard implies that the instruction memory is in a distinct address space from the data address space, and that no instructions exist to allow one to write to the program memory.
First, how about moving to least privileged users? Separating binaries and data: Program Files and Documents and Settings (usr/bin, /etc, /home). Shipping with only the necessary services turned on. Detaching IE from the OS. Sure, some of these have to wait for Vista, but they've already made improvements. Whether it is enough or is effective is up to debate, but Microsoft are making efforts.
These things are "taken from unix" only if your worldview ends at unix and windows.
Multiuser OSes were around before unix, and implemented better. Windows NT has always been multiuser.
Windows NT has always seperated user profiles from application files. Windows 9x has done it since about 1997 (although, obviously, it couldn't be enforced by filesystem permissions).
IE is no more "detached" (or "attached", for that matter) to the OS than it was before. It's architecture has remained basically unchanged since IE3 back in 1996. It's still just a shared component like khtml is in KDE.
Just about all the stuff you're talking about - and likely thinking of - aren't really changes to Windows at lower levels, they're just improvements in default configurations and UI.
I would argue that it has hardly been tested, so one can't really say that it has "proven" anything.
The usefulness of non-root users in protecting the typical desktop machines is *vastly* overstated. The only reason most malware fails with a low privilege account is because it is poorly written, not because it actually needs the higher privileges.
I'd have to say that being callous I have little concern for the user's own data. They should be backing it up anyway*. Nor can I see an easy way of protecting it (a database style approach may work, where the data is owned by another user and only accessible via specific client applications, but this would be annoying for many reasons).
Never the less, it is still the most important data on the machine. An OS (and applications) can be reinstalled in a matter of hours. Some types of data can *never* be recreated.
(This is why the "but it's a regular user account" is bogus for machines that aren't servicing multiple users.)
Installing automatically executing code that survives between reboots, without alerting the user, is not something anyone has yet achieved - despite the fact that there have been known auto-execution AND privilege escalation issues, no one has yet been able to combine the two in a dangerous way.
Well, it wouldn't be particularly *hard* - just get something into the user's LoginItems.
Added to that, get a user to throw in a password to a sudo prompt wouldn't be difficult, to get something in /etc/rc.local.
Of course, viruses aren't the only threat. Trojans are increasingly significant (especially as virus-delivery becomes harder on Windows) - and the Mac is not substantially more 'trojan-proof'.
I would argue that trojans are *very* significant. They're certainly the most common vector on Windows. Pretty much every "email virus" for example, is/was a trojan, as are most ActiveX exploits.
Apple, like Microsoft, deserve shooting for not incorporating backup as a standard feature in their consumer operating system - selling it as part of a .Mac subscription is completely underhand.
Microsoft at least have always included a backup program with Windows. The UI - along with automation for typical useres - however, could use improvement.
Wasn't there a recent spate of OS X exploits, including a virsus or trojan of some sort?
There is no such thing as a "safe" file.
'sudo blah' runs 'blah' as root.
'sudo -i' gets you a root shell.
Every time you type in your password at one of those "Enter your password" prompts you are running the subsequent code as root.
'sudo passwd root' enables the root account for a GUI login (assuming you type in a password).
I would call all of those fairly trivial.
The root user is disabled by default and can only be enabled by going into the network utility.
Because of the primitive unix security model, "disabling" the root account doesn't stop the ability to run code as root. It just stops you being able to directly login as root.
The vast majority of users have no idea the root user even exist.
Never the less, they are running code as root every time they type their password into one of those graphical (or console) sudo prompts.
The administrative user, which can su to root, is not the user default either.
This is not correct. The default first user created on an OS X system *is* in the admin group.
Even if someone is running as admin, they are presented with password request for every process launched.
Most of which are spurious. An "admin" user on OS X can do a *lot* of damage, even without elevating their privileges. Just because all your legitimate applications like to spam the user with password prompts, doesn't mean malicious code will.
Most Macs spend most of their time running in standard user space making it hard to seize control of the machine remotely.
I'm not sure what you're trying to say here.
I would say that the biggest problem windows permissions is not the permissions model per se but rather the large number of legacy/poorly written apps that will not work under it. A lot of windows boxes are running exposed because their apps won't work any other way.
This is certainly a problem. It is not, however, a problem that can be blamed on either Microsoft or Windows, certainly not any more.
And nowhere near even the ground floor of the ridiculous things done in the name of atheism. Read The Black Book of Communism lately?
/.ers are capable of the level of face-to-face human interaction required to commit murder. HHOS.
Proven historical fact: People will kill each other for any damn fool excuse, or for none at all. Although a pissing contest over one's favoured OS has yet to yield any reported homicides, probably because few
I encourage everyone to open up those links and draw their own conclusions. One thing you may wish to consider are the relative numbers of exploits - 28 vs 9 - of Apache and IIS over the last 3 years.
-Noone- tries to steal my old piece of s**t. And I do not even have an alarm system. And I leave the keys -in- it.
Just wait until you come accross the other type of car thief: The kid who wants to go joy riding and will take whatever he can get started. Most of these kids are known to target old, crappy cars because they are easy to get started and less likely to be missed right away.
Ah yet another prediction that Mac OS X is going to be swarm with viruses. Yawn!!! What is this, the 10000th one? This article should be modded -1 Redundant. Here the theme, "As soon as its it marketshare get bigger, the viruses will come. Apple won't be ready. You'll see". But, if I go online and search today for Mac OS X viruses, I can't find any information about specific viruses or stories about infection. Hell, I couldn't infect my Mac if I wanted too!!! It is obvious we are still in hypothetical land. Equally obvious, virus writers are going to attack the platform with the largest marketshare and Apple has been in single digits for the past 8 years. So, why am I going to spring money for antivirus subscription when there is no virii out there. But, I'll bet one day that they will be right. Shit, a broken watch is right twice a day. Until then, I going to keep on computing with an extra $60 in my pocket.
You don't have to be smart to use a Mac, you just have to be smart enough to buy one
Not to say anything about the fact that macs being more expensive, scrip kiddies don't always have their hands on one to learn to to exploit the system....so unfamiliarity with and os X and the g4 processor. I am not a programer but I believe I can safely assume that you have to have some intimate knowledge the of the target system hardware to take advantage of things such as buffer overflows and the likes. Most people who use the ibm power processor are likely to be professionals, not some one in some basement.
... Duke Nuken Forever will go gold first!
ha! I didn't even realise that as I was writing it. As normal for any internet posts, my post accidentally says more then I wanted it to say.
To tell the truth I didn't think about the connection between Apple and apple. I was just thinking about all the apple exploding videos around - it's probably the fruit that's most fun to put a bullet into.
A virus is OS dependant not processor dependant and therefore there is equal chance of PPC OS X getting the same virus as Intel OS X if the virus writer has any degree of skill - although very few virus writers seem to be anything more than just little pathetic script kiddies.
Bring back the good old days where viruses destroyed your BIOS and knackered the bootsectors of your drives.
Most of which are spurious. An "admin" user on OS X can do a *lot* of damage, even without elevating their privileges. Just because all your legitimate applications like to spam the user with password prompts, doesn't mean malicious code will.
Huh? you do realize that the code that results in the root password being needed IS NOT the code that opens the dialog. No dialog, no permissions. Its like this..
You can't write code that does root stuff without a password coming up. There is no way to bypass this except possible bugs in the OS X code. Legitimate applications don't spam the user with password prompts to be nice, they have no choice. Write some code requiring admin access some time and find out for yourself. Now you can rely on user naivety (I suspect a lot would trust Bob's Smileys). But if you think you can get away without the password being asked you don't know that much about how user and process permissions work.
You're missing the point. There's a great deal of things that can be done *without* requiring root permissions. For example, deleting or modifying just about everything in /Applications and many things in /Library does *not* require any privilege escalation if a user is in the admin group ("admins" have write permissions to those locations and most files in them).
Legitimate applications don't spam the user with password prompts to be nice, they have no choice. Write some code requiring admin access some time and find out for yourself.
Anytime I - as an admin user - run a program installer than does nothing more than copy some files in /Applications and maybe ~, and it pops up a password request, I am being needlessly spammed. My user alredy has write permissions for that location, the machine shouldn't need to ask for any privilege escalation.
I've seen several application installs that do this, and they shouldn't.
However, it may just be that the developer has told the Installer to do something "tricky" - maybe chown the copied files to root:admin - and that's why the dialog is raising. I haven't looked into it that closely. I'd still consider that dialog spam, as well.
Now you can rely on user naivety (I suspect a lot would trust Bob's Smileys). But if you think you can get away without the password being asked you don't know that much about how user and process permissions work.
I know more than enough about unix permissions to see that a user in the "admin" group has write access to places like /Applications and /Library, and that this is a possible vector for malicious code to delete or modify files in these locations.
Virus writers are writing viruses to make profit; either by stealing information, creating botnets, or proliferation of unwanted advertising. They make more profit by exploiting more machines, so it's no wonder that the most common OS is also the most targetted.
Bullshit for two reasons: you have many millions of computers in business and government that wont have credit card data to steal, as opposed to personal machines. The second reason: Macs cost more than your bargin basement PC's. So going after Macs would be a much better investment on your hacking dollar, because your number of false positives would be reduced enourmously, and the numbers you WOULD get would be from people with better finances (and credit ratings). Besides, if viruses writers go where the money is, why has IIS had far more exploits than Apache? Apache has more marketshare and runs commerce sites all over the globe.
Furthermore, the main reason people write viruses isn't to collect information, it's to make an impact on the world and for "props", as other posters have pointed out. Say you write a show stopping Windows virus that brings millions of Windows boxes to their knees. BFD. It's been done a thousand times before. However, if you wrote the first show stopping Mac virus, you'd go down in history as the first guy to do so.
So, once again: marketshare has nothing to do with it. If Apple had 95% of the industry, they still wouldn't have Outlook, Active X, piss poor privledge separation, or dozens of ports and services open by default. Microsoft would.
Not because Accords are better, but because they are more common.
No, not because they are more common. Because they are easy to break into (see other posts), and because Hondas hold their resale value very well.
I read back over it. I accept I might have misinterpreted the point.
/System. I'm going to have to look more closely into exactly what the difference is between the wheel and admin groups. Although I can't think of any reason to have that folder default writable by admin and I can't think of any way that could still be safe.
Although I hadn't realized the Applications directory was writable by the admin group. thats terrible. I had thought(assumed) it was the wheel group like
>I would argue that it has hardly been tested, so one can't really say that it has "proven" anything.
As atheists have long known, it's almost impossible to prove the absence of something, despite the complete lack of evidence for it's existence or nature. Faith always wins out.
I would argue that (as per first post) that you can, at the very least, compare OS X with Classic - the threat level is about the same, and we are seeing almost nothing. It is certainly not for want of effort.
I am not disagreeing that Mac security is often over-stated. There have been two KNOWN problems that I would categorise as genuinely critical - the 'auto-install widgets' incident, and the issue covered in the parent article (failure to detect a file is in fact a shell script). The only reason either didn't spread widely is definitely down to market-share - 2 weeks would be long enough to cause substantial problems on unprotected PCs.
However, I do think the threat hysteria is often over-stated - every other vulnerability, including the 7 outstanding issues, has been as meaningless and low-threat as your typical reported Windows or Linux vulnerability. (As you note, the main vector is trojans, not code embedded in JPG on web pages).
Mac users do also have the useful advantage that even a slight potential threat makes mainstream news coverage.
'Capitalists of the world, unite! Oh
Well sonofagun - Apple's running Windows viri ads on their website and tv this week. By qwinkydink! What a coincidence. Think someone in Redmond got a leak-tape early and went into dammage control.
Naw - they're too smart for spite FUD. Too - too - smart.
Are you seriously suggesting that Windows NT was around before Unix? You do realize that Unix dates back to 1971, don't you?
Some people like to point out that Windows NT inherited a lot of its concepts from VMS, which did predate Unix. However, while NT on paper took a lot of concepts from VMS, in implementation it tended to sacrifice them in the interests of perceived at-keyboard performance.
And even that said, VMS was first seen on the VAX in 1977, and its first non-beta release was in 1978.
Other, older OSes did have different multi-user paradigms, but they were far, far more baroque than the simple file/directory ownership one that most modern OSes inherited from Unix and tended to be based more on volume ownership than file ownership (because they in turn tended to look at the world as a series of mounted tapes rather than random access hard drives).
"It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
No offence, but you sound like a user, not someone who actually knows much about operating systems. As someone who knows a fair amount about operating systems, I conclude Windows is very useful, but it is poorly designed with a good deal of rushed implementations. It doesn't compare favorably to Unix in terms of design.
I'd like an OS expert to comment, but I've yet to meet one who isn't zealoted in proposition of Unix, or something really obscure (Plan9 anyone?), so it's hard to get a decent comment out of them. In my experience.
While not a kernel hacker, I do know a good deal about operating systems, having studied them relatively instensly in college.
The reason that you find UNIX zealots is because the UNIXes were written so many years ago and still represent the best in OS design and development. Plan9 was also an incredibly solid OS, although the laptops it ran on were a ton if they were a pound.
My point was in relation to the parent of my original post, who insisted that Windows ability to be hacked was because it was a piece of shit. On the contrary, for the amount of third party drivers, software, and backward compatability in Windows XP and 2000, the Windows OS is indeed quite an achievement. Would I like to see MS concentrate more on security? Sure. But one of the reasons that OSX may be more secure is that they own a lock on driver interaction, hardware compatability, and have several times shunned backward compatability in the OS.
My point was simply that there is still a lot of improvement to the security model that all OSes could use. Windows is hardly alone in the world of insecure OSes.
Excuse my speling.
Making The Bar Project
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
I have to disagree. OS X's marketshare is much smaller - *especially* as a relative measure - than Classic's was.
Really, OS X machines are simply not on the radar of malicious coders. There's not enough of them to be useful as distributed networks of any type and very few enterprises use OS X Servers in "useful" (from an exploitation perspective) mission-critical roles. To be blunt, there's hardly any reason to target Macs (as a general thing) in the first place.
Added to that, it's my feeling that the end-user demographic of MacOS has moved away from its historical "clueless user" base in recent years and is now largely made up of people who - while they might lack in-depth technical knowledge - are accomplished and experienced computer users able to identify most scams(/trojans) for what they are. Plus, as you note, news spreads fast in the Mac community - scams are relatively short-lived and the majority of machines are patched and up to date.
Even ignoring marketshare - which I firmly believe to be an integral part of a platform's "perceived security" - OS X simply doesn't have the same risk profile as Windows. Neither does Linux, for that matter, but mostly for different reasons.
IMHO, until marketshare levels are at least in the same ballpark, meaningful comparisons based on "security reports" are impossible - because there's a whole bunch of other stuff that comes along with increasing marketshare that dramatically changes the risk profile of a platform. If Linux and OS X were to (collectively) get up up around the 40% - 50% mark of the Desktop market, then I'd say meaningful comparisons could start to be made, based on things like how frequently exploits occur, their impact, etc, etc. Until then, no chance.
Er, then what do you call the Administrator account?
Granting that I may hold a misconception of the definition of 'super-user'. But you can't hide anything from Administrator, nor can you deny any permissions to the Administrator.
http://undecidedgames.blogspot.com
I never said it was enabled in the default configuration. I only said it was possible.
In Repressive Burma, it's not just your connection that dies. slashdot.org/comments.pl?sid=314547&cid=20819199
Yes I have to agree, nix security is just waiting for attention. I imagine bash or just plain sh could produce a fair amount of malware. Bash is powerful and is basically installed on all *nix which removes the "heterogenous environment" argument.
You could always use wget to grab a platform specific version of yourself if you were spyware/malware anyway.
And anyway, it's mostly social techniques that get most malware on boxes nowadays. All those activex controls tend to require dialog confirmation, but they target kids sites and the kids just ok everything.
I don't think Vista plans to address that, but of course, Macs don't either.
Your points raised a number of things worth mentioning.
:P
I think using W2K/FF/Eudora/Pegasus instead of XP/IE/Outlook has benefitted me greatly over the years. First of all a virus arriving at my email client doesn't have a chance since it's so old it cannot even open attachments or view complex html. W2K has been patched up pretty well with SP4+SR2. IE on my machine is disabled as far as possible and its internet connection is banned. A small program sits on the registry and notifies me if some process wants to change it. And finally a software firewall, and in the end my hardware firewall on the router will block any attempts by unknown software doing anything I don't like.
So as you can see, I'm not just complacent about not using anti-virus software but I've actually found a better alternative. This way I'm in control and don't overburden or impede the machine's daily functions. BTW: I do also run an Apache/SSL and SSH servers on this same machine so those firewalls are there for a reason.
I would comment on your doubt as to the security of Firefox. Indeed it is very likely that vurnerabilities will be found in it. However this does not make it unusable. Any kind of virus software won't protect you against birthday viruses so as long as you keep uptodate with news on the current vurnerability situation out there while keeping your nose clean of unrealiable sites you're very unlikely to be the first one hit by it and consequently will have warning in advance to avoid and patch up any such vurnerabilities.
At the end of the day you have to balance your needs and requirements in the altar of security vs. usability. I've found that virus-software impedes usability too much without giving me much security in return. But taking regular backups and having a spare machine also helps.
www.tribalnetworks.org - helping tribal people around the world to own their own means of high-tech communications
Now THAT was an informative comment. I learned something today.