First Scareware For the Mac

I Don't Believe in Imaginary Property sends us news from F-Secure of what they claim is the first rogue cleaning tool for the Mac. MacSweeper is a Mac version of Cleanator, hosted from a colo somewhere in the Ukraine. The article points out that the company's About page is lifted verbatim from Symantec's site. With the Mac's market share closing in on double digits, perhaps it's not surprising to see the platform targeted with crapware as PCs have been for years. The F-Secure author adds as a footnote that a journalist said to him something you don't hear every day: "I visited the macsweeper.com website. I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected."

Comments

Oh no!

[luftrofl]

Don't show this to everyone claiming that macs don't get viruses!

Re:Oh no!

[Fluk3]

"Claiming"?

Re:Oh no!

[moderatorrater]

Would you prefer "Proclaiming", or "acting all snobbish while saying", or "falsely believing"?

Re:Oh no!

[Tsiangkun]

I'd prefer to focus on the ZERO self propagating pieces of malware in the wild.

Re:Oh no!

[webmaster404]

Everything can get viruses that can run code on them. This includes the PSP, Linux, BeOS, the DS, ETC. However it is true that Linux/Unix have a much, much lower risk of malware then Windows.

Re:Oh no!

[Anonymous Coward]

Don't forget to focus on the MANY pieces of common third-party software you won't be able to run in your malware-free haven, or the number of third-party products where the performance of your machine will go to waste because there was no point the third party writing up-to-date, optimized drivers and utilities on a platform used by a tiny fraction of their userbase.

Re:Oh no!

[bigstrat2003]

Doesn't matter. Stupid users trump all possible security measures (except locking them out of the system for their own good, which isn't really feasible), and there's no shortage of them. Until the programmers can prevent stupid users from infecting their systems, it doesn't matter how damn many malware samples there are in the wild, and you have no right to be smug about the security of your OS.

Re:Oh no!

[webmaster404]

No, it has a couple of advantages.

1. Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system.

2. Most software is installed through a repository. Now, I realize that Mac does not by default (although there are projects to port apt-get and the like to it) but most distros of Linux have a way of installing via the repository.

3. Most first-party OS-X software is at least partly open-source including the key components of the OS such as the Kernel, Browser rendering engine, and some of the other utilities. This adds a layer of protection to prevent programming errors from not being noticed as anyone can look at the code and submit fixes to it. In addition, this adds security by having parts of Safari being looked at to prevent such flaws as drive-by-downloads which were a major problem of IE and a reason many Windows users got infected by malware.

While it is true that if someone really wanted to mess up OS-X or were just plain stupid they could. However, the chances of Unix breaking from normal usage are far far smaller then those of Windows.

Re:Oh no!

[Architect_sasyr]

While it is true that if someone really wanted to mess up OS-X or were just plain stupid they could. However, the chances of Unix breaking from normal usage are far far smaller then those of Windows.

You need to meet some of my designers. I spend more time rebuilding OS X machines and correcting privileges than I do with the windows users... incidentally this never happened on the OS 9 installs, so the additional power that having a Unix system around can give is actually what is causing me and my users the most grief here.

Your comments on OS code, whilst quite valid, are actually rather incorrect. Something that a lot of people seem to fail to remember with open source code is that the code IS available IF you wish to look at it. Personally I've never gone near the Kernel code, so I wouldn't have a clue if it is secure or not (perfect example of this: Firefox).

My $0.02 AU, Ignore at will.

Re:Oh no!

[webmaster404]

For your seeing more OS-X machines, I think part of it could be the popularity of OS-X is way more then OS-9 ever was, and yes Unix sometimes is tempting to mess around with mostly with the strange names for files (fstab anyone?) that although are nice on a command line look obscure when looking at it in a GUI. But then again, I don't know your situation but if it is computer repair, part of it could be the Windows users who are so used to coming in for repairs switching to Macs and lacking the Mac or Unix skills to fix problems.

Yes, most people don't look at the code, however it is nice that you COULD look at the code if something seems off on a new update or such. One of the reasons I won't use Opera for any extended period is when I think about how much information passes through my web browser how do I know that it really is safe? However, it is nice to know that other people can look over the code and that you can too, plus, who is going to try to hide spyware in a GPL'd product?

Re:Oh no!

[Aetuneo]

Not a virus, just a trojan horse. Program claims it does something that it doesn't, program is installed, program does what it actually does. Nothing in the article suggests that this installs itself, just that it tries to get the user to install it.

Re:Oh no!

[Garridan]

As a linux user, I am under no delusion that my system is "more secure" than a windows box or a mac.

For me, the worst thing that can possibly happen, is somebody destroys my home directory. Ok, that's easy, if a virus is logged in as me. If they hose my system, so what? I can always re-install linux, that isn't a problem. There aren't any other users. I allow myself access to the internet and to email, so if a virus starts spamming the world, well, that isn't stopped by security policy either.

What you're talking about is a linux server. There, it's hard to root the machine and cross-infect, sure. But what spreads viruses the most these days is users downloading shit in email and not knowing that their browser just executed something. Linux is *not* more secure. *I* am a user am less prone to viruses because I maintain a strict policy of which sites I use each browser for, where I take cookies from, and I browse sketchy shit only inside vmware and restore from a clean image frequently. But I'm still vulnerable to all sorts of attacks -- if google pushes an ad with linux-targeted malware, for example.

If you think linux is somehow inherently virus-proof, you're deluding yourself. Using linux on the desktop is the same as using any other desktop system -- if somebody else knows how to make an executable for your system, it's probably vulnerable.

Re:Oh no!

[Anonymous Coward]

Working with mixed version OS X macs in a windows domain can be a pain as well. The worst is when you have Mac network applications that were not programmed with windows 'security' in mind so you can't have the users logged into the domain... yet the mac itself is still in the domain. Hilarity ensues as the users try to 'fix' permission settings!

who knows... but then who'd want to use exchange with a mac anyway? :P

Re:Oh no!

[Anonymous Coward]

Until the programmers can prevent stupid users from infecting their systems,

This is an under-appreciated benefit of a less user friendly operating system: fewer "stupid users" will be interested in using it -- at least to any deep extent -- thereby leaving those that do in a safer community.

Re:Oh no!

[Architect_sasyr]

I don't know your situation but if it is computer repair, part of it could be the Windows users who are so used to coming in for repairs switching to Macs and lacking the Mac or Unix skills to fix problems.

They're designers... they've been using Mac since before I was born. They also tend to stay away from the command line (that Terminal.app thing scares the hell out of them whenever I fire it up). The popularity has nothing to do with their usage of the system, as they were fine using OS 9 before hand. I work for a media company, the designers are all over the place and always use Mac.

who is going to try to hide spyware in a GPL'd product?

I don't know but considering some of the code that one can write can be obscure as hell I'm sure spyware could be slipped into a product with relative ease. Whilst I've forgotten who and what, there was some PABX software recently that called home (it always had) that took $x long to become well known... leave you to think on that.

Re:Oh no!

[joeytmann]

Agreed, and I would like to add that there is the possibility that some one can look at the code, find the bug and exploit it. For years MS thought they built a secure product(ok well maybe they thought that) and look where it got them. Just because software is open or closed doesn't make it more or less secure than the other. Software is made more secure by quality programmers/testers/patches/testers/updating/testers. Replace anyone of those with crap and your odds of making crappy/buggy/exploitable software goes up....

Re:Oh no!

[nesta]

True, the worst thing that can happen is that your home directory is wiped out, but if you logged in and saw that all your files were gone you would immediately log off and log in as a different not infected user and could easily clean up your system, so the virus would have a very short time to spam the world or whatever it was released to do. So it wouldn't wipe out your files, but would instead try to hide, and it wouldn't have very many places to do so.

This is why using a system with clear privilege compartmentalization makes viruses much less of an issue. Once infected they are easier to detect and much, much easier to clean. Sure you can reinstall Linux if rooted, but you can almost as easily reinstall Windows. If the security model is set up correctly, though, normal use shouldn't put you at risk of having to reinstall your OS just to clean it up.

If the end user is the security risk they should be running in a mode that minimizes the risk to the total system. This is why a stock install of most Linux distributions *are* more secure than stock Windows distributions.

Re:Oh no!

[Arcady13]

There are no hyphens in Mac OS X or in Mac OS 9. Would you talk about Windows-95 or Windows-Vista?

Re:Oh no!

[b1gp0pp4]

hear hear! Wish I had mod points!!! To stray from the car analogy... a computer expert is out in the jungle searching for weeds that sting, poison, or otherwise get in the way of all the other software... which is also a bunch of crazy plants. crap i just dropped my iphone.

no time to replace my sig. i just dropped my iphone. i'm not a mac fanboy but god i love this phone.

Re:Oh no!

[morbiuswilters]

Almost every techie I've ever met who makes a broad statement like "(Linux|OS X) is way more secure than Windows" has been so security-retarded it's not even funny. I've used Linux exclusively for years but I'm under no delusions that any general-purpose execution environment is malware-proof. I used to run Win98 and Win2k without anti-virus or firewall and I only got a single virus in 6 years because I opened an exe sent to me by a friend. On my Linux box, anything worth doing can be done as me: stealing personal information, sniffing passwords and credit card numbers, running a botnet client or a daemon on a non-privileged port. I've also got SSH keys that grant me access to my own dedicated boxes, as well as dozens of my employer's servers, not to mention the source code to proprietary applications worth millions. What makes Linux safer is that most people aren't writing trojans for Linux. It's almost sad to watch the Mac market grow like it is, knowing what it will rain down on the smug little bastards. I've got nothing against Mac users, but at this point their hubris is almost Titanic in its proportions. Additionally, Linux has a steeper learning curve than Windows or Mac OS X, meaning most users are more likely to be aware of proper security concepts. Still, I've found rootkits on the servers of many *nix sysadmins. Oh, and they all believed Linux was "way more secure" than Windows.

Re:Oh no!

[socsoc]

My experience in a mixed environment for a media company are that the problem machines are whatever's oldest at the time. Doesn't matter if it's the XP machines in sales or the OS X machines in design, the machines next in line to be replaced are the ones that start to bite it... I love how you're comparing OS 9 to OS X. When we were running 98, often times a simple reboot would fix the problem, that doesn't work as much with XP so obviously 98 is superior.

Re:Oh no!

[dryeo]

1. Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system. So you figure it is better to only lose your home directory containing everything you care about, email, pictures, personal documents, all your settings like bookmarks etc. As long as the rest of the system, which is easy as hell to reinstall, is not compromised?
As a desktop user I severely disagree, I'd rather lose everything but ~ and if I'm stupid enough to run malware that malware will have the necessary permissions to delete everything I care about.
And about opensource being better because people can look at it and find vulnerabilities. Have you ever looked at the Mozilla code? Lots of people have and yet regularly there are new exploits found, some that have been there since the browser was called Mozilla.
I monitor a few open source applications mailing lists and often when a security vulnerability is found, it has been there a long time. How many more are lurking in that mess of C++ code?

Re:Oh no!

[toadlife]

1) Windows has user privileges that work too. The default settings of XP suck though. A definite +1 for UNIX in that regard. Vista *finally* addresses this. As for people being "stupid", you obviously overestimate the aptitude of the masses. A few years back a email worm for Windows came in a password protected zip file with the password in the body of the email...and it spread! Yes, people actually put the password from the body of the email to open the zip file and executed the payload.

2) The repository model, while nice (FreeBSD ports rocks!), would never work in the free market software ecosystem where proprietary software dominates the landscape. It would be like herding cats. Even in a ecosystem where most software is open source, I still think would fail if the amount of software available approached that of the amount of Windows software. The sheer scale of it would be too big, and conflicting interests would end up destroying it. My point is that if Linux gained a significant installed base, the repository model would fall apart the and Linux would be pulled into the "wild will west" where Windows currently resides. OSX has the same free market model as Windows anyway, so I don't see how it directly related to this article.

3) Meh.

BTW, to the fuckwads who modded me down for questioning the god of UNIX:

Fuck off! <---(That's "-1 Flamebait" right there, bitches)

Re:Oh no!

[atraintocry]

Obviously nothing's ever for sure, especially not with your computers. But if your browser isn't running with elevated privileges, then you don't need to worry about malware coming in through it the way people with WinXP + IE6 do, save for any specific & isolated exploits. So I would argue that linux is more secure (if by linux we mean "your average linux distro") because your average distro is going to install software from a trusted repo, not have a default install that leaves you running your browser as root every day, and will also give you the tools to control your network interface. And even if you don't use those tools, the fact that 9/10 of the linux users out there do use them does in fact make you a little safer. It gets better...the myriad differences in distros, software packaging, and choice of software means that any "linux" exploit is not going to affect all linux users, unless it's at the kernel level, and even then, there's plenty of variation in people's kernels. Safety in numbers, I guess.

Re:Oh no!

[howlingmadhowie]

not quite. the theoretical possibility of someone looking at the code is not particularly comforting. the good thing is, people actually do. let's say there are 100 million firefox users worldwide. now if only a thousandth of one percent actually looked at the code, it would still be 100 eyes outside mozilla/google/whoever totally unattaced to the company looking at the product and helping to fix things or warn us of problems and malign features.

the point of open-source software is not that you personally look at the code (this is aimed at the parent) just as the point of doctors is not that you personally are one.

Re:Oh no!

[novakyu]

Stupid users trump all possible security measures (except locking them out of the system for their own good, which isn't really feasible), and there's no shortage of them. It sounds like we need a friendly user helper agent that will remind users that what they are about to do could be dangerous for their data and prevent them from performing such actions. I am thinking that this agent should be enabled by default, cannot be deactivated except by calling customer support to get the deactivation key, and to inspire user confidence, it should look like something that they see everyday. Like a paper clip.

Re:Oh no!

[brad77]

What the hell are you talking about?

Re:Oh no!

[cp.tar]

And about opensource being better because people can look at it and find vulnerabilities. Have you ever looked at the Mozilla code? Lots of people have and yet regularly there are new exploits found, some that have been there since the browser was called Mozilla.

I would argue that they are found precisely because people are looking at the code.

You can't find them all at once, especially if you're focused on development. But I don't have to explain how much easier it is to patch the exploits when the application is open source — Firefox vs. IE record speaks for itself.

Re:Oh no!

[TheCrackRat]

This is an under-appreciated benefit of a less user friendly operating system: fewer "stupid users" will be interested in using it -- at least to any deep extent -- thereby leaving those that do in a safer community.

Security through obscurity?

Re:Oh no!

[xtracto]

I monitor a few open source applications mailing lists and often when a security vulnerability is found, it has been there a long time. How many more are lurking in that mess of C++ code?

Haven't you thought that it is funny how everything is in the last place you look for it?. That is, the place where you find it.

But yeah, I also laugh when reading those comments saying that the "only" thing that can happen if a virus infects a Linux machine is that you could lose your home directory which contains all your data... Sheesh, fortunately all the prgorams (which are available all over the internet, and in my installation disk) will not be touched.

Re:Oh no!

[Anonymous Coward]

if google pushes an ad with linux-targeted malware, for example. What is that?

Re:Oh no!

[weicco]

1. Privileges, an ordinary user can't mess up the entire system.

Spam bots don't need admin privileges. Just that they get pass the firewall. An evil mIRC/Irssi script would be a great example I think.

Re:Oh no!

[TheVelvetFlamebait]

Nah, don't look so worried. I doubt they'd learn anything.

Re:Oh no!

[Anonymous Coward]

But yeah, I also laugh when reading those comments saying that the "only" thing that can happen if a virus infects a Linux machine is that you could lose your home directory which contains all your data...

I think you are missing two important points.
Firstly, if you have multiple users, each is protected from the others' infections. My wife and I share a Fedora system; she's a novice and I'm reasonably experienced. In the unlikely event she managed to run some malware, at least only her home directory could be hosed, not mine - damage limitation. Same applies but even more so with kids involved.
Secondly, it's easy to backup the entire /home directory very frequently (e.g. using rsync or some 'friendlier' gui backup tool), and if it gets hosed you can just delete it and restore from backup in a few minutes. And you need to frequently backup /home anyhow in case of drive failures.

So no, Linux's file system structure and permissions aren't a magic wand, but combined with backups you should already be taking for other reasons, they make recovery from user-specific malware almost trivial.

Re:Oh no!

[jargon82]

I think the doctors point was a bit off... but how bout an example of a major advance in cancer treatment? You won't apply it, yourself, but you could still potentially benefit from a skilled practitioners ability to apply it on your behalf. The open source model is similar in some ways.
On the other hand, I suspect alot of those 100 eyes will be looking at what they find interesting or think needs improvement. Given this, it wouldn't be all that hard to hide evil code in an unusual (and boring) place.

Re:Oh no!

[Anonymous Coward]

So you figure it is better to only lose your home directory containing everything you care about, email, pictures, personal documents, all your settings like bookmarks etc. As long as the rest of the system, which is easy as hell to reinstall, is not compromised?

And I say to you the same thign I say to all my clients.... Where's your backup? If you are running a computer without backing up important things.....

Then you truly are stupid. Losing 5 years of family photos is a mark the stupid carry. For the love of Snod BACK UP YOUR FILES.

and I guarantee that this is not the only time you have heard this. Why dont you own or subscribe to a backup system? I have a cheapie DAT tape backup system that backs up 80 gig at a time, I put in a tape, press start and walk away. I also back up to DVD's on a regular basis.

Why dont you?

Re:Oh no!

[Anonymous Coward]

Well, this seems to work for Windows users (once all of its tips/tricks/techniques are applied, via CIS Tool guidance, & NOT VIOLATING SOME "RULES" it sets (javascript, iframes, email attachments, & others in its content):

HOW TO SECURE Windows 2000/XP/Server 2003 & VISTA (+, make it "fun" to do):

http://www.security-forums.com/viewtopic.php?t=50567&sid=2f63dc96d17dec0292428d140267832c

It works, & in BOTH Business + Home LAN/WAN environs (as well as for "standalone" non-networked rigs online connected to the public internet) to secure folks online using modern Windows NT-based Operating Systems of today.

APK

P.S.=> I wouldn't call myself "smug" for using it, just confident & happy - as are the users' testimonies from those that tried & applied it themselves in BOTH home & business environs in fact... it just works! apk

Re:Oh no!

[Anonymous Coward]

I don't see how cookies can cause any sort of problems. Really 4kb of plaintext is dangerous, I have never understood the commotion around cookies. Sure cookies can be used to track people between sites, and idiotically store CC#'s But honestly what is the threat of cookies. As far as I can tell its all FUD.

Re:Oh no!

[Anonymous Coward]

If you weren't running antivirus or a firewall how in hell do you know your PC wasn't riddled with malware for those 6 years but you only found one of them?

Re:Oh no!

[Anonymous Coward]

Don't you mean: "linux-targeted malware:does not compute"! :D

Re:Oh no!

[MachineShedFred]

As an administrator of 100-odd macs myself, used in advertising design and textile design, let me give you a foolproof recipe to making your life 95% easier:

1 Mac OS X Server, configured with all users in Open Directory, and policy to lock out users from system preference panes they have no business being in

1 FileWave server for application deployment and file integrity checking, obtainable from www.filewave.com (note, this will cost money, but will pay for itself the first time you don't have to reinstall an application, because whatever file the user just fucked up just got checksum'd and rewritten)

x users NOT running as a local administrators of the machine

1 unlimited license of Apple Remote Desktop, so that you can remote control / observe, execute code, get system reports, etc.

Mix ingredients together, bake at 350 (or 177 C) for 20 minutes.

Re:Oh no!

[Cro Magnon]

Linux & OSX ARE more secure than Windows. Windows has ActiveX & IE. Other platforms don't. Most Linux distros fix their holes fairly quickly. Microsoft doesn't (though they're better than they used to be).

That doesn't mean people can afford to be complacent. A stupid user who will give his password to see Britany pics is going to get pwned, even if he's running OpenBSD.

Re:Oh no!

[Cro Magnon]

The thing is, it's not a choice between losing your stuff and losing the system. It's a choice between losing EVERYTHING and losing your stuff. Either way, your stuff is toast.

I agree that my stuff is more important than the OS, but it's at least slightly easier to restore the good stuff if you have an uncorrupted OS.

Re:Oh no!

[Just Some Guy]

I maintain a strict policy of which sites I use each browser for, where I take cookies from, and I browse sketchy shit only inside vmware and restore from a clean image frequently. But I'm still vulnerable to all sorts of attacks

I understand that meth addiction is difficult to kick, but I urge you to please consider it for your health, both physical, and - particularly - mental. With time the paranoia will subside and you will be able to return to rational, productive behavior. Remember, we're here for you.

Re:Oh no!

[Anonymous Coward]

But we like to call it Gentoo.

Re:Oh no!

[Tsiangkun]

A user can be educated.

An OS that can be exploited with no user intervention is an insecure operating system.

Let me reiterate my point.

There are ZERO pieces of self propagating malware in the wild for MacOS X.

Re:Oh no!

[Anonymous Coward]

Something occurred to me after reading your comment. Arent Macs supposed to be easier to use? You know, dumbed down to a lowest common denominator? Doesnt this automatically imply that the Mac has a very large vulnerability by design, built right into the chair?

Re:Oh no!

[LWATCDR]

"So you figure it is better to only lose your home directory containing everything you care about, email, pictures, personal documents, all your settings like bookmarks etc. As long as the rest of the system, which is easy as hell to reinstall, is not compromised?
As a desktop user I severely disagree, I'd rather lose everything but ~ and if I'm stupid enough to run malware that malware will have the necessary permissions to delete everything I care about."
That is worst case on Unix. On Window worst case is you lose EVERYTHING. So yes it is still slightly better.
Do you have kids? Does your spouse use your PC? Again the worst case is that user can infect and maybe loose there home directory and not everybody's.
So yes it is better to just loose your home directory. BTW make backups. No matter how secure you OS is that important data is sitting on a drive that will fail some day.

"I monitor a few open source applications mailing lists and often when a security vulnerability is found, it has been there a long time. How many more are lurking in that mess of C++ code?"
Yes but that is the key. They are out in the open. How many more are lurking in that mess of C++ code that is Windows that nobody fixes?

Linux has a higher security rating than Windows at least that is what the US government says.
If you want a really secure OS then I suggest running VMS :)

Re:Oh no!

[bigstrat2003]

The users never will be educated. No matter how many we catch, there are thousands more that go past us unnoticed.

Since we can't ever educate all users (or nearly all), all operating systems are insecure.

Let me reiterate my point.

The number of "self-propagating malware" pieces in the wild is just e-peen waving. All operating systems are insecure against the only thing that matters, and if you think that the situation will be any better the moment (SELECT * FROM osnames WHERE os != "Windows") is the primary OS in the world, you're only fooling yourself.

Re:Oh no!

[Anonymous Coward]

I prefer to focus on Jessica Alba.

Re:Oh no!

[Tsiangkun]

I don't disagree that the user is the most exploitable part of the computer system. see Honestly, I don't care about any computers that I don't use. If all the exploits require user intervention for my chosen systems, then I will continue to feel pretty secure in using them.

Re:Oh no!

[Alex Belits]

But yeah, I also laugh when reading those comments saying that the "only" thing that can happen if a virus infects a Linux machine is that you could lose your home directory which contains all your data...

Your data is worthless. Everything on the computer is worthless compared to the ACCESS TO OTHER COMPUTERS with ability to impersonate you. I can back up, erase and restore my home directories all day, but $deity forbids, someone will be able to use my computer to impersonate me on the network at my work, modify my backups or interfere with my work when I handle other people's accounts.

Re:Oh no!

[toadlife]

They're designers...they've been using Mac since before I was born...that Terminal.app thing scares the hell out of them...they were fine using OS 9 before hand. Is this one of your designers? ;)

Re:Oh no!

[Anonymous Coward]

You're right that Unix-style permissions aren't all that great. What's cool though is that now there are flavors of Linux that allow permissions by *application* instead of just by user. Per app permissions are much better, because it means you can say that MailAttachmentApp is not allowed to erase anything or that DriveByDownloadApp isn't allowed to use your webcam. See the OLPC project's security page. They've incorporated this kind of security into their machine. Sure, it's still not perfect or a guaranty that you won't lose data -- but it's better than any current system.

Re:Oh no!

[webmaster404]

Any application though can delete your My Documents folder in Windows. However many applications can mess up your Windows install too. Therefore even when Linux can have the home directory erased, Windows has that and more.

Re:Oh no!

[Haeleth]

Honestly, I don't care about any computers that I don't use.

"Use" or "operate"? You almost certainly use quite a lot of computers you don't operate. Slashdot, for example: you were using the Slashdot server when you posted that comment button, but how much control do you have over the security practices of the people who operate it?

Maybe the worst thing that could happen if your Slashdot account details were compromised would be that your account would be used for trolling, and quite possibly that doesn't bother you in the least. But what other computers do you use in similar ways? What about all those online stores you've probably given your credit card number to over the years - wanna bet all those are only operated by highly-trained security professionals? Because I don't. What about government agencies? We've hardly been short of "stolen $DEPARTMENT laptop held $MANY million citizens' personal details" scandals in recent years...

And I think we all know why so much spam comes from residential IP addresses, right?

Given which, I'd really rather there not be any malware at all for any operating system. An OS that has malware in the wild is an insecure OS. Just because all the malware requires user intervention doesn't mean the OS is secure. It means it's more secure, and clearly a superior choice over OSes that suffer from hands-off malware, but "more secure" doesn't mean "safe" any more than "growing up" means "mature".

Re:Oh no!

[sammydee]

This is why you don't get any malware for linux.

Re:Oh no!

[toadlife]

By blaming ActiveX and IE for security problems in Windows you've proven the parent posters point quite nicely.

IE and ActiveX are no different from Firefox + Addons or Safari + Java JRE in that they are all just browser/plugin combinations. All can be exploited to the same extent. IE + ActiveX's ubiquity has been it's greatest downfall.

Re:Oh no!

[Tsiangkun]

good point

Re:Oh no!

[klez23]

Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system.

Nowadays, that's a backwards priority, and we need to stop prioritizing system over data, if you ask me. Most computers of these UNIXy machines (OSX, Linux, even NT-based windows for the point of discussion) folks use nowadays are essentially single-user, or at most a family. It's exactly the user's files that are important. If I (or a trojan) nuke my OSX system, I can just pop the Tiger install disc back in & be back up in an hour (or two, allowing for third-party software installation). If I lose all my data (either due to stupidity or malware), I've lost months of work, unless I've backed up. (Kudos to Apple for simple backup in Leopard...)

The idea that the system is more important than the data is a relic of shared-use UNIX workstations, if you ask me.

Re:Oh no!

[Anonymous Coward]

Thats because all your software is written by jokers with no Standards.

Re:Oh no!

[Symphonix]

1. Privileges, an ordinary user can't mess up the entire system. Unless the user is *really* stupid, they are not root and therefore do not have Write privileges on system-critical files. So even if you ran "rm -rf /" as a normal user, you would only lose the files you had access to and not break the system. This is not entirely true. Yes, the root account is locked out by default, but the default "out of the box" user account is a super-user, and therefore if you ran "sudo rm -rf /" you really would have a problem. The only thing is the malicious software has to convince you to enter your password in order to do this.

This is a reason why I suggest, if you set up a Mac for a family you should keep the admin account to yourself, and give everyone else a user logon without admin rights. The Mac is marginally more secure than windows, but you still have to use judgement and commonsense.

Re:Oh no!

[Garridan]

You people seem to forget that the first big worm spread around the internet and brought the entire thing to a halt... all running on Unix. Linux-targeted malware is malware that has been crafted to take advantage of a hole in Linux. Find a hole in firefox on linux, and you're 99% the way there. If you don't think that's possible, I've got a bridge to sell you...

gamespot gave it 11 out of 10

[User 956]

With the Mac's market share closing in on double digits, perhaps it's not surprising to see the platform targeted with crapware as PCs have been for years.

I didn't realize Kane & Lynch had been announced for the Mac platform

Re:gamespot gave it 11 out of 10

[MacSweeper]

A Letter to Mac Community We'd like to address the community of Mac users on behalf of the creators of MacSweeper. Our product has been slandered a lot recently. It has been accused of being a "rogue" application and imputed false functionality to. We'd like to dispel this misguided opinion and show you that MacSweeper is a really useful application and the best of its kind. 1) What is MacSweeper and why would you need it? MacOS is considered one of the most secure operating systems in the world. Nevertheless security in general depends not only on the OS but on the user and programs running under it. That's why for user's data protection MacSweeper was developed. Removing Cookies belonging to sites in the blacklist Different companies use Cookies for tracing user activity, some of them have dubious reputation since malicious software has been transmitted through their networks or from their domains. Such domains are put down to the blacklist. MacSweeper prevents user's data from being spread by removing those cookies while keeping user's personal cookies safe. Cleaning user's and system cash Our security experts have found that a lot of private information is stored in application cash and can be accessible for malicious software somehow launched on your mac. Moreover, by cleaning application cash you can free lots of space on your hard drive. Cleaning application and system log files Log files mostly contain information that an average user will never need which can be deleted trouble-free making additional free space available. Universal Binaries & Languages Mac applications are commonly assembled for different architectures and with multi language support. Users never use architectures other than their native and seldom use different languages. So it is possible to compress all these applications according to the needs of a specific user. Therefore MacSweeper is not an antivirus, antispyware or antimalware application. Also MacSweeper has nothing to do with "rogue software" though many influential companies have labeled it this way and try to convince all users of it. But if you just read the definition for "rogue software" here http://en.wikipedia.org/wiki/Rogue_software and then launch and activate our product to study its functions you'll realize MacSweeper is NOT a "rogue software" and we don't use anything mentioned in the definition. Rogue security software is software that uses malware (malicious software) or malicious tools to advertise or install itself or to force computer users to pay for removal of nonexistent spyware. 2) Our advertisement pages Many authoritative companies don't like our ads pages saying they display lies. Here let us draw an analogy to creating and selling toothpaste as a simple commonplace example. So imagine yourself you are sitting back on your couch and you see this toothpaste advertisement which says using this toothpaste once will keep your breath fresh 24 hours. But when you buy it and clean your teeth in 100% cases your breath won't stay fresh that long. Nevertheless you're not going to run out in the street shouting that a certain company produces "rogue toothpaste". Our advertisement pages are just the same - nothing more than a usual ad, simple animated pictures. 3) Other false opinions Some users who had installed our product later wrote on forums that MacSweeper finds a number of objects on an absolutely clean machine. Our answer is - of course it does and before making statements as the one above you need to understand what the program finds. Every clean system, even a brand new Mac, has lots of trash files, universal binaries & languages and that's why MacSweeper wil find a lot of objects there. 4) Analyzing our product by authoritative companies We were amused by the fact that a certain authoritative security software development company with a big name and experience wrote a review on our product based on its design and used pictures. However as we could see from a review, the company employees hadn't ev

Not the smartest journo

[MLCT]

The journalist should have visited using a linux livecd. If the site hosts mac malware then it is a pretty good bet they already have established "businesses" in the field of windows malware.

Re:Not the smartest journo

[Chyeld]

Real security experts telnet to port 80 and hand craft their HTTP requests. It's the only way to be sure!

Re:Not the smartest journo

[pilgrim23]

Remember the Brit "journalist" who posted his own data to prove ident theft a hoax? Sounds like this fellow attended the same training seminars...
as to the crapware: gosh and golly gee! Now that I have expressed apropriate concern let us move on...

Re:Not the smartest journo

[WillAffleckUW]

Real security experts telnet to port 80 and hand craft their HTTP requests. It's the only way to be sure!

I prefer port 8080 myself, but then I used to check the CERN beamline just for fun.

Re:Not the smartest journo

[xannash]

That may be the way "REAL" security experts do it. You need to keep in mind the person is a journalist and propably not a security expert. Besides if you were to use a Linux LiveCD to login and have no HDD or Flash Drive plugged into the machine, no damage would be done, at all.

Re:Not the smartest journo

[MrKevvy]

re: "If the site hosts mac malware then it is a pretty good bet they already have established "businesses" in the field of windows malware."

If the site was detecting the user agent or using some other method of determining platform and delivering targeted malware based on it, I doubt they would have also been delivering a fake Mac scan to a Windows browser as they did in the article.

Re:Not the smartest journo

[Anonymous Coward]

Way to miss the fucking point...

Re:Not the smartest journo

[Anonymous Coward]

nah, the real security experts manually tap out the cryptic series of zeros and ones required to make the request.

Re:Not the smartest journo

[somersault]

at 56000 baud

Re:Not the smartest journo

[Anonymous Coward]

http://xkcd.com/341/

Re:Not the smartest journo

[mysidia]

Real security experts craft the raw TCP packets to request the page, inject them into the network by hand.

(Capture the responses with tcpdump, and analyze them with hexdump: to avoid the risk of the site exploiting a terminal control code vulnerability (ANSI escape sequences) or telnet protocol vulnerability.

Re:Not the smartest journo

[Gideon Fubar]

you can't get 56000 through an acoustic coupler..

Re:Not the smartest journo

[Max Littlemore]

Real security experts telnet to port 80 and hand craft their HTTP requests.

Pffft. Noone who knows anything about security uses telnet anymore.

Really real security experts ssh to port 80 and hand craft their HTTP requests.

Re:Not the smartest journo

[vbraga]

uphill, both ways.

Re:Not the smartest journo

[Angostura]

Clarkeson is a presenter and columnist - not a journalist.

Re:Not the smartest journo

[Zaphod The 42nd]

screw that, you're still vulnerable. The truly enlightened expert has already replaced his vocal cords with a modulator, allowing him to telnet via a phone line and manually interpret the code in real-time.

Re:Not the smartest journo

[aniefer]

I've only ever done this for SMTP. Hardcore man!

Re:Not the smartest journo

[hdparm]

through snow

Re:Not the smartest journo

[Phroggy]

Get off my lawn!

Re:Not the smartest journo

[amirulbahr]

That's how I posted this comment. The hard part was remembering those darn cookies to send back. ^D

Re:Not the smartest journo

[Anonymous Coward]

I take it you are new to computers.

Re:Not the smartest journo

[halcyon1234]

you can't get 56000 through an acoustic coupler..

Who needs that newfangled junk. I can whistle at 56k, and do the binary in my head

Re:Not the smartest journo

[xannash]

Not at all, but please do explain the damage that could be caused. Enlighten me.

Re:Not the smartest journo

[Anonymous Coward]

The parent to your comment was joke. If you knew what he was talking about ("handcrafted HTTP requests", etc.), then you would have understood that, and not gone ahead and given a serious response and revealed your painful absence of any sort of technical knowledge.

Re:Not the smartest journo

[xannash]

Ok, so I'm a jackass...no really.

Re:Not the smartest journo

[jellomizer]

In theory if there is a vulnerability in the Live CD that will allow software to run as root (Which such vulnerabilities existed in the past and may still exist) Then once code is loaded as root it will mount your physical hard drive check to see what OS it is and install whatever code you want on the file system bypassing your actual OS Security Features and Anti-Virus and Spyware code. It could be darn devastating.
You will be much safer if that Live CD Loads and then Virtualized an other Linux Distribution Live and assures that the Virtualization code will not recognize any physical storage information. That way you may have a chance unless there is a security hole in the VM System.

Re:Not the smartest journo

[xannash]

You missed were I said to have

have no HDD or Flash Drive plugged into the machine

"plugged into" being the key

Re:Not the smartest journo

[ookabooka]

You know, in order to send 56K over the phone line you must have a digital hookup on the other end. So dial up customers can receive data at 56K because AOL or whoever has a digital hookup to the telco, but you can only transmit at ~33K. Aliasing frequencies and all that. I highly doubt you can transmit at 56k with an analog channel. Nonetheless, I'd like to see a benchmark of your. . erm. . mouth?

Re:Not the smartest journo

[Mr. Roadkill]

If the site was detecting the user agent or using some other method of determining platform and delivering targeted malware based on it, I doubt they would have also been delivering a fake Mac scan to a Windows browser as they did in the article.

Depends on their intentions, and they could have different plans for different targets.

With Mac users, their intentions might be to sell a product to remove a problem that the user doesn't have... or to give them a problem that can be removed through the purchase of their "remover" product. Or they could be phishing for credit card numbers...

With Windows users, they could be hoping for an influx of people who've received the link from a friend, with the obligatory "I can't believe how stupid spammers think we are - look, it tells me my Windows machine has Mac spyware!" comments... and then installing a Windows rootkit through browser defects. Making themselves look stupid has caused at least one journalist to let their guard down and visit the site.

Re:Not the smartest journo

[Anonymous Coward]

telnet slashdot.org 80

GET / HTTP/1.1
Host: slashdot.org

Re:Not the smartest journo

[TheThiefMaster]

Real security experts telnet to port 80 and hand craft their HTTP requests. It's the only way to be sure! I've done that :(

Re:Not the smartest journo

[Anonymous Coward]

V.92 is an ITU-T recommendation, titled Enhancements to Recommendation V.90, that establishes a modem standard allowing near 56 kbit/s download and 48 kbit/s upload rates. With V.92 PCM is used for both the upstream and downstream connections; previously 56k modems only used PCM for downstream data.

Re:Not the smartest journo

[Anonymous Coward]

Real security experts telnet to port 80 and hand craft their HTTP requests. It's the only way to be sure! I hope you're not using an XTerm, or any other more or less ANSI X3.64 (or whatever) compatible terminal. Alternatively you can try to sanitze the output, otherwise you open yourself to some key redefinition exploits or command injection upon return to the shell. Personally, if in doubt I use echo, netcat and less, otherwise (with my own servers) telnet is good enough.

Re:Not the smartest journo

[Corwn of Amber]

Excuse me? Code that loads as root using a known vulnerability of a fraction of the Linux userbase, those with the precise unpatched versions, then mounts the HD and hides itself without destroying the filesystem data, no matter what FS it is. Yeah, right, as if someone who could do Just That had nothing better to write than viruses...

Re:Not the smartest journo

[slashdotwannabe]

56k?!? Hell, REAL security experts tap their 1s and 0s on an acoustic coupler at 300 baud.

Re:Not the smartest journo

[jellomizer]

I heard a simular excuse about 10 years ago about buffer overflows... Well I never said no matter what FS it is. It just needs to be a common configuration... Most people with Live Linux CDs will normally have Windows installed with either vfat or NTFS. Then if you can mount the drive and put the virus in some key files and break a virus scanner you are all set. Not nessarly an easy hack but if everyone was using a live CD or a lot of people that would be the way to do it.

Re:Not the smartest journo

[pilgrim23]

a dissection that is not a distinction; both are forms of entertainment. Little different from the circus clown or the trained bear.
  See a old play: The Front Page for further information

Re:Not the smartest journo

[Angostura]

Just because you choose not to understand the distinction, doesn't mean there isn't one old chum.

Next week: Why hackers and crackers are actually the same thing, eh?

Cross platform spyware!

[devman]

it was only a matter of time!

Re:Cross platform spyware!

[Shados]

Write Once, Piss People Off Everywhere?

Re:Cross platform spyware!

[Tolkien]

Write Once, Piss People Off Everywhere?

WO/PPPOE

*smirk*

Re:Cross platform spyware!

[Ilgaz]

It has been tried. The media was quick to get alerted about it. A special thank you for horrible Java implementation of Windows that time which sent a "heads up" to Sun and every geek/professional having something to do with Java :)

http://forum.java.sun.com/thread.jspa?threadID=405425&messageID=1966682

http://www.ca.com/us/securityadvisor/pest/pest.aspx?id=453059998

It was based on Java, was distributed by Java P2P application. One should be glad that Macs were still not that popular that time.

Isn't any "cleaning tool" rogue on a mac?

[Anonymous Coward]

The category of "cleaning tools" was rather dodgy even before the trojaned ones started showing up. The notion that getting infected by god knows what, running a little wizard, and being all ok again is insane. Both the notion that one can reliably detect malware that has already had time to romp with your system and the idea that infection is so routine that there should be tools to be run every few days for it are pretty gross.

And now we have an example of this fine species showing up on a platform that doesn't really have malware. How could anybody trust a cleaner for a platform that doesn't, as yet, need cleaning?

Re:Isn't any "cleaning tool" rogue on a mac?

[moderatorrater]

It's been my experience that 90% of the PCs that require cleaning got in that state because the owner's installed something they shouldn't have. In a way, this program is attempting to create an environment where one would be needed.

Re:Isn't any "cleaning tool" rogue on a mac?

[Anonymous Coward]

The category of "cleaning tools" was rather dodgy even before the trojaned ones started showing up. The notion that getting infected by god knows what, running a little wizard, and being all ok again is insane.


Well, the notion that Snake Oil sold by a carnie could cure you of Quinsy and Polio and whatever else people back then suffered from is pretty crazy too, but people bought it in droves. Heck a few years ago I remember being in a health food store and seeing a large jar of shark cartilage pills next to a book called "Sharks Don't Get Cancer." Miracle cures are nothing new and there will always be plenty of suckers to fall for them.

And now we have an example of this fine species showing up on a platform that doesn't really have malware. How could anybody trust a cleaner for a platform that doesn't, as yet, need cleaning?

I dunno, I'd say some recent switchers from Windows to Mac ("average" users, not the Slashdot know it all types) might feel a little naked without their antiviruses and all that. It's almost understandable, seeing as they've had years of conditioning that everything they do invites trojans and viruses. Kind of like how a New Yorker who moves to the suburbs is amazed he doesn't have to lock his car doors.

Re:Isn't any "cleaning tool" rogue on a mac?

[Anonymous Coward]

the Mac market share nearly doubled in the last few years, it wouldn't surprise me a bit if the people who fell for this were the same that fell for it on Windows as that's pretty much the only thing they knew. On windows people have the idea that the only way not to get hosed is to have some program always running in the background searching for baddies. They most likely carried that way of thinking to their new OS out of habit.

Re:Isn't any "cleaning tool" rogue on a mac?

[robi2106]

How could anybody trust a cleaner for a platform that doesn't, as yet, need cleaning?

Because good is dumb.

Re:Isn't any "cleaning tool" rogue on a mac?

[Atlantis-Rising]

I dunno, I'd say some recent switchers from Windows to Mac ("average" users, not the Slashdot know it all types) might feel a little naked without their antiviruses and all that. It's almost understandable, seeing as they've had years of conditioning that everything they do invites trojans and viruses. Kind of like how a New Yorker who moves to the suburbs is amazed he doesn't have to lock his car doors.

Which is ironic, because just as you should still lock your car doors in the suburbs, the principle of defense in depth is just as applicable to any *nix-based OS as it is to Windows.

Both switchers are getting exactly the wrong impression.

Re:Isn't any "cleaning tool" rogue on a mac?

[Jeremi]

How could anybody trust a cleaner for a platform that doesn't, as yet, need cleaning?

It's the people who aren't sophisticated enough to tell the difference between suggestions given by an untrusted third party app from the Ukraine, and suggestions given by the operating system itself.

In other words, Mac users ;^) [ducks and runs]

Re:Isn't any "cleaning tool" rogue on a mac?

[Anonymous Coward]

ATTENTION MAC USERS!

Has your Mac been infected by the new macsweeper malware? Visit http://www.mac-cleaner.com/ and download a FREE removal tool!

Re:Isn't any "cleaning tool" rogue on a mac?

[MacSweeper]

It's not difficult to remove macSweeper from your computer, just like you remove other applications. Just move it to trash, and make sure that MacSweeper Daemon is not running (look for little trash icon in your tray). And you also need to remove MacSweeper CMI plugin from ~/Library/Contextual\ Menu\ Items, and com.KIVViSoftware.MacSweeper.plist from ~/Library/Prefferences No other files are created! And no cleaning tools are needed!

Re:Isn't any "cleaning tool" rogue on a mac?

[Anonymous Coward]

Mac Janitor certainly isn't scareware, nor is it fake:
http://personalpages.tds.net/~brian_hill/macjanitor.html

funny thought...

[eNygma-x]

All my Mac using friends are going to hate this.... Oh wait my friends don't use Macs! =)

Re:funny thought...

[Doctor_Jest]

You should find better friends....

Re:funny thought...

[eNygma-x]

LOL nice reply. =) But no thanks I'm quite happy having friends that not only know how use a computer but know how to fix them. They are the best of friends =)

Re:funny thought...

[reidconti]

Dude, you must work in tech support... Mac hatred is so 1997 among computer folk.

Re:funny thought...

[Doctor_Jest]

Doesn't matter really... some people just don't get good humor... ;) offtopic? :P bah.

And as a Mac user who knows how to fix his computers... (even the macs)... I'm doing just fine myself... Of course one of my macs runs Fedora... so that probably isn't technically a "mac" in the religious sense of the word...

Remember, though... guns don't kill people... windows computers do.

Wait, why would you even use this?

[WillAffleckUW]

I mean, if you have a Mac, it's not like it's a problem anyway ...

Re:Wait, why would you even use this?

[NewbieProgrammerMan]

Well, assuming Apple's market share is increasing (which I don't know for sure, just taking it as a given for making my point), some significant fraction of those new Mac owners are former PC owners. Many of these people will assume that all the crapware they "needed" for their Windows machine is just part of owning a computer. It's not that there's a problem with a Mac, it's that a lot of people just don't know any better.

Re:Wait, why would you even use this?

[WillAffleckUW]

oh. sorry, I keep forgetting people don't know it's such a waste to even bother with such stuff on a Mac.

I just checked with linux

[Nikademus]

I just checked this using a PC with linux and clicking the "free scan' prompted me to download a .dmg program. I somehow doubt the dmg could have been executed on a PC...

Either they changed their website, either the article lies on some points.

Re:I just checked with linux

[v1]

I rather doubt a DMG can be executed on any computer... ;)

Re:I just checked with linux

[DannyO152]

Then they are relying on ensnaring a naive user who is running as administrator and has open "safe" downloaded files as preference, which is the (I don't know why) default for Safari.

Re:I just checked with linux

[Anonymous Coward]

Then they are relying on ensnaring a naive user who is running as administrator and has open "safe" downloaded files as preference, which is the (I don't know why) default for Safari.

That's because everything is safer with a Mac. ;-)

Re:I just checked with linux

[Weedlekin]

DMG files are disk images, so opening them only results them being mounted as a volume -- nothing inside them will be automatically executed. This program is therefore a simple Trojan that has to be deliberately installed by its victims, and therefore presents no more danger to Mac users who know about it than EMAIl phishing scams.

Re:I just checked with linux

[LionMage]

DMG files are disk images, so opening them only results them being mounted as a volume -- nothing inside them will be automatically executed.

Factually untrue. Many DMG images are set up to automatically mount, copy their contents to the current directory, then unmount the image and move it to the Trash. Other DMG images are set up to automatically run the OS X installer on an installer package embedded in the DMG after it auto-mounts. (For those who don't know, OS X has a standardized installer which reads a standardized package format. The packages typically have an icon that looks like a beige or orange-ish box that may be partially opened, or may be tied up with string.)

You can avoid the worst of this crap by turning off the preference in Safari which opens "safe" files after download. Of course, there's also usually a disclosure sheet attached to the Safari downloads window which asks if you really want to open this image/archive if it looks like it contains an executable.

Re:I just checked with linux

[Weedlekin]

"Factually untrue."

Really?

"Many DMG images are set up to automatically mount, copy their contents to the current directory, then unmount the image and move it to the Trash."

Copying isn't automatically executing.

"Other DMG images are set up to automatically run the OS X installer on an installer package embedded in the DMG after it auto-mounts."

This still isn't a case of automatically executing something on the disk image itself, which versions of MacOS prior to X could do in much the same way as Windows (and as with Windows, the capability could easily be disabled). OS X's package installer is an application already present on the host machine that displays a GUI which the user must interact with for the installation to take place (the DMG containing the package will also be opened in the normal OS X way, so the fact that a DMG has been mounted can be clearly seen), so it should be pretty obvious that (a) something is trying to install itself, and (b) there is an option to cancel it.

NB: the above capability is nothing more or less than OS X' default behaviour of using the application associated with a data file type to automatically open such a file if it is the only thing present on an auto-mounted disk image. I'm not saying this isn't a potential security risk, because there have been many cases of data files (or their names) being specially crafted to take advantage of things like buffer overflows in either the default application that displays them, the OS launch handler, etc., and vulnerabilities of this sort have been found in both in OS X itself and various applications that run on it, although the known ones seem to be patched pretty quickly (as yet unknown ones are obviously still there).

"You can avoid the worst of this crap by turning off the preference in Safari which opens "safe" files after download"

This sort of option should be turned off in _any_ browser on any platform, not just Safari.

"Of course, there's also usually a disclosure sheet attached to the Safari downloads window which asks if you really want to open this image/archive if it looks like it contains an executable."

It looks for other types of potential threat as well, but this doesn't change the fact that it should have been turned off by default. The lesson _all_ software authors should learn from Microsoft's experiences is that automatic behaviour which is intended to make life easier and more convenient for non-technical people often ends up being a major source of misery for them and everyone else, including those who thought that putting it in was a really great idea.

the shit hits the fan!

[ILuvRamen]

You know how they say everyone who isn't good with computers should use a mac cuz it's a hand holding type of OS that simplifies everything for the user and doesn't let you into the really technical stuff without a lot of digging. So yeah, simple folk use the macs lol. You could train a monkey to run a mac. And from repairing comps in home for 4 year lemme just tell you that that's the kind of people who download and install fake scanners. The last one I did was from someone who saw a popup that said they have malware so they did the scan and OMG it installed some adware! OH NOZ! They never saw it coming *rolls eyes* yeah, so mac people are either hippies, self important starbucks customers, media ediors, or mac software programmers and 3/4 of them are dumb enough to install this new "scanner"

Re:the shit hits the fan!

[necro2607]

Yeah the difference is, you can't get spyware installed on a Mac by clicking a banner ad in a browser. The software doesn't even have permission to do software installation, so it would be asking for a password (unless some unknown vulnerability is exploited). Frankly if you're entering your password for your computer when some arbitrary website asks for it, you've already got have way worse problems than spyware on your Mac.

Re:the shit hits the fan!

[Anonymous Coward]

Thats a funny generalization you made. I know of at least 8 of the top ranked 50 universities in USA where the entire computer science department and their students uses macs primarily.

Re:the shit hits the fan!

[sqlrob]

It doesn't take special permissions to put stuff in ~/Applications. It's not done by default, but some users do do it, and Finder supports it.

Or heck, just put it on the desktop where the user can click it. No special permissions needed. Most .Apps don't need an installer, nor need to be in /Applications.

Re:the shit hits the fan!

[jmauro]

But the Applications folder does not run as root, but as the regular user. The malware can only screw up the current users session, it cannot access or modify anything that needs root permissions without asking for the root password. Without root, malware is annoying, but not difficult to get rid of.

Re:the shit hits the fan!

[Mordaximus]

Exactly! There are too many Mac users all smug with the notion that their OS is super secure. Which is true, the system is secure - but the user is not. The first time they ignorantly run a malicious app that clean out the contents of their home they'll likely learn the distinction though.

Personally I've never fretted over having to reinstall an OS. I typically clean install with every major release. What I dread is losing my data.

Re:the shit hits the fan!

[GaryPatterson]

Yes, but if you ask a user what they care more about - the OS or their data - you'll find few who care that they'll have to reinstall the OS. It's an irritant, but easily replaced from the source media.

Our data is far more critical, making the ~/Applications folder (or the ~/Desktop folder) a dangerous place for executables.

Of course, in these enlightened days we all have regular backups now or Time-Machine-enabled external drives. Hmm...

Re:the shit hits the fan!

[sqlrob]

But still damaging. A lot of what MyDoom did can be reproduced in a non-admin level account very easily.

It's trivial to reinstall in OS to clean something. Recovering the data is the issue.

Re:the shit hits the fan!

[willyhill]

The malware can only screw up the current users session

I'm sure people care more about the contents of their /bin folder (or whatever passes for that in OS X) than the graduation pictures of their kids and their tax returns. So I guess that's OK. The OS was never compromised! Incidentally, you don't need root to turn a machine into a spam-spewing zombie. On any OS.

it cannot access or modify anything that needs root permissions without asking for the root password.

Well then, it will just ask for the root password. You're thinking here that the user won't provide it for some reason? They just clicked on a "Punch the monkey" banner, after all.

Re:the shit hits the fan!

[acb]

That is assuming that (a) there are no (as yet unknown to you) security holes in your web browser, media plugins, &c., which could be used to execute arbitrary code, (b) there are no (as yet unknown to you) security holes in OSX or any of its components that could be used for privilege escalation, and (c) crackers haven't discovered these and used them or traded them on "zero-day" forums. Which is a pretty big assumption.

Using a Mac is safer than using Windows, though using something like NoScript to disable JavaScript, Flash, &c., for untrusted sites makes it even safer.

Computer security is like wearing porous armour: the more layers you have on, the less likely it is that something will make it through the holes.

Re:the shit hits the fan!

[crabpeople]

"Without root, malware is annoying, but not difficult to get rid of."

Maybe im just an expert on windows malware, but pretty much all of them install as root and they are for the most part not difficult to get rid of. You just have to learn where things can hook into, and have some common tools by your side. For joe user, I would argue that its just as difficult to delouse a PC or a mac. What about a polymorphic spyware that drops copies of itself everywhere, renaming itself randomly to mimic user created files? or if it zips up all your document files with a password? Joe user wouldn't have a clue if it was self replicating, spawned by some background process.

2008, year of the malmacware?

Re:the shit hits the fan!

[Anonymous Coward]

has it occurred to you that being able to repair one type of machine doesn't make you an expert in another type of machine that you've never actually seen up close? also.. i don't think you know what you're talking about. Luckily, your posting style is so bad that it doesn't matter.

Re:the shit hits the fan!

[Tacvek]

I'm sure people care more about the contents of their /bin folder (or whatever passes for that in OS X)

For the record, there is a /bin folder, but that is only for the low level Unix style tools. The main applications can be located anywhere in the hard-drive, but are most often kept in /Applications. Of course the bundle system that the apps use make browsing the installed applications as easy as browsing the /Applications folder, which is why there is no real need for a statr-menu like system. The Dock and desktop can hold shortcuts to the most commonly used applications, otherwise, you just browse /Applications.

Re:the shit hits the fan!

[BeanThere]

True, although most malware that people actually have to worry about doesn't delete your data. Most commonly, the intent is to deliver popup ads, or steal e.g. credit card info or logons when you order stuff or do banking online ... I think these are probably the most common hazards. I guess to do that on a Mac, malware would probably have to at least modify Safari in some way, I'm not sure if an ordinary user logon can do that.

Re:the shit hits the fan!

[Taevin]

I keep seeing people posting this concept... I have a hard time understanding it to be honest. Let's take a (very simplistic) look at Windows vs. OS X (and yes, I am aware you can make Windows nearly as secure as other operating systems, but I'm looking at base install here): Windows:

• User Data: not protected
• System Data: not protected

OS X:

• User Data: not protected
• System Data: protected

Ok, sure, OS X is not perfectly safe. Clearly it is the better choice though in terms of protecting system data. I really only made this reply because some of these posts (not necessarily the one I'm replying to) seem to be implying the OS X is somehow less safe. At worst it's no more secure than Windows; at best it is significantly more so.

Protecting system data may not be the most important thing in computing, but it's a bit ridiculous to claim it's less important than user data. You're probably right: the affected Joe User probably cares a lot more about his photos that he's procrastinated on backing up for the last 3 years than whether or not his OS is functional. However, I'm pretty sure that the other users on that PC are very glad that they weren't affected by Joe's actions. And let's be realistic here: how often does a piece of malware destroy files wholesale? Save the occasional virus writer that hates the world, most malware creators are much more interested in profit (i.e. getting users to buy something, typically through inserting advertisements).

Re:the shit hits the fan!

[webmaster404]

The thing though is, in a Unix-like system (like Linux) or a Unix system (like OS-X) the person logging in does not have root capabilities (or at least shouldn't) and thus keeps the possibility of attack low. In addition, Linux (OS-X can be configured to) have a centralized repository where most users download their programs that the source has been scanned for presence of malicious code (OS-X's version is called Fink I believe) this is one of the main reasons there is little malware for Linux, OS-X though, being mixed free/proprietary (more or less BSD with a nice GUI) software, doesn't have this and instead most applications are downloaded binaries, I am not sure whether or not they can be installed without root privileges (I know apt-get on Linux requires it, but I think ordinary programs can still be executed without root privileges, just not in the directory of system-wide binaries) this keeps the risk of data deletion down because the most it can do (deletion-wise) is delete the /home directory (the Unix equivalent to My Documents on Windows). As for the polymorphic spyware, if it was executed by a normal user (not root) the most it would (or should) have access to is the /home directory, keeping the risk of it going very many places down because most people check their home directory and unless it was hidden (not sure how the default file manager in OS-X handles them) it would be very very easy to figure out that you didn't create that file. For zipping up your documents with a password, that could be done, however assuming that either A) the password is the same B) the generator creating it is the same and if it was encrypted, it would be trivial to brute-force the password, figure out the algorithm then release a patch that fixes it. Overall, Unix systems are very hard to crack given that all the patches are installed, as one person said: To break Linux (or Unix) you need to work at it, to break Windows all you need to do is work on it.

Re:the shit hits the fan!

[bigstrat2003]

imho, any user stupid enough (in a security sense) to click random banner ads is stupid enough to enter their password when asked for it, on blind faith.

I'm not saying that having a secure OS is an unworthy goal, by any means, but whatever OS is top dog will always be the most plagued by stupid users... and unless you lock them out of the system (which is just going to piss them off), there's nothing that can be done about it.

Re:the shit hits the fan!

[devman]

I'm amazed parent got modded troll, that was a relevant comment

Re:the shit hits the fan!

[v1]

It doesn't take special permissions to put stuff in ~/Applications. It's not done by default, but some users do do it, and Finder supports it.

Actually it does. The /Applications folder is owned by root, and it is grouped to admin. Other has only read access. If you want to write to /Applications you have to be a member of admin, which is usually identical to the list of sudoers. Although probably 70% of accounts on macs are admins, (less than the 99% of windows...) not everyone is. If you are a parent and have kids, your kids are probably not admins on the computer so they can't break it. (at least can't break it for the rest of the family anyway)

The point being made was that yes, you are allowed to hose your account. No one should have any expectation that the system can protect you from yourself. You can just as quickly drag your Documents folder to the trash and empty it yourself as you can double click a script written to do just the same thing. The difference is you don't tank the entire machine, or cause problems for the other user accounts on the computer. By the definition you appear to be using, someone posting a text file with instructions on how to "optimize" your computer by dragging the contents of your home folder to the trash, could be considered malware.

The primary difference between this and most of the earlier windows malware is this is not a "drive-by download", where merely visiting the web page triggers a download and execute of code that can do damage. On a mac, if you DO click on something, you will get one or two warnings that you have downloaded an application and asking if you want to allow it. You get one warning when downloading the DMG, and another warning when trying to run any app inside the DMG once opened. The first warning has been around awhile, but the second one is new and goes something like "you are opening application xxx for the first time, which you have downloaded from the internet. Do you wish to continue?"

I don't personally think there is any way for the mac to remain anywhere near as free of 'malware' for even the near future. It's going to come up. I'll just be happy if it remains worm and virus free for the long term. And the way it's designed, there's a very good chance of that. It's the computer's job to block viruses and worms. It's the user's responsibility to avoid malware. (although it remains the computer's job to mitigate the damage caused by a user that chooses to run malware, and most importantly to protect the other users)

Re:the shit hits the fan!

[Kalriath]

In Windows, if you're running as a limited user (or are using Vista with Protected Mode on) then your system data is protected too.

Re:the shit hits the fan!

[Anonymous Coward]

Time Machine, please tell me you have a cheapy $99 drive plugged in doing hotbackups of all your data in an incremental fashion, with the ability to pull days weeks and years back.......oh wait that's a standard os x feature

Try again, get root next time LOL

Re:the shit hits the fan!

[RincewindTVD]

you must be new here...

Re:the shit hits the fan!

[sqlrob]

Did you read my comment? I did not say /Applications. I said ~/Applications

Re:the shit hits the fan!

[eefsee]

True, a default Mac install gives users admin privileges and the /Applications folder requires admin rights. So most Mac users have the rights they need to modify the /Applications folder. Note: "admin" on a Mac is not "root" for Unix purposes. From the Unix perspective "admin" is just a group with rights on a lot of privileged items in the system.

However, it is _highly_ advisable for any reasonably security conscious Mac user to create a second admin account (let's call it "apple") and then _remove_ admin privileges from their regular user account. Day to day life in MacOS X does not require any admin privileges. This is how I've run all my systems for at least three years now. I do not have admin rights from my user account. MacOS X is very graceful about this. For example, when I do need to add something to the /Applications folder it will put up a window informing me that I don't have the right to take that action and offering me a chance to authenticate. If I choose to authenticate, it lets me type in the username of an admin account (say "apple") and the password. It then uses that account's authority to take the action. This is very similar to a Unix sudo. Since daily use of the OS requires so little admin access, this really presents no problem.

What is the benefit? While the user can know the admin username/password, rouge software won't know that. There is no way for software using my user privileges to even add anything to the /Applications directory or any other special location without forcing an authentication request that should, at the least, make me suspicious.

So, yes, while the default behavior is as stated, it is very easy (and I would even go as far as saying recommended) for users to remove admin privileges from their regular user account.

Re:the shit hits the fan!

[sqlrob]

Depends on what version of OS X you're talking about. Drop something in ~/Library/Input Managers in Tiger and below, and every cocoa app is infected when you run it. Or put something in ~/Library/LaunchAgents and watch for Safari and inject code (non-root for PPC only,special group or root for Intel). Or rewrite plugins residing in ~/Library/Internet Plugins...

With some more thought I can probably come up with a pile more.

Re:the shit hits the fan!

[sqlrob]

This is how I normally run. Unfortunately, it is buggy and still not completely effective. There are those user based locations I mentioned in other comments. Even worse, when you drag into /Applications, even after authenticating as the admin user, the permissions are for the current user with full access. So once it's installed, anything else running with your credentials can edit it.

Re:the shit hits the fan!

[Anonymous Coward]

Time Machine isn't a panacea for malware. If you're doing Time Machine the way you're "supposed" to, the TM drive is permanently connected to your mac, and permanently turned on. It's trivial for a malware author to wipe out the contents of your TM drive, or to replace the backed up data with malicious data.

Time Machine protects you against accidental damage, not malicious. The only way to protect against malicious (software-based) damage is to burn your data to write-once media, and only put that media into your system when you need to recover something (just in case malware can turn on the write laser and scramble your backed up data.)

Re:the shit hits the fan!

[GaryPatterson]

No, I don't use Time Machine. I don't have a handy large FW drive.

I use a 2x500GB Linux-based NAS box in a RAID 1 array over gigabit Ethernet (via 802.11n) to store occassional backups (when I feel like it, although I could easily use one of the many apps or even the Unix commands).

There, I think I've covered all the backup buzzwords.

Re:the shit hits the fan!

[DDLKermit007]

No it doesn't take special permissions to put stuff in Apllications, it's pretty danm near impossible though without user intervention though. However with 10.5 the system keeps tabs on apps that come from the internet. On first run at least you will be prompted that the application your about to run came from the internet the first time with the option to not allow it to run.

Re:the shit hits the fan!

[atraintocry]

I think one of the big problems that we still have is that users don't don't differentiate between programs and data. Or app settings, or functions of the OS, or anything else. It's all just a big mushy, magical, computerish blob. Recently I tried very hard to explain to someone that the Windows error reporting for some random app crash had nothing to do with them somehow destroying their network driver a week later. Maybe I'm just terrible at explaining, but as simple as I could make it ("like I keep saying, it's not related, at all"), the guy kept bringing it up, like it was the magical key to everything.

(Un)common sense says: your data is the only thing in there that can't be replaced. Keep it organized & backed up, don't lose sleep over the rest. And don't feel bad when the computer breaks, because no one's ever built one that didn't.

I just hope someday people will figure out doing their weekly defrag or whatever isn't making their computer better, it's just time wasted that should be spent backing up the things you value. But it's easy and makes them feel good...it scares me when I see how superstitious people can be with these things. So while messing with people's data is much worse than changing their homepage, they really don't see a difference. All you get as the designated help desk person or unfortunate family tech is a grunt to say "it's not working".

Like you hinted at...time machine makes it almost fun(!) to keep backups, but still, many don't bother. And they get what they get, I guess.

Re:the shit hits the fan!

[atraintocry]

I'm sure people care more about the contents of their /bin folder (or whatever passes for that in OS X) than the graduation pictures of their kids and their tax returns.

I'm guessing you're being sarcastic here, but even so...consider that they might not know the difference at all. It sounds crazy but I don't know many people that really separate their data from the programs that open them. I call it "icon fever" :D

Re:the shit hits the fan!

[Anonymous Coward]

It doesn't take special permissions to put stuff in ~/Applications. It's not done by default, but some users do do it, and Finder supports it.

Exactly which Javascript-function does not take special permissions to put stuff in ~/Applications? Or do you need Flash?

Because that's about the only things that get to run by clicking on a banner ad.

Of course you can still download stuff yourself and put it there, but the claim was that you can't get it just by clicking on a banner ad.

Re:the shit hits the fan!

[MacSweeper]

Actually there are known methods to do so. We are working for a long time in security sphere, and can ensure you that everything is vulnerable. But too keep Mac platform safe, we won't discuss it here. MacSweeper doesn't use any of the vulnerabilities, it is made to be Simple and powerful System Cleaner, and helps to warn people to be more careful. There are known security holes with cookies, so MacSweeper has its own database of dangerous websites and cookies. It secures unwanted cookies, the same way MacScan does. And I repeat, we love Apple and all their great products and we want to keep them clean and secure!

Re:the shit hits the fan!

[QuoteMstr]

But too keep Mac platform safe, we won't discuss it here.

Security professionals who believe in security through obscurity aren't. Also, I suspect that people who can't differentiate "to" and "too" aren't smart enough to really consider all the nuances of full system security.

In other words, my crackpot meter is going "beep! beep! beep! beep!"

Re:the shit hits the fan!

[sqlrob]

Or a buffer overflow in Java that Apple had for more than a year after Sun fixed it.

Re:the shit hits the fan!

[Theaetetus]

OS X: * User Data: not protected * System Data: protected

*User Data with Time Machine running: protected

"Aw, gee, the malware hosed my data! Well, I'll just grab the version from last hour."

Re:the shit hits the fan!

[prockcore]

Without root, malware is annoying, but not difficult to get rid of.

Except it can modify all your applications.. trojan itunes, trojan safari. On top of that, you don't need root to turn a machine into a zombie.

Re:the shit hits the fan!

[TheNetAvenger]

You seem to be skipping user areas, user applications, and even general applications that are accessible via a default user/program.

Here contrast this, in Vista, IE can't even write to user areas, let alone program/application areas. Additionally, even normal users or applications CANNOT write to applicatin/program areas in Vista, so even if the user is using Firefox, the applications are still protected.

fixed that for you

[joeyspqr]

"I visited the macsweeper.com website. I know I probably shouldn't have but I used a Mac so I knew I wouldn't get infected."

oh wait ...

Yeah and moon is made from..

[Fri13]

What, you need to download something to your mac and then INSTALL it?

This kind software has be there long time ago and there is nothing new to see here.
Market share is still smaller than GNU/Linux and it is not having this kind problems, wait, it has.

Come back again when F-secure and others have proof for worm or virus what works like windows platform, automatically.

Re:Yeah and moon is made from..

[moderatorrater]

It's been my experience that 90% of the hosed computers in this world have had something installed that shouldn't have been. This is just the sort of malware that typically plagues windows computers.

Re:Yeah and moon is made from..

[Anonymous Coward]

How about you come back when you have proof for writing what works like English, illiterate Mac fanboi. You has add nothing to discussion.

Re:Yeah and moon is made from..

[necro2607]

No kidding, I couldn't guess how many times I've written on Slashdot about how people used to upload trojan-horse programs to my server all the time and try to get me to run it. You know, malicious AppleScripts with a different application icon so it looks like something legit like a text doc or whatever. Except these days, Mac OS is designed with way more attention to these kind of possible "hacks", fortunately.

Re:Yeah and moon is made from..

[willyhill]

Come back again when you understand how Windows machines are largely compromised. Crapware vendors don't need to wait for the next IE vulnerability to target people, all they need is social engineering and lack of common sense. The last few major botnet herding attacks have been perpetrated like that. The fastest-spreading worms have been perpetrated like that. Coming a close second is exploiting vulnerabilities that people can't be bothered to patch. Yet all of this has somehow become Microsoft's fault, but in this case I guess it's the user's fault, right?

Idiocy can and will spread happily across platform boundaries. It really does not matter what OS you are using. And this article proves it. It's just that until now Windows was losing by the weight of sheer numbers. It has more vulnerabilities, sure. But those are irrelevant to the people who make big $$$ compromising machines. They simply don't need them.

Re:Yeah and moon is made from..

[postbigbang]

Your comment is somewhat disingenuous. For argument sake you can cite that there are probably an equal number of stupid people buying Macs and PCs, by percentage.

Now take a look at the architectures. A dozen years of Windows since Win95 has only progressively made Windows more secure, and while better than before, still full of a superfluity of exploits (for differing reasons, again, not counting user "stupidity"). You have to do a lot of work to iteratively get past the gatekeepers in both operating systems; it's not as trivial an exercise as it once was; all the really wide-open machines are 0w3d by someone by now.... as part of a botnet.

Given a 5-10% of the market for Apple, depending on whom you believe, you're only now seeing a MacOS ruse. Think about that for a moment. Think about both motive and opportunity. Motive we understand. Opportunity hasn't been very strong until now. The weapon? Two decades in to desktop operating systems (three if you count CP/M, UCSD Pascal and so on) we're only now seeing a MacOS exploit. A common denominator among the exploitable: stupidity. Now let's scratch off stupidity and talk about architecture. It's not Microsoft's fault that they used a root-level database (the 'Registry') that could be twigged by any user-mode app in pre-XP SP2? Hmmmm. Or the mindless ways that people found to explode IE? Or the TCP/IP stack? Or how long it took to get a WEP-128 parser and still longer for a WPA parser? Microsoft's sloppy code created an industry, one to fix the code, and another to exploit it. They didn't take security seriously, then paid it only lipservice. They're paying the price in disrespect for not being respectable!

Re:Yeah and moon is made from..

[Nossie]

What?

Let me guess. You are 12, American and like lol cats?

"You has add nothing to discussion" I can haz cheezburger?

"come back when you have proof for writing what works like English, illiterate Mac fanboi"

Proof for writing that works like English? try "Come back when you have proof that you can write in English"

pot, kettle, black, idiot!

Now is when you quickly reverse your statement, tell me that the sarcasm you posted went over my head and that I'm an Apple sympathizer.

Re:Yeah and moon is made from..

[Nossie]

ahhh shit, how did this comment get here?

whoever thought this was aimed at you.. it wasn't... *rolls his eyes*.. now I need to hunt him down again.

Re:Yeah and moon is made from..

[Nossie]

Ahhh for some reason it wasn't showing his post... nvm. I was right the first time :P

Re:Yeah and moon is made from..

[devman]

I agree with this statement wholly. I work as a PC repair tech and most of what I see that hoses up a typical Windows install are things the user actually installed. Its very rare that I encounter something that slipped through a crack in the OS (read:exploit) especially in a fully patched Windows install. The payload for these kinds of malware generally seem to come from the freebies people download like screen savers, minigames, plug-ins or shady P2P apps. IE7 in Vista has no root permissions at all anymore unless the User grants that privilege for which they are asked for and then asked to confirm and people still get hosed up by clicking through it not thinking. Bottom line is, that the user is the computers worst enemy, people who install shady crap on there computer are gonna get burned regardless of what OS. Even if it prompts you for a password likely the user will just punch it in anyway.

Re:Yeah and moon is made from..

[toadlife]

It's not Microsoft's fault that they used a root-level database (the 'Registry') that could be twigged by any user-mode app in pre-XP SP2 Thank you for demonstrating your ignorance of how Windows works.

We can now safely ignore anything else you say on the subject.

Next.

Re:Yeah and moon is made from..

[v1]

Wow I think I invented TFA's idea of malware, I did this YEARS ago. Lets see if I can remember my leet skillz...

10 INIT A

wow, I can't believe I remembered that.

This is about the caliber of the "malware" on this site. Though I wonder if apple will react by pushing out their first clamav update?

Re:Yeah and moon is made from..

[postbigbang]

Rather than exacerbate a flame war, I'll disclaim your belief. You're obviously an expert.

Re:Yeah and moon is made from..

[willyhill]

For argument sake you can cite that there are probably an equal number of stupid people buying Macs and PCs, by percentage.

Forgoing remedial math and ignoring the size of the user base, sure.

you're only now seeing a MacOS ruse. Think about that for a moment.

Sorry, but I don't have to think about it. The basic premise of this article is that the Mac is starting to be targeted because Apple has been selling machines like crazy for the past seven years and their market share has ballooned. Seriously, are you paying attention?

(the 'Registry') that could be twigged by any user-mode app in pre-XP SP2? Hmmmm.

Hmmm indeed, since the registry has had node-level ACLs since NT4 was released in 1996, so no, you could not write to certain parts of it if you were running under a non-privileged account.

Microsoft's sloppy code created an industry

I absolutely agree that they paid lip service to security in the name of "usability", and that ultimately was their biggest mistake. The need to maintain backwards compatibility with the 9x line and have everyone run under admin accounts (which have been unnecessary since 1996) because so many apps were written to have the go of the entire box was another.

But in this case, the "sloppy" code is irrelevant. People get infected and 0wnd because they download crap from teh internets, because they really need to read that funny postcard from "fan", because etc. Exploiting vulnerabilities is passé - social engineering is more than enough. But for that to work you need a large user base that contains ever larger amounts of dumb users. Windows has the biggest one. OS X is going to be the next. Articles like these prove that, and you'll be seeing more as their market share grows.

Re:Yeah and moon is made from..

[postbigbang]

User idiocy aside, the inherent architectural differences, not the sheer number of idiots IMHO, have made Windows a vulnerable target at many levels. In a perfect world, we would train people on using things before we let them loose with them. But we don't.

For this reason, until four years ago (Windows early XP era), Windows and its myriad faults were untenable. MacOS X, by contrast, at least warned people before they were about to get a knife stuck in their operating system. FireFox, Mozilla before it, Safari, IE, all of the browsers (sorry Opera, Ieft you out) have been vulnerable to one piece of malware or another. Microsoft's products (and I've been watching them from long before they went public) didn't button down their architecture. The registry has been eminently hackable in user space until XP SP2 locked it down.

Sure there are idiots out there. But that's why we have stop signs, yellow lines on the road, seat belts, and in some areas, vehicle inspections-- so that a common set of operating criteria can be used to insure safety of use.

The use of an open registry, easy access to system files, legacy exploitable executables, all of these cause(d) problems. If you expect civilians to uptake technology, then you have to ensure their safety, and Microsoft didn't do that, both in the quality of their code, and its basic architecture.

Re:Yeah and moon is made from..

[Anonymous Coward]

http://support.microsoft.com/kb/256986

Re:Yeah and moon is made from..

[Chris Tucker]

Great Comment! Right On!

Click here to see Jeri Ryan (7 of 9!) stolen sex tape!

Re:Yeah and moon is made from..

[arminw]

.....if you were running under a non-privileged account........

That's a big IF. Much Windows software, especially games, doesn't work correctly, or not at all, unless the user is running as an administrator. Is a user has even only ONE such program, they will run as admin, which is of course STILL the default Windows comes with. So does OSX for that matter. However, there isn't a single program for the Mac that will NOT run under a limited user account. Thus it is possible for a family computer to be set up so the kids can play games and download all sorts of stuff and at worst only screw up their own account. Whoever administrates the family Mac can make a special kid's game account for that sort of thing. When the account get messed enough with malware, it is a simple matter to delete the whole account. OS10.5 even comes with a guest account, where that sort of deletion happens automatically, upon logout. Fast user switching also allows a single user to set up one account for keeping sensitive data and another for downloading "experimental" software and quickly switch between these accounts. Apple has included a number of tools to make it hard for malware to do any real damage or get at data useful to thieves.

Re:Yeah and moon is made from..

[atraintocry]

Don't confuse OSX with the other MacOSs that came before it. Remember nVIR? I completely agree with you about the numerous compatibility shims that Microsoft always ships Windows with. But that doesn't mean MacOS was always secure, or stable. Granted, it wasn't the house of cards that old versions of Windows shipped as, but OSX was a huge improvement in many ways, so I don't think the last 20 years really count for much, unless you're wondering, "how come in 20 years our OSes have gotten smarter, but the users seem to be getting...well...not?"

Re:Yeah and moon is made from..

[Anonymous Coward]

Or even without an administrator password.

Re:Yeah and moon is made from..

[Anonymous Coward]

Actually the number of stupid mac owners is a bit higher than Windows buyers. The really rich buy MAC as it's seen as trendy, the really rich tend to be some of the stupidest on the planet as they cant be bothered with learning. They cant be bothered to learn how to operate a DVD player, Computer, etc... they are too "busy" and therefore end up being stupid by design.

I know this, I do home theater designs for these people, and I end up doing MAC service for them at $159.00 an hour when they find out I am a Mac guru as well....

That is the cool part, I get to charge 2X normal PC rates to work on them... They expect it to be more expensive :-)) I love it!

Now, people that actually scrimped and saved to buy their mac, those are the smart ones.... It's the rich guy that always has the latest mac computers everywhere who is the idiot. He's doing it for trendiness, example of his wealth.. (That's not a PC, it's a MAC means it cost over $2000.00 not some cheapo PC) and to be "different"...

Re:Yeah and moon is made from..

[Anonymous Coward]

Someone forgot to click "post anonymously!"

Way to spam, asshole!

Looking at the screenshots...

[Lally Singh]

The screenshots seem to show that all it detects are evidence of viewing porn sites. Yes, you can view smut on the mac. Everyone go hide in fear.

Re:Looking at the screenshots...

[RincewindTVD]

Apple have your back there too. http://www.apple.com/safari/

Your browsing is your business. Which is exactly why Safari offers private browsing -- to keep your online activities private. Turn on private browsing and Safari won't store your Google searches, your cookies, the history of sites you've visited, your download history, or information from online forms you've filled out. porn porn porn. I think I'll install Safari at home.

Unfortunately, this is likely to become more

[ibbie]

common as Macs continue to grow in popularity. Malicious code tends to gravitate towards the largest user base (more targets), and Apple's market share (or perhaps, more importantly, positive PR) is growing at a decent rate. I'm surprised that it hasn't happened sooner.

The same could happen to Linux, (Free|Open|Net)BSD, etc. All it takes is an uneducated* user behind the console, and Linux's drive to take on the desktop makes that all the more likely.

* I mean uneducated in the security sense. You can be highly intelligent, have 3 PhD's, and still not know a thing about what downloads to avoid. We can't know everything about everything, after all.

Re:Unfortunately, this is likely to become more

[cromar]

The same could happen to Linux, (Free|Open|Net)BSD, etc.

What? A trojan on Linux? That's crazy ;)

Re:Unfortunately, this is likely to become more

[willyhill]

Well I never... you mean the threat level is directly proportional to the popularity of the target platform and the demographics of its user base?

You mean that... by exercising common sense and not downloading crap to my computer I can avoid the vast majority of viruses and malware? Hah! Next you're going to tell us we need to also patch them and then we'd be quite reasonably safe!

That's just crazy talk, c'mon. Everybody knows that's not true.

What's wrong with /.?

[Anonymous Coward]

Why do almost all of the articles on the slashdot main page say only "25 comments"? Is it some kind of bug? (I'm not logged in, and I'm using IE7 on Vista. Flame me. :))

Re:What's wrong with /.?

[tehniobium]

I'm logged in FF2/XP (not that that makes a difference) and I'm seeing the same thing...

wierd oO

Re:What's wrong with /.?

[celle]

"No kitty, thats my pot pie!"

moderator: The kitty turns around and lifts up its tail.

--> "You sure about that Jack?"

Re:What's wrong with /.?

[Sean0michael]

I'm seeing the same thing FF2/XP, though my URLs don't look any different than usual. For example, my URL for the Scareware article is:
http://it.slashdot.org/article.pl?sid=08/01/15/232258
Not sure what it is, but I think Taco will save the day. He doesn't get to be a Commander for nothing.

PC are immune..what what?

[Mastadex]

I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected. Excuse me. *Leaves the room*


Bahahhahahahahahaha.....

... and here's a Linux one.

[EmbeddedJanitor]

#!/bin/sh
rm -rf /

The point being that if you do dumb shit on any computer you can break stuff.

Re:... and here's a Linux one.

[CottonThePirate]

Oh noes, your code caused me trouble. Well mostly it just came back with a bunch of permission denied errors, sorry file is in use errors, and the like. But your point is quite valid, I can write a piece of code for any platform that fscks it up if I have a user (or worse yet a privileged user) run it on their machine for me. The Bonus(tm) of mac/linux/BSD is that 99.5% of people don't run as root even on their own machine for day to day use. While Vista moves this way, it just annoys users with "is this ok?" boxes enough that it's a matter of course to click yes now.

Re:... and here's a Linux one.

[TheLink]

I don't know about you, but most users running that on their desktops would be rather upset if they leave that script running long enough to wipe much of their home directory (backup backup backup :) ). On Linux desktops, most files owned by root are usually from the distro and can be reinstalled.

A similar script could have backgrounded and not shown any errors or warnings. In fact a deviously written perl script could do so many things it's not funny (and would work fine on modern Macs and Linux).

I use both Linux (suse,ubuntu) and Windows (XP,2K). And there really isn't that much difference in security technically[1].

Both Linux and Windows have privileges and ACLs etc. Suse/ubuntu Linux have apparmor, Windows XP has that firewall thingy.

In fact a Linux desktop by default runs stuff with the full privileges of the user[2]. Windows XP's firewall stuff somewhat allows you to reduce privileges, but it's not good enough for most users to use correctly.

It is silly that a browser running a malicious script/program would be able to listen in on your microphone by default or read/write your email/documents.

[1] In practice things are different. Malware people target windows because it's more common. I've said before that Mac users were like people living in a house in a small village that's nice and safe. Whereas Windows users are like people living in a ghetto apartment with boarded up windows, steel grilles and padlocks - then they voluntarily let strangers in regularly and get robbed of everything ;).

I guess the Mac village is still relatively safe, but if the market share keeps increasing it's not going to be such a safe small village anymore.

[2] On my linux system I run firefox under a different account because I don't trust the quality of firefox. Similarly I run windows in a virtual machine to browse sites that I believe aren't as secure or require javascript and other crap - while virtual machines can be broken out of, I'm not rich enough to buy another computer just to watch youtube.

Re:... and here's a Linux one.

[Anonymous Coward]

For most home users, running as root doesn't make much difference.

Everything outside of /home is normally used to store system stuff and applications, which can be reinstalled rather easily. It's /home that has all the valuable stuff. Reinstalling is inconvenient, but not really a disaster. But if you lose /home, you're screwed unless you have backups.

Re:... and here's a Linux one.

[penix1]

[1] In practice things are different. Malware people target windows because it's more common. I've said before that Mac users were like people living in a house in a small village that's nice and safe. Whereas Windows users are like people living in a ghetto apartment with boarded up windows, steel grilles and padlocks - then they voluntarily let strangers in regularly and get robbed of everything ;).

I guess the Mac village is still relatively safe, but if the market share keeps increasing it's not going to be such a safe small village anymore.

It has very little to do with "market share" and everything to do with monopolistic practices. In integrating the web browser into the OS, Microsoft has created their mess. Flaws that affect the browser would have less impact if the browser was walled off from the OS. Only in Windows do you see a browser flaw trash the entire system. This in addition to the monoculture that is Windows programming techniques allows mass infections to proliferate. Why is it that C:\windows & C:\windows\system are the dumping grounds for just about every Windows program out there? Those two directories should be sacrosanct, read only, Microsoft OS only but they aren't. To top it off, Microsoft is the biggest violator when it comes to abusing those directories. Add in the abortion known as the registry and it is little wonder Windows users are walking targets.

No, market share has very little to do with infection vulnerabilities. It doesn't matter if you have 1 user or 1 trillion users. If the vulnerability still exists, then ALL users of that system are at risk.

Re:... and here's a Linux one.

[Divebus]

I guess the Mac village is still relatively safe, but if the market share keeps increasing it's not going to be such a safe small village anymore.

That's for sure. More Village Idiots who are mostly Windows switchers bringing bad habits with them - "Click here to see the dancing monkeys"

Re:... and here's a Linux one.

[TheLink]

Whether it is windows or linux, it is hard for a browser flaw to trash the entire system if you don't run as root/admin.

BUT that's besides my main point, most of the windows worms and malware nowadays are "user" level only - no root, no system privileges obtained nor desired by the malware author - they just want bots they can use to send spam or DDoS stuff.

The way such malware is installed is by application bugs or user error - both of these are not Windows specific problems. Firefox has had lots of problems and I am very sure it will continue to have problems.

These modes of infection are just as possible on Ubuntu, SuSE, RedHat etc. As for monoculture, all those popular distros have perl and sh installed by default. Can you imagine what a malicious perl script can do? I can. It could even google for new instructions :). It'll be interesting to see how the antivirus people would keep up with rapidly changing perl scripts that can fetch new code from all sorts of places, including each other :).

From a security technology perspective windows and linux are about the same - they are both still primitive and unsafe for normal users.

Both windows and linux (most distros) by default run the browser with the full privileges of the user using the GUI, this is not a good idea. The browser should be sandboxed off.

I have suggested that things work the following way: https://bugs.launchpad.net/ubuntu/+bug/156693

Market share has everything to do with infection. Nobody in their right mind will bother writing a QNX specific DDOS bot.

If you are living in a safe small village and your doors are unlocked, a vulnerability exists, but nobody is going to exploit it.

Back when I worked in IT security I found a fair number of security problems that never got public. Some weren't fixed for years. There are tons of security problems out there. But the hackers have plenty of far far easier AND more _profitable_ targets around.

Re:... and here's a Linux one.

[gd2shoe]

Nah, too much effort, putting it in a script/modifying permissions and all.

sudo rm -rf /

(presuming Ubuntu or other "friendly" distributions)

Re:... and here's a Linux one.

[Anonymous Coward]

That's for sure. More Village Idiots who are mostly Windows switchers bringing bad habits with them - "Click here to see the dancing monkeys"

your link is broken... can you repost?

Re:... and here's a Linux one.

[Divebus]

your link is broken... can you repost?

HA! Fscking hilarious... tnx

Why Linux and Mac OS will be safe

[Anonymous Coward]

Linux and Mac OS will never get the malware trouble Windows does for a good reason - the communities behind them.

Windows has such a large userbase, there are many shady-looking shareware apps that work just fine and do what they're supposed to. The problem is that Windows has developed a culture of suckiness such that users can't readily tell the difference between a legitimate vendor and illegitimate software. I had a webcam where I had to obtain the driver on a website that looked ripe for hosting malware. There's also the issue of having everything ActiveX enabled and scripting-friendly that essentialy lets malware distribute itself.

On both Linux and Mac, there is no ActiveX equivalent vulnerability, so the malware authors are going to have to work through the community.

On Linux, repositories are peer-reviewed and open code is generally preferred over closed-source solutions. Since software is under review all the time, there's no place for malware to hide and it is quickly detected and shunned by the Linux community.

On Mac, if an app is low quality, people generally gravitate away from that app and towards the better solutions. And the malware authors generally don't create a front that is believable. If you look at a lot of Mac dev sites, you will see that a lot invest a lot in fit, finish, and glitz. If the authors of Mac malware want to get anywhere, they'll have to find a way to auto-propagate malware - that or break into the Mac community - through recommendations by respected Macheads and investing effort into making their software appear usable. And by that time they've spent likely more effort than they're willing when there's the giant Windows bullseye just waiting to be shot at.

If you go to the macsweeper.com website, you'll find they lifted Apple's home page and modified it to make it ugly. If a Mac dev can't even create their own good-looking website, why would I trust them with software on my computer?

Re:Why Linux and Mac OS will be safe

[Anonymous Coward]

except that as more of the windows community move to the apple community they are going to influence things. I think alot of the moving market share comes from inexperianced users being told that Apple is "more secure" and they move towards that because they dont know how to many a windows machine secure. Or they simple dont bother, same thing. As more of those people start using macs then it is going to open opportunities for stuff like this more and more. If you can fool someone to downloading program 2164523 on windows then you can fool them to download program 2164524 on a mac.
Its ironic that the success of the apple campaign of being easier to use and more secure is going to eventually compromise its own security.

double digits?

[BeanThere]

There are now 10 or more Mac users?

Re:double digits?

[BeanThere]

Just kidding, seriously though, I presume they meant millions, but I'm pretty sure we're well past 10 million Mac users? Or do they mean new sales *per year*?

Re:double digits?

[Fluk3]

Nearing 10% marketshare. Not 10 million.

Re:double digits?

[BeanThere]

Ah, that would make sense :) But is that percentage of computer sales per year, or total installed base? I presume the former. There are some interesting stats here for anyone interested: http://www.appleinsider.com/articles/07/12/11/apples_leopard_to_boost_mac_sales_while_dell_hp_slump_report.html ... according to that, around 30% of new home computer sales in the US, that's not to be sneezed at.

Re:double digits?

[BeanThere]

That wasn't a troll, honestly, some people :/

Re:double digits?

[mcpkaaos]

Practicing your base 2, I see.

Re:double digits?

[daVinci1980]

That was my favorite part: "With the Mac's market share closing in on double digits"

Market share refers to the percentage of total install base that are macs.

In all honesty, mac has been closing on double digits for the last... well, how long have they been in business?

They're definitely doing a good 'little engine that could' impression, though. Most companies that can only maintain a small percentage of the market place fold. I suspect that the reason Mac hasn't is due to the exceedingly large size and growth of the consumer PC business.

Re:double digits?

[webmaster404]

That is true, however when you consider that Apple has much much more then just Macs with iPods, iTunes and just about anything else you can add a lowercase "i" to. Also, because Apple is into both hardware/software even though their marketshare may not increase much, they still get more profits anytime that a Mac user who has a machine that is too old wants to run the newest version of OS-X and spends about $1K to buy a new one and those that do have a machine new enough spend the ~$100 for the newer version. It also though, is in a monopoly position, in open competition a business with 10% marketshare would easily go bankrupt however they are still #2 in the (home) computer industry in operating systems. But really, Mac needs to maintain a #2 or #3 spot or else they have suddenly become "the man" and all the Mac-Rebels who want to rebel at the dominate industry (and there are plenty of them) would go somewhere else. Apple has enough cash to last them a long time with loyal customers, huge marketshare in the digital audio player business and online downloads.

Re:double digits?

[nmb3000]

Most companies that can only maintain a small percentage of the market place fold. I suspect that the reason Mac hasn't is due to the exceedingly large size and growth of the consumer PC business.

If you're making a profit it doesn't matter how many customers you have: you're still in the black. Sure, more customers then means more profit, but usually you hit a wall where you have to cut profits in order to stay competitive. If a company is happy with its single digit market share (what most would call a niche) then there's no reason to change anything. If you look at Apple's products (especially their audio division), I imagine they have a significantly higher average profit margin than somebody like Dell.

Re:double digits?

[Anonymous Coward]

"There are now 10 or more Mac users?" ...well, somewhere between 10 & 99, if you add up the sum of their parts as experienced users. unfortunately the apple dev teams aren't quite at the "experienced user" level, so fail to boost the numbers.

Re:double digits?

[xannash]

There are now 10 or more Mac users?

You must have meant that in binary, right?

Re:double digits?

[MBGMorden]

You have to understand though: Apple is a hardware company. Their OS and other software merely serve as a way of differentiating their hardware from the generic ones out there. When you look at it from that standpoint (competing against the likes of Dell and HP, not against Microsoft), Apple has a huge portion of their market and is doing quite well.

First Scareware?

[Macrat]

I thought Symantec released the first Scareware for Macs?

Contact Us page changed already

[caseih]

Looks like they read slashdot. Their "Contact Us" page is already edited now to remove the text copied from Symantec. Now the page doesn't say much of anything at all. No phone numbers, no addresses. Just a bare e-mail address. Hard to believe how scam artists can operate out in the open these days.

Re:Contact Us page changed already

[Timo_TM]

Well they didn't bother changing the lovely flash at kivvisoftware.com (which is what it shows in the application itself as the URL), that's still direct copy of Symantec's "about us".

Lol, thanks mod(s). BTW...

[Anonymous Coward]

I guess slashdot is having some kind of redesign, 'cuz the URLs have some extra &no_d2=1& cruft added onto them.

Thank you, whoever modded me up.
I don't know where the -1 Troll came from.

apparently it can even...

[reversial]

apparently if you subscribe, it'll even clear your DLL cache! http://www.macsweeper.com/buynow.php

Probably

[Reed Solomon]

"I visited the macsweeper.com website. I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected." And yet he probably did. Why would they limit themselves?

virtues of ports and repositories?

[xoundmind]

I'm not naive enough to think my BSD and Linux machines can't be infected, but.... This would seem to be yet another argument for ports, apt, etc. I've never feared any of the software installed through those routes. (Yes, I know security alerts arise and are addresses...I'm talking about over malware.)

Re:virtues of ports and repositories?

[Jeremi]

This would seem to be yet another argument for ports, apt, etc. I've never feared any of the software installed through those routes.

What if somebody compromised the software repository you are downloading from? Or subverted DNS so that you aren't actually downloading from the server you think you're downloading from? Or simply included a subtle back door in their app, and waited a few months/years for it to spread before using it to launch an attack?

I'm not saying these things are likely, but I don't see how apt-get, etc, are necessarily more secure than a plain old download...

Re:virtues of ports and repositories?

[Terrasque]

First point, about replacing. Same as with windowsupdate, they got crypto checking things.

Second point, about placing malware:
  1. Just about every software is delivered in source code format, and then compiled by the package maintainer, which also tweak the code to work fine with the distribution.
  2. To be a package maintainer you need to get thru quite a few steps, and the last part require meeting in person. You can read more about the process at http://www.ubuntu.com/community/processes/newdev

So, I see quite a few reasons for why it's much safer than plain old download.

idiot moderators

[Anonymous Coward]

why waste points modding down someone pointing out an obvious /. problem?

Re:idiot moderators

[LaskoVortex]

Because they have absolutely no concept of what a moderator is supposed to be doing.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:fixed it for you.

[Anonymous Coward]

"Yes, you can view straight smut on the mac."

ZING!

Fixed it for you.

Huh?

[rthille]

If he didn't want to get infected, he should have used lynx on OpenBSD!

"registry cleaner recommended"

[v1]

I have a fun screenshot of the Registry Cleaner web page, saying their software can fix problems in my registry which are causing all sorts of problems.

The first funny part is it desperately tries to look like an IE window with a close and cancel button etc which just clicks the download link, which is laughable since the browser is clearly firefox. Then next you notice the apple in the upper left of the screen...

Okay, smarty-pants...

[ciaohound]

... any recommendations for the following:

Real cleaning software for the Mac, that you've actually used and deemed worth continuing to use?
Best web sites to learn about Mac security?

Re:Okay, smarty-pants...

[pikine]

Real cleaning software for the Mac, that you've actually used and deemed worth continuing to use?

sudo rm -rf /

(cue after 10 seconds) Just kidding.

Re:Okay, smarty-pants...

[theurge14]

I have on freeware app I use periodically. It is imaginatively called Maintenance and appears basically to be a front end for built in Mac OS X scripts the system already uses, but also allows you to do things like clean caches and such. It isn't really necessary, but I do like that it helped me determine that my HFS++ volume had some header corruption and advised me to reboot from my Mac OS X install DVD and run a disk scan. It did and it repaired the headers and now the disk access is just as fast as the day I bought the computer.

Cleans all bad cookies!

[Maestro485]

From the features page:

- Clean all bad cookies. Simply deleting these cookies is not enough. MacSweeper really gets rid of the evidence! I guess it really gets rid of cookies by....um....deleting them?

And they say they'll even clear my "Unniversal Binnaries!"

If this isn't some kind of malware it sure as hell comes off like it.

Eee PC outselling Apple

[flyingfsck]

It is funny, but Asus expects that the little Linux based Eee PC (typing this on one!) will outsell the Macintosh this year.

Hi i'm MacSweeper Developer, listen to me

[MacSweeper]

I would like to explain all the situation, about MacSweeper. We are really trying to make a good software, and you wont find any viruses/spyware/trojans/malware in MacSweeper (test it your self, if you don't believe me, you can use any type of firewalls, dissemblers, or other tools) . The problem is that we are using selling partners that forces us to use this marketing type. We would like to leave them, we don't want to completely destroy Good Name of MacSweeper application.
Personally I adore Mac Platform, and it hearts to here that the program you wrote is said to be some kind of "Rogue application" , i wouldn't like to destroy good manners of software written for it :((
I would like to say sorry for all inconveniences that we could bring to you, but believe MacSweeper is meant to be a useful application.

You can ask Questions, and i will try to answer them! Thank You!

Re:Hi i'm MacSweeper Developer, listen to me

[Lewrker]

Dear Sir,
thank you for make clear mistake. I find myself have found an inheritance of 50 BILLION DOLLARS (AMERICAN). I rely my confidence on your arm in relate your website macsviper.kom be legitimate business as of identity yours will be made clear as mine is, for this I will need your kindest help with transfer five hundred dollars of administration price, for which of as of now I am not in relation available.
Sincerely yours,
Ba Ba Baa, Nigeria

Re:Hi i'm MacSweeper Developer, listen to me

[MacSweeper]

??? interesting :))

Re:Hi i'm MacSweeper Developer, listen to me

[Anonymous Coward]

You can ask Questions, and i will try to answer them!

Are you a dumbass or expecting us to be?

Re:Hi i'm MacSweeper Developer, listen to me

[MacSweeper]

Expecting you to be, next question.

Re:Hi i'm MacSweeper Developer, listen to me

[Anonymous Coward]

We are really trying to make a good software, and you wont find any viruses/spyware/trojans/malware in MacSweeper (test it your self, if you don't believe me, you can use any type of firewalls, dissemblers, or other tools). If you are really being honest, open source it and let us compile it ourselves. We cannot trust any software distributed in binary format only.

Satisfaction guarantee!

[flyingfsck]

SATISFACTION GUARANTEE: Shop safely at MacSweeper.com with the MacSweeper 100% satisfaction guarantee. If for any reason you are not happy with your purchase, simply contact our customer support staff within 30 days, and we will refund 100% of the purchase price with no questions asked. At MacSweeper.com your security and satisfaction come first. If you're unhappy, we're unhappy... then MacSweeper's unhappy. And, that just simply will not do.

Copyright 2007 MACSWEEPER.com.

Mac Malware you say?

[tristian_was_here]

Mac users around the world are going to have to throw away their macs and buy new ones! What about people with portable Mac computers? They wont be seen in Starbucks no more pretending they are journalists.

The risk is the user, not the mac....

[Anonymous Coward]

Being a mac user of many years, a network admin for a small mac network, and someone who helps people who use macs and switch to macs from PCs.... this the risk...

(1) There is no automated installation of crapware, because apple has not combined the system and browser APIs, which was microsofts fatal mistake. So, it requires the user to install the software - this is the risk.

(2) The real risk of people actually installing this, and handing over their password. It cannot auto install. This was the same difference between the sony rootkit on the mac and the PC. On the mac the sony rootkit required an admin password to install, which almost no one loading an audio CD would provide. Again the risk is the user, specifically user ignorance.

(3) The the only was this could happen is to PC users who make the switch to mac, and who refuse to believe that there is no crapware on the mac, like there is on PCs. I have come across several times... they just can understand they dont need to install anti-crapware.

The conclusion is...

[Jerry Smith]

With the Mac's market share closing in on double digits, perhaps it's not surprising to see the platform targeted with crapware as PCs have been for years.

With the former Windows users using the Mac more and more, it's not surprising to see the platform vulnerable to crapware as PC's have been for years.

There, fixed the summary.

Re:Hi i'm MacSweeper Developer

[ncryptd]

Well... a quick disasm of your binary doesn't show anything blatantly malicious, which is good... but I also don't see anything really useful. Pretty much everything your program does (and much, much more) can be done with OnyX. For free.

Oh, and you mis-spelled "purchase" in two methods in MacSweeperDaemon. ;-)

(void) purchaise
(void) purchaiseThread

I also noticed you left a somewhat interesting TODO list in the app bundle.

The binaries have references to KIVViSoftware throughout them -- you wouldn't happen to be one and the same with these guys, would you?

Disclaimer: I didn't find anything blatantly malicious -- but I only took a quick look. Given the folders that it tinkers around with, any bugs could do some damage to your Mac, so be careful.

Re:Hi i'm MacSweeper Developer

[konohitowa]

The only really interesting response in this thread and me without mod points. Oh well.

I'd have to say I'm quite concerned that the TODO list implies that LittleSnitch is something they want to blacklist.... assuming I'm parsing the list correctly and understanding the semantics. Anything that wants to remove my network monitor goes straight to my dustbin.. - oops - it just turned into an eject button... huh - okay - hang o

Re all ya all

[Anonymous Coward]

Arguing on the internet is like competing in the special Olympics, even if you win your still retarded.
http://dogtoe.com/weblog/wp-content/uploads/2007/01/arguing_on_the_internet.jpg

infection

[Tom]

I know I probably shouldn't have but I used a Windows PC so I knew I wouldn't get infected." Right, because a baddie trying to infect your Mac will absolutely not ever get the idea to put some IE exploit on his page as well, just for good measure, you know?

Stupid, meet journalist, your brother.

Re:infection

[MacSweeper]

1) windows machines are vulnerable to infections. 2) If you want to infect something, than you probably will look at the clients browser/os first? And depending on that you will send the code you want to the client! So using Windows machine, not to get infected thats the most stupid idea!

iMalware

[Wiseman1024]

iMalware. Get hacked with style.

Since you are about to get screwed up, better do it while listening to your latest DRM-ridden iTunes music in your grossly overpriced iPod. Make iMalware part of your digital lifestyle. It looks much better than Windows'!

Most Mac users are clueless anyway...

[Anonymous Coward]

Don't rely on Mac users being smart...

years ago a guy released a CPU demagnatizing tool for the Mac. It was shareware and only costed a few dollars. The man made thousands people would actually buy it and advise other people to buy it too (obviously it did nothing, just a UI).

So it's not a bad idea...

This is not a virus

[LKM]

1) This is not a virus
2) Now that you've implied that there are virusees for Mac OS X, please provide evidence

There's no reason why Macs couldn't geet viruses. Most viruses rely on human stupidity for propagation, and there definitely are dumb Mac users. But the edge cuts both ways: If you feel the need to complain about Artie MacStrawman, you should provide some evidence that your complaint isn't just as stupid as Artie's claims.

Who's snobbish?

[LKM]

While I haven't seen a Mac user claim that Macs can't be infected by viruses, I see morons complaining about supposed Mac snobs in each damn article about Mac security.

I'm not sure who's the snob here, Artie MacStrawman or you, who seems to think Mac users are dumb, deluded snobs.

Re:Who's snobbish?

[Nullav]

While I haven't seen a Mac user claim that Macs can't be infected by viruses, I see morons complaining about supposed Mac snobs in each damn article about Mac security.

Calm down, the 'dumbass' bubble on the Venn diagram overlaps with everything; don't forget the 'Joe User' crowd that misconstrues 'more secure than Windows' as 'immune to any attack'.

Re:Who's snobbish?

[undercanopy]

While I haven't seen a Mac user claim that Macs can't be infected by viruses,

most mac users on /. know better, however i hear less techie mac users 'in the wild' proclaim this all the time.

Awesome

[LKM]

mac people are either hippies, self important starbucks customers, media ediors, or mac software programmers and 3/4 of them are dumb enough to install this new "scanner" 50% Insightful
  (Score:1, Insightful)

The next time somebody claims /. moderators are pro-Apple and will mod down all dissenting opinions, I'm going to point to this flamebait.

And that matters because...?

[LKM]

It doesn't take special permissions to put stuff in ~/Applications.

And that matters because...? ~/Applications is just a regular directory. You don't need to put an app in there for it to run, and apps in there don't get any additional privileges.

Re:And that matters because...?

[sqlrob]

How many times does this need to be repeated?

Effective malware does not need special permissions

Granted, higher permissions make it harder to remove and/or detect. But given the average user, that doesn't mean squat, they wouldn't notice it unless it was in their face, and even then it's a crapshoot. Until there's effective MAC that an average user can use (Leopard isn't it, SeLinux doesn't cut it for the average user), malware will continue to be a problem. Even then, social engineering will work wonders, it's just more dialogs to make them click through.

Re:And that matters because...?

[LKM]

Yeah, that answers my question. Not. See GP's comment about the ~/Applications folder, please. I was replying to that.

Re:And that matters because...?

[sqlrob]

It does, as does other comments I've made in these threads. It makes it easy to get a user to run something unknowingly. Especially if they modify Applications in the sidebar to point to ~/Applications and symlink across the apps that are normally there. *poof* Something that looks legitimate in "/Applications", but really isn't.

Re:And that matters because...?

[LKM]

Okay, so the logic is: Since you do not need root privileges to alter ~/Applications, a malicious application run by the user could put another malicious application into ~/Applications which would then be run by the user. If you are able to put something into ~/Applications, the user has already run a malicious application!

How is that bad if the user has already started a malicious application which installed the malicious application?

Re:Hi i'm MacSweeper Developer

[MacSweeper]

Thanks! Finally there is a man who can think wise :) TODO list, yeh, thats some minor mess up, but it really shows what we are doing and what we about to do in our application. At the moment we are rapidly working on new, most wanted features like Dead Applications files removal. It should work something like AppZapper, but users won't need to drop every application into some area, it will work even when you removed any application. Just finds and cleans, it's that simple!

Re:Hi i'm MacSweeper Developer

[MacSweeper]

Little snitch default location is not /Applications or ~/Applications, its stored in/Library/Little Snitch/ which is not a standard location for the applications, thats why it is in our TODO list, because we don't want it to be removed, if there are some other applications out there, which are not using standard locations, we will add them to list.

oblig..

[Kreigaffe]

I for one welcome our looped-steel-wire overlords!

Macs not save anymore?

[Britz]

Popularity grows, so it becomes an interesting target.

For the people that went Mac for security reasons. Welcome to Ubuntu, comes preinstalled here:
http://dell.com/ubuntu

Re:Macs not save anymore?

[Weedlekin]

"For the people that went Mac for security reasons. Welcome to Ubuntu, comes preinstalled here:"

Because unlike dumb old OS X, Ubuntu Linux on Dell hardware has a secret magical AI capability that knows you didn't really want to _manually install a Trojan_ despite the fact that you typed in the administrator's password when the OS asked for it.

Re:Macs not save anymore?

[Britz]

Popularity.

Being so unpopular, that even malware writers didn't bother used to be the key to Mac security for so long. That advantage now sits with Desktop Ubuntu. There won't be a question for an administrator's password.

Maybe one System is more secure than the other, maybe one company manages to get patches out the door faster than the other (though I do like the fact that I don't have to rely on one single company for the delivery of patches), but nobody is immune to zero day attacks.

Re:Macs not save anymore?

[Weedlekin]

"Being so unpopular, that even malware writers didn't bother used to be the key to Mac security for so long."

If popularity is the key, then please explain why several pieces of malware (primarily viruses) for older non-Unix versions of Mac OS appeared during periods when its popularity was at a notable low ebb. Popularity gives people a reason for attacking a system, but whether they succeed or not is governed by how good a system's defences are, and with general purpose desktop computers in particular, users are a part of those defences because they ultimately control what does or does not get installed and run. To use Slashdot's much-beloved car analogy, a designer can reduce the probability of accidents by giving a vehicle superb brakes and steering, sensors that adjust to varying road conditions, lights than turn themselves on during rain, fog, and encroaching darkness, audible warnings of being too close to other vehicles, etc., but the fact that there's ultimately a human behind the wheel means that people can and will do stupid things, so our designer also puts seat belts and air bags in to increase the probability of the occupants surviving the consequences of both their own silly acts and those of others.

"Maybe one System is more secure than the other, maybe one company manages to get patches out the door faster than the other (though I do like the fact that I don't have to rely on one single company for the delivery of patches), but nobody is immune to zero day attacks."

Agreed in full. It's impossible for even the most talented group of people to build something as complex as a complete modern OS without making (a probably quite large number of) bad design decisions and programming errors, and this situation is compounded by the fact that the OS authors have no control over the thousands of third party applications, widgets, and other stuff that people want to put on their computers, the vast majority of which will also have their own share of bad design decisions and programming errors. What's surprising therefore is not that all there are, and will inevitably be security holes that can be exploited, but the fact that such complex combinations of elements from so many different sources work reliably enough for people like me to experience significant periods of up-time in Linux, OS X, and Windows XP.

So as you say, the best we can hope for is that vulnerabilities get found and patched before they're exploited, or failing that, are closed very shortly after an exploit appears, at least until somebody finds a way of preventing social engineering attacks like this one without frustrating and annoying users with Vista-style items such as "Your computer is about to do something that you may or may not have wanted it to do. Are you really, really, really, totally, and utterly sure that this is a good idea? [Yes] [No] [Duh...]".

Re:Yeah and moon is made from Green cheese

[Anonymous Coward]

Once upon a time there were only virii on Macs and the excuse was that Mac users were more creative.

Re:Hi i'm MacSweeper Developer

[mzs]

Oh dear LORD if this app will be deleting files in such a manner you will break SO MANY things. Just do the honorable thing, pull it before it does serious damage.

Your missimpressions of macs

[goombah99]

The statement of principles you make are all sound but you actually don't understand why they are not so relevant on a mac.

1) On macs you don't need root to install (most) applications, and applications don't (generally) run with root privledges.

2) Cosnequently, When you application does need root it must ask for it during install. Since this happens seldomly it is a much larger red flag than if this happened all the time.

3) Most applications don't require that you run an installer, and when they do run the installer, it's usually just an unpack operation, not an executable process. When it does need to run an executable to install, the installer asks first. Again being seldom it's a red flag.

Many (not all) Linux and Windows applications require root (or the equivalent) or make you know some archane flags if you don't want to installa s root. On linux if you try to go the route of not installing into root owned directories like /bin or the man pages or the libraries, or /etc, then generally you wind up in dependency hell, paths that break, man pages that can't be found, and no other user can run it. So in practice root only installs are prgamatically mandatory on Linux for any complex programs you want generally available. Same with Windows.

Also not only is there an apt-get port project, it's mature and in widspread use. Actaully there are at least three repositories for mac software. Ironically, because of their linux origins, they all have to be run as root and thus have all the dangers.

4) mac apps are self contained and thus are easy to uninstall. they don't spray pieces of themselves into special directories and possibly overwrite other simmilarly named libraries.

5) While open source is in theory examinable, linux apps drag in so many dependencies there's a lot of ground to cover. Package managers in some way make this worse since one draws from repositories that are spread geographically. If you work for government agencies there's some greater worry when pulling in some weird compression library from Russia than from say stanford. COnversely since mac apps are self contained it's one stop shopping, as long as you trust where you got it.

I don't understand this...

[emil]

...if I create a new, non-admin user on an OS-X system, can I browse to any site I want, launch any hostile process that I want, and feel secure that I won't damage either the OS or other accounts (that use the default privileges)?

Both under windows and OS-X, creating restricted users and using those accounts to browse potentially hostile websites is what I've always done to keep my system clean - this means that malware must first find a hole in the browser, then launch a process that finds a hole in an admin/root process for escalation (which is a much harder target to hit).

I never work as a privileged user. Is not not enough anymore?

OpenBSD is more secure...

[emil]

...here is why:

• strlcpy() and strlcat()
• Memory protection purify
  • W^X
  • .rodata segment
  • Guard pages
  • Randomized malloc()
  • Randomized mmap()
  • atexit() and stdio protection
• Privilege separation
• Privilege revocation
• Chroot jailing
• New uids
• ProPolice
• ... and others

Re:Macs not sa(f)e anymore?

[Switche]

I agree with the popularity factor, and I happen to also think that Mac OS will not withstand the security demands as the competing, current, time-tested, and server-grade OS's that have been targets for as long as I've been able to grep. I hope I'm wrong; it'd be nice to have Mac live up to its self-hype. However, this is a moot point to make without a lengthy, dead-horse argument that will only fuel the flamewars. I say this only to make clear that this is not my point. I'm here to point out that the Ubuntu user, in all his leety indi-ness, has just as much to worry about as the Maccy did so many years ago; when he was dancing around singing "Under Pressure" in front of a bright green background, as the newest Zero-day vulnerability exploits ravaged his friend's XP home edition box. Abandoning ship or gloating is the boob's argument. You can island hop all you want, but the waters are still rising. As a Windows user who has stuck it through all the way to Vista, lost and won many a battle with a straight face, and learned so much more throughout on how to protect myself in my environment of choice, I say bring it on. If you so can't stand being exploited as to learn from it, get off the Internet.

Re:Macs not sa(f)e anymore?

[Britz]

Well, actually I use Debian, but I happen to believe in diversity as a way to fight large automated attacks. Let the fileformats be standarized, but the implementations diverse. If 60% use Windows, 10% Apple and the rest goes Amiga and different flavours of Linux I think the internet would be a much safer place against those automated massive attacks.

Re:Macs not sa(f)e anymore?

[Switche]

A good point, Britz, but I'm not sure I agree entirely.

"By the toll of a billion deaths man has bought his birthright of the earth, and it is his against all comers..." --H.G. Wells, War of the Worlds

I'm sure there's consensus to the truth in this. That species which is attacked most by the most diversity of attackers will be naturally resilient to future attacks through its survivors. That's that point, and I have a slightly different one.

Diversity is important, but we're not talking about diversity within a species when we compare Ubuntu, Windows, Mac, etc., we're talking about a different species altogether, and the newcomer may as soon be a Debian as a Mac.

The key, however, is in the fact that they often belong to the same genus, phylum, what-have-you (this is only an analogy of course). After all, an Intel chip, under any other OS, is still an Intel chip, and a buffer overflow vulnerability will smell as sour; in a kernel, in an OS, in a plug'n'play driver, ready to exploit your specific CPU, just as my pet ebola is patiently waiting on that taco. Ebola doesn't ask you what clothes you're wearing before it wants to eat your organs. If you eat it, it is hilariously good at what it does. It's just a matter of time before I find out what you like to eat.

Now, again, I agree that diversity is important, and I submit that diversity in computers is far more vast and complex than simply saying Mac, Ubuntu, Windows are species in a genus, and I can make ebola tacos, but all of these OS's can be far less diverse on fundamental levels. Let's say I plop ebola on a big mac, a taco, and a garden burger on one plate, make 6 million of these plates, and hand them out. If I know 90% of everyone who gets a plate will eat one of those meals, I'm the freaking iron terrorist chef.

Selinux

[Anonymous Coward]

Selinux can provide protection for linux users.

For example, firefox should not be able to touch files outside of ~/.mozilla, create new processes and other stuff.

Re:Macs not sa(f)e anymore?

[Ohreally_factor]

You're over-thinking it and you've fucked up your analogy as a result. In your analogy, software is a vector of infection. Clearly, software is a target of infection, whatever the vector. So far, no malware author is infecting a person via their computer.

Diversity works like this (whether the scale be that of a home network, a business, or the internet): (1) A monolithic network, i.e., one dominated by a single OS, can be taken down at the knees. A mixed environment, while it might be crippled if half its component systems go down, can still hobble along and some work can get done. (2) The more diverse a network, the smaller the overall vector, thus slowing propagation of infection. Under these conditions, a virus might be contained or even burn itself out before reaching epidemic status.

Incidentally, ebola is not a food borne disease. I'll eat one of your ebola burgers if, in return, you let me wipe my syphilitic penis in your eyes. Deal?

Re:Macs not sa(f)e anymore?

[Switche]

I was aware that my analogy did not use ebola in realistic terms. I'm not a virologist or an epidemiologist. It's a bit of a sad shot to poke such holes in an analogy, but thanks for your words of wisdom, mighty syphilis man. If any such analogy were so flawless as you seem to suggest they all should be, we would indeed have computer-to-human virii. I'll assume such absurd statements were attempts at humor, though, as were mine.

Let me stop using analogies so I can make this simple, direct, and boring. Diversity is not simply determined by OS. I agree, though, that it is a major factor in epidemics, since many epidemic-grade virii are highly tailored to automate the exploitation of a large base of the same OS. You make a good point by explaining that multi-OS networks are an example of diversity in this attack scenario, and I agree that statistically a network has been safer from the majority of epidemic attacks by running OS-diverse networks.

Perhaps in this light, I invited such a response (ie: "fucked up (my) analogy") by my use of epidemic imagery, which was not necessarily the attack methodology I was referring to. My intended focus was in the fact that uniformity exists in many networks on lower levels than just the OS, using the Intel CPU as the relevent example for our article, thus undermining the idea of security through diversity of the OS. My response was to those who at one time thought changing to Mac was a safe security option by default because of targetting trends, and now to those who suggest jumping to Ubuntu, etc., because somehow Macs have begun to be targeted. I'm not going to take any more time to try to explain why this is a problem, because you clearly have more of a clue than the schmuck who waves a Ubuntu banner every time a zero-day vulnerability is announced on a mainstream OS.

To be honest, I'm not sure it was necessary to make a point of joining the fray on this one, considering how clear of a mistreatment of the problem changing one's OS is to those who care enough to know better, and how unimportant it is to those who don't. Of course, I suppose I did get a sexual offer out of it. Where should we meet?

Re:Macs not sa(f)e anymore?

[Ohreally_factor]

mighty syphilis man This made me so happy to be called this! Seriously, you have no idea. (And if you do, you might want to have that checked out.)

You make a good point about the other layers of the network, especially the hardware level. There was just an interesting story about "drive-by" cracking of wireless routers. Well, that's software, but it does demonstrate how the crackers' repertoire has expanded into other components of the network.

The majority of attacks today are on the OS. No particular OS is safe, of course. However, the epidemiological model does apply where viruses and worms are concerned, because a diverse OS "gene pool" (if you will) can slow and halt the spread of a computer "disease", just as it happens in nature. A virus needs a large enough vector to reach explosive epidemic growth. A homogenous population that is susceptible provides just such a vector, while a heterogeneous population decreases the vector. When the virus hits a non susceptible OS, it's reached a dead end. If the OS gene pool contained three OSes evenly distributed, the virus would only have a one in three chance of infecting the next computer to which it gets passed. Meanwhile, in the homogenous pool, the virus would have a 100% success rate, resulting in an epidemic.

Granted, this is just one tactic against viruses. It wouldn't be successful against a virus that targeted some other subsystem of the network.

Sooooo, anway, thanks for your reply and for overlooking my rudeness and crudeness. You really did make my day with that well deserved name.