Apple Quietly Recommends Antivirus Software For Macs

Barence writes "After years of boasting about the Mac's near invincibility, Apple is now advising its customers to install security software on their computers. Apple — which has continually played on Windows' vulnerability to viruses in its advertising campaigns — issued the advice in a low-key message on its support forums. 'Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult.' It goes on to recommend a handful of products." Reader wild_berry points out the BBC's story on the unexpected recommendation.

Comments

a way to make money

[Bizzeh]

is this a scare tactic for apple to push some payfor software and get people to buy it. or have apple started to loose confidence in their operating system? or even worse, do they know something we dont? are they expecting an attack?

Re:a way to make money

[bytethese]

It does sound like a possible "setup". Macworld 2009 debuts new AV software? Who knows. Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts? After all, Mac does seem to be gaining market share year by year.

Re:a way to make money

[YttriumOxide]

Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts?

Perhaps, but I am still waiting to see a real "virus" that hits MacOS. There's been a few trojans (such as the one mentioned in TFA), but nothing that qualifies as a virus yet as far as I know. It is likely much harder to write a real virus (rather than a trojan) for MacOS than Windows as you'll need to find a privilege escalation exploit (need I say, without local access) in one of the standard services first, all of which tend to be pretty robust and having a core that comes from the open source and Unix worlds... as far as I know, there aren't any such exploits known right now.

Trojans can of course still be fairly nasty, as there's a lot of stupid users in the world (of any OS)

Disclosure: I do use MacOS X as my primary OS at home, but I'm definitely not a "fanboy" (I also have Linux systems at home and use primarily Windows at work - I consider myself "OS agnostic").

Re:a way to make money

[Geoffrey.landis]

is this a scare tactic for apple to push some payfor software and get people to buy it

No, it's just common sense. Macs are not immune to viruses, and it's wise to keep up to date.

Re:a way to make money

[CFTM]

I don't know why you want to wait, it will happen in time. This is not meant as a critique of Apple in anyway, I am of the belief that over a long enough time frame, with enough market penetration, Mac viruses will become more common. It's not that Macs are inherently that much more stable, rather the market penetration is such that it makes more sense for people creating malicious viruses to focus on the PC instead. Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

I also would wager that the Mac OS is probably a bit more secure than Windows, because well, it's Windows...that being said if there's enough code there will be mistakes that can be exploited that's the nature of the human element.

Re:a way to make money

[stickystyle]

Disclosure is the correct word, look it up.
I did but hitting Apple-D on my Mac keyboard :-P

Re:a way to make money

[Anonymous Coward]

Why would it need privilege escalation? If there's a hole in some commonly enabled service that runs as root, that would take care of it.

Also, why couldn't a spambot just run in user space? Most people only ever use one account anyway.

Re:a way to make money

[bytethese]

OS-nogstic? :) I too use OS X at home and am certainly not a "fanboy" either. I too use Windows at work and have several virtual machines on my Mac (nature of the beast for my grad work). I agree with you regarding the difficulty in virus writing for the MacOS platform vs trojans. Unfortunately, there's more dumb people than darwinism can efficiently select out.

Re:a way to make money

[mario_grgic]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Re:a way to make money

[v1]

Macs definitely are susceptible to malware, as the recent DNS trojan has demonstrated. Any app that asks for and gets your admin password is going to play with your computer, that's pretty hard to beat.

Viruses, and worms in particular, do covert, automated spreading. Worms are able to exploit on-by-default network services remotely in the background. (we just had a new one announced yesterday! affects xp AND vista, good lord you'd think they'd learn by now!) Viruses require the ability to circumvent LOCAL security, and get their hooks in the system and replicate locally without user interaction/permission. OS X (and unix in general) are designed from the ground up with this in mind, and have always been far less vulnerable to these two issues.

I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice. Windows started in the wide open, and their devs got used to it, before they realize the scope of their mistake and tried to close the doors. The devs refused to stop writing apps that just "oh lets just assume we have full write access to the entire hard drive" etc. and so MS has had to go very slowly to avoid completely destroying their established software market. That's hard to overcome.

Even today I can count on one hand all the mac apps I've ran into that either (1) have to be installed while logged in as an admin, or (2) will only run properly (or completely) when logged in as an admin. And I count those developers as idiots for not knowing what they're doing and just assuming they have privs. Until Windows software approaches these numbers, I don't think we can call the Windows security model "fixed".

There are two things that most interest me here. First, Norton has been considered anything from "bad" to "poison" to OS X from the get-go. It's been known to create a wide variety of system problems, and in most cases, when OS X is misbehaving, and they admit they are running norton, the first advice they get is to remove it. (and "good luck removing it" to boot) Symantec has been of little help there, their first "removal tool" was 300+ lines of terminal commands, and still didn't completely uproot it. Their current removal tools are more effective and user-friendly though. So to see Apple RECOMMEND norton is something of a shock. I don't know of a single person in any of the mac support forums that recommends anything for Norton besides uninstalling it.

Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it. From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate? I seriously question where they're going by recommending you install additional (or possibly multiple) AV software.

Re:a way to make money

[deraj123]

Except the GP didn't say that it was easier to break into the system - he said that more people are going to try. I think he neglects to mention an underlying assumption that no software is perfect, and given enough time and effort, the chances of finding a security flaw that can be exploited is greater than zero in ANY piece of software. While this assumption won't always be true, it's completely reasonable for us to make it when considering the security of our systems - for we don't really have any way of disproving it for any particular piece of software.

Re:a way to make money

[TheRaven64]

It doesn't when you're talking about manual attacks, but it does for automated attacks. Compromise one Windows machine, and it's trivial to find a load more Windows machines to attack. Compromise one Mac, and it's much harder to find the next Mac to attack.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Oh, this just makes me laugh. Operating system the first Internet worm ran on? UNIX. It wasn't until the mid '90s that people started saying 'UNIX Security' without laughing.

Re:a way to make money

[yachius]

Market share may not have anything to do with the ease of breaking into a system, but it certainly makes it a desirable system to break into.

Market share + flaw = exploit

A coder trying to build a bot-net most definitely cares about market share, as does anybody who is profiting from compromising computers (spyware/adware).

Re:a way to make money

[Anivair]

You're wrong. Market share has everything to do with how easy it is to break into a computer. They are, in fact, directly proportional. the easier it is to break in, the bigger your market share. Just ask Debian.

Re:a way to make money

[tyler.willard]

...is likely much harder to write a real virus (rather than a trojan)...as you'll need to find a privilege escalation exploit...

That's not really correct. All a virus is is a self-replicating program that infects other files or programs. There's no need for privilege escalation. Granted, that would protect system files from infection (which is good) and perhaps make the virus less dangerous; then again, infecting docs (e.g. macro viruses) and executables in your home directory would still suck. Also since viruses and worms are often conflated (worms being self-replicating programs that only create copies of themselves) it doesn't necessarily follow that a worm would require privilege escalation.

...all of which tend to be pretty robust and having a core that comes from the open source and Unix worlds... as far as I know, there aren't any such exploits known right now.

Come on...having a Unix pedigree is indeed a large improvement but lets not forget where the "root" in "rootkit" comes from.

Re:a way to make money

[squiggleslash]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

Look at AROS! It has no security whatsoever, not even memory management between processes, so despite only having a hundred or so users, it must have zillions of virusses. But, of course, it DOESN'T. So far as I'm aware, nobody's bothered to write one, and it's unlikely any AROS virus would actually be effective.

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

It's frankly hilarious that Unix, on which the first worms operated, can be held up as some system that had security built-in from the start. It's also untrue that Windows, that is, the operating system known as Windows today, was "never meant to be a multi-user OS connected to the internet". Unless you're talking about Windows Me and its predecessors (98, 95, 3.1, et al), then that's completely false. Current versions of Windows (XP, Vista, 2003, et al) are derived from Windows NT, which was designed, from the beginning, to be "a multi-user OS connected to the internet".

In fact, Windows NT and its successors have a more advanced security model than Unix, allowing more than a separation of users and groups.

The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

Re:a way to make money

[domatic]

I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice.

There is another common stupidity that many Mac developers seem to have that still persists from the Classic days. Many OS X devs still act as though the user installing the app is the only one on the system. A good example is Adobe Reader. EVERY user that runs Reader for the first time will be pestered to enter an administrator password the first time the software is run. The only workaround is to copy some preference files into every home directory on the system and if there is an update to Reader then that has to be done again. Yeah, yeah, I know just use Preview but things like that happening are common. It isn't OS X' fault. There is provision for system wide app settings; it's just that OS X devs tend not to use them the way Windows devs assume everyone is an administrator.

Re:a way to make money

[nine-times]

Maybe it's just them covering their own asses against the lawsuits and public backlash that might come if a widespread virus ever does hit OSX.

Whatever the reason, they've been selling AV software in their stores for years now, and even included an antivirus with .Mac subscriptions for a couple years, in spite of these programs essentially not doing anything.

I'll go out on a limb here, though, and I'll advise that you don't install any of Apple's recommended Antivirus packages. They're resource hogs that don't really help you. YMMV.

Re:a way to make money

[YttriumOxide]

Why would it need privilege escalation? If there's a hole in some commonly enabled service that runs as root, that would take care of it.

True... I was sort of lazily accepting that as an unspoken obvious point, but you're right I should've mentioned it also. I'd consider this to also be extremely rare though, as it'd first require that there's something running as root listening on the network (only very few services do so), and then that it's exploitable (again the "well tested" part comes in to play here for these kinds of services).

Also, why couldn't a spambot just run in user space? Most people only ever use one account anyway.

Hmmm... I had to really think about this. I GUESS it's possible that code could be executed by a user's process that then causes some more code to be auto-executed at the user login with the privileges of that user only... Would be VERY noticeable to the system though, and killing it would be trivial, so I guess some kind of "very light" antivirus may be employed to guard against this kind of thing if anyone considers it to be a potential threat.

Re:a way to make money

[aliquis]

Mine just tries to add a bookmark :/
Guess you have added the shortcut yourself.

Re:a way to make money

[notthepainter]

Even today I can count on one hand all the mac apps I've ran into that either (1) have to be installed while logged in as an admin, or (2) will only run properly (or completely) when logged in as an admin.

At a previous job I had the task of making the installer for our consumer level OS X product. I had to fight with management to get them to let me spend the time to get it installed both as a drag install and to do it without requiring admin accesses. (Our product installed an item in System Preferences so this wasn't a no-brainer.)

I eventually prevailed and coded it "correctly" and was quite gratified to read in reviews how good the installation process was. It can be done but the non-Mac managers mindset just often doesn't see the need for doing it the "Mac" way.

Re:a way to make money

[wiedzmin]

Interesting theory, especially in the light of the fact that Microsoft has just announced that their AV solution will be free for all.

Re:a way to make money

[YttriumOxide]

There's no need for privilege escalation.

Technically correct, but any malware that runs purely with user privileges is going to be pretty tame - especially as it should be DEAD easy to find and kill (admittedly therefore some kind of "antivirus" software would actually be needed, but nowhere near the complex scale of current things)

Granted, that would protect system files from infection (which is good) and perhaps make the virus less dangerous; then again, infecting docs (e.g. macro viruses) and executables in your home directory would still suck

Maybe most users treat their systems differently, but I really don't have anything in my home folder that I couldn't stand to lose and regain. All important documents that don't get modified every day (especially my media files, as I'm a movie/music junkie) are stored in a directory that is read only, and on the rare occasions I need to write there, I'll enter my admin password (MacOS X makes this kind of setup trivial for even the average to dumb user, which is one of the reasons I like it as a home OS). The stuff in my home folder is mostly config files, temp stuff I haven't sorted yet (that's what my Desktop tends to get used for) and that sort of thing. I'd be annoyed at losing config settings, but not much else in there.

since viruses and worms are often conflated

Yep, I was being lazy in my wording... what I was describing was a worm with a viral payload, which is pretty much how any truly problematic viruses propagate in the real world at present.

Come on...having a Unix pedigree is indeed a large improvement but lets not forget where the "root" in "rootkit" comes from.

Absolutely, hence the qualifiers in my sentences... I wasn't saying, "impossible", just "much harder" and "none right now (AFAIK)"

Re:a way to make money

[YttriumOxide]

1. I always thought that a virus (by definition) had local access. If you're talking about network attacks, wouldn't that would be a worm?

Yes, excuse my laziness and see another reply I just made for further explanation.

2. Windows-based antivirus programs usually work based on a database of signatures. If there are no viruses out there to put in the database, wouldn't the AV program be pointless?

In my understanding the database of signatures is mostly a "guaranteed hit" kind of thing. The most important part however is the ability to detect as yet unknown things which works by detecting "malware like activity" (also a kind of signature, but not specific to individual bits of malware). That's what would be implemented in a situation where there's "as yet no known specific viruses"

Re:a way to make money

[jsalbre]

From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate?

I don't think they're suggesting that each machine run multiple AV systems, just that there are multiple AV systems in use among all machines, thus decreasing the chances that a virus can exploit a weakness in a particular scanner and remain undetected.

Also, OS X Server comes with ClamAV, but standard OS X does not. However, ClamXAV is available (completely free of course) for OS X and provides a simple way to install ClamAV and a GUI for management. I'm a bit surprised Apple doesn't list it on the recommendation page.

Re:a way to make money

[drumbug1]

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Win 2000, XP, and Vista are all based on NT - I really don't think Windows NT was ever designed to be a single-user system....

....or are you still using Windows 98?

Wikipedia says of Windows NT:

" It was originally designed to be a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix."

Re:a way to make money

[bkaul]

Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it. From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate? I seriously question where they're going by recommending you install additional (or possibly multiple) AV software.

I don't think they're recommending multiple AV installations on any given system, but rather a variety of AV programs being used by their user base at large. So, a virus writer will not be able to count on everyone having exactly the same configuration, and would have to plan to defeat a variety of AV programs if he wanted to ensure the effectiveness of his malicious code. This wouldn't be because all of them would be installed on a computer, but because any one of several would be installed, and he couldn't predict which.

Re:a way to make money

[drsmithy]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

No-one ever suggests that it does.

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) [...]

This is simply false.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

The very first versions of UNIX were not multiuser.

Re:a way to make money

[chaim79]

Market share isn't the reason there isn't a virus for OS X, I mean, come on now, there's a virus for linux on iPod! A virus that depends on hacked hardware that only a few thousand people are doing! How does 'market share' handle that one?

The biggest reason there isn't a virus for OS X is that it's so difficult, as the parent mentioned, to get anywhere. The only things out there for OS X are things that rely on the user's stupidity (which is potentially unlimited) to install and infect, but that isn't a virus, it's a trojan, or spyware, or something like that.

Market share will never come into the equation, it will always be the ease of making the virus. If by some chance windows overnight became as secure as OS X, then we will see viruses for OS X, then when the security is equally difficult we will see market share being the reason for the number of viruses on a system. But we're talking about Windows becoming secure and well-coded to prevent hacking, that'll never happen, so Market Share will never become a factor.

Until the point where windows is as secure as OS X (or hell freezes over, whichever comes first), OS X will always have few, if any, viruses, even if it becomes the market leader.

Re:a way to make money

[chaim79]

Mid 90's? so win 95? how did the security of Unix compare to the security of windows 95?

Maybe they stopped laughing at Unix security because they found something else that truly showed how bad security could be. :)

Re:a way to make money

[tbrex33]

In business aspect, the initiation of using anti-virus software for Apple products is solid because of the extensibility of the services that can be provided. Apple may have an eye on potential long term profitability through subscription services to anti-virus software provided through them, marketing it as "it will be easier if you just get the service through us because we know the system."

Re:a way to make money

[gzipped_tar]

Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it.

I guess it's because some of the AV products for PC use techniques similar to rootkits and modifies the kernel files. That leads to an abysmal hell if you try to stack them.

AFAIK ClamAV doesn't do that. It can be configured to run as a server (useful as an email server's virus filter), a cronjob, or a one-shot scanner, but not an intrusive bomb waiting to be triggered. That's why I like it: no on-access scan bullshit. (I believe one have to modify the kernel to achieve on-access scan, am I right?)

Re:a way to make money

[VirusEqualsVeryYes]

Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

Yeah. Why achieve the fame and glory of being the first to write a real Mac OS X virus? Why feel satisfied in crushing the worldview of every Mac fanboy in existence?

There's just no draw.

Re:a way to make money

[vertinox]

I think he neglects to mention an underlying assumption that no software is perfect, and given enough time and effort, the chances of finding a security flaw that can be exploited is greater than zero in ANY piece of software.

I don't believe this to be true if enough focus on security is made.

Software can be made secure at the expense of functionality. Now this doesn't ever solve the problem of local access, but if you made your OS into a glorified terminal server, you can prevent automated attacks by restricted what the user can do by default.

Of course the user might be hindered somewhat, but sometimes that is the price to pay.

Re:a way to make money

[Mister Whirly]

I recall people saying just the opposite when DOS for PCs was starting to become popular. Back then, people were writing worms for Unix systems, and there wasn't much "in the wild" for DOS. But no need to change your strategy as things obviously never change in the technology realm...

Re:a way to make money

[egomaniac]

It's Ctrl-Cmd-D. It will define the word under the cursor.

Re:a way to make money

[Mister Whirly]

Much like the Apple argument now. Not many people were targeting Windows/DOS boxes back then - Unix was the big target because it was the most widely used. The difference is nobody was claiming that Windows was "more secure" then due to the amount of malware being written for it. When I started at my job back in 2000 virtually none of the Windows boxes at the University were running any AV software. Even then viruses/trojans were not so common that you needed to run AV software on every machine. Personally I foresee the same thing happening to Macs in the future, but not as fast. Although if everyone keeps thinking that an OS is secure "out of the box" with no extra precautions taken, it may be faster than even I predict.

Re:a way to make money

[aliquis]

Probably not as much "it's Windows" as "more things run with excessive privileges."

Re:a way to make money

[Kerkyon]

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly)

This is mostly wrong. XP/Vista/Win 7 are NT derivates. NT was "designed from day one to be [a] networked multi-user OS". Whether they were done poorly or not is a different issue, and not a question that can be factually answered.

Re:a way to make money

[Kerkyon]

Software can be made secure at the expense of functionality.

The only computer that is guaranteed to be secure is one that is encased in concrete and dropped to the bottom of the ocean.

So I guess you're right.

Re:a way to make money

[LandDolphin]

Market share will never come into the equation, it will always be the ease of making the virus.

Your absolute shows a lack of thoguht into the situation that is common in America (I am assuming that you're and American, me too).

Both "Market Share" and "Ease of Making the Virus" are reasons viruses get created. Both are factors into the equation, along with others I am sure. To say anything "will never come into the equation" is very short sighted and flat out wrong.

Re:a way to make money

[Mister Whirly]

Viruses and trojans are free of charge. Feel free to install all that you want!!!
Oh, and did you pay for your copy of OS X or is it an illegally installed version?

Re:a way to make money

[MobileTatsu-NJG]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

I wish people would understand the true nature of a complaint before wishing it'd go away. I mean, it sure sounds good and gives people with mod points something to do, but it defies logic. You can't even run Unix without following certain policies (like continually updating the system). Heck, nobody's even been able to write software protection that hasn't been cracked shortly after release.

I wish people would stop parroting the fallacy that security in *nix is a matter of if and not when. Your OS is insecure. Sorry.

Re:a way to make money

[jhol13]

Why do you need a privilege escalation?
Why does it need to be remote?

Most of current Windows viruses are "britneynude.exe" type e-mails. Sure, Windows usually run as admin, but the virus really does not need any admin rights, though admin rights makes things like hiding ("rootkits") easier. But being admin is by no means necessary for sending spam, snooping keyboard for passwords, etc.

Re:a way to make money

[DesertBlade]

Luckily all viruses are free. But I agree. If I am going to have to pay the virus-tax I might as well do it on windows were I can get AVG and Avast for free. Luckily I run Linux on my main PC so I am 'completely' safe. I backup all my files that I can't stand to lose (pictures, Docs, home movies) off to a web host.

Re:a way to make money

[_Sprocket_]

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

Fair point. However, Mac OS X has far more market share than something like Aros. We're talking somewhere above 8% of the market right now. That's an appreciable install base and certainly worth targeting. By comparison, the Witty worm targeted (and infected) an install base of only 12,000 systems. So sure - install base might be a factor. But it is hardly the only one.

There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

Wait a minute here. Correct me if I'm wrong, but my impression is that the "administrator" setting of an account allowed sudo access. That's a little different than running as root. Is there something else going on in the Mac userland?

It should also be noted that we've heard these warnings before. The doomsday scenario has yet to come to pass. And while I agree that some of the perception of imperviousness is misplaced, I am also inclined to believe there's a bit more at work here than some critics want to believe.

Re:a way to make money

[LO0G]

Good points all, but I think you forgot one major aspect of the "market share" argument.

There hasn't been a true "virus" out there in the wild for years (to me, a true virus means self propogating malware - malware that modifies existing binaries and relies on those modified binaries being distributed). Instead there's a TON of malware intended on converting machines into botnet clients.

The vast majority of malware (maybe as much as 95% or higher) these days is really "crimeware" - software intended to aid in criminal activity (identity theft, click fraud,etc).

As a criminal, let's say that it's going to cost me $10,000 to hire some eastern european hacker to develop malware for my criminal enterprise (number totally made up). I get to chose which platform I have the hacker target - I can target Windows with 90% of the market, I can target OSX with 8% of the market or I can target Linux with 2% of the market (market share numbers also made up, but probably in the right ballpark).

That means that if I'm interested in profit (and this IS a criminal enterprise, so profit is the primary motive), I want to have my hacker target the platform with the highest ROI. That means that the hacker's going to go after Windows and ignore OSX and Linux.

As the Mac's market share increases, it is going to be an increasingly more attractive target for hackers, because the ROI is higher.

Re:a way to make money

[Me! Me! 42]

Mmm, I don't think so.
AFAIK this has always been Apple's policy. All they did was update the posting slightly to show the latest leading commercial AV software. Here's the previous update from a year and a half ago. I assume it was just an update of the one previous to it. (I think you will find that it looks very familiar!)
http://web.archive.org/web/20080113164722/http://docs.info.apple.com/article.html%3Fartnum%3D4454
"Mac OS: Antivirus Utilities
Last Modified on: June 08, 2007
Article: 4454
This article describes the antivirus utilities that are available for the Mac OS.

Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one program to circumvent, thus making the whole virus writing process more difficult. Here are some of the available antivirus utilities:

Intego VirusBarrier X4
Publisher: Intego
License: commercial

Norton Anti-Virus for Macintosh (formerly SAM)
Publisher: Symantec
License: commercial

Virex
Publisher: McAfee
License: commercial

This article provides information about a non-Apple product. Apple, Inc. is not responsible for its content. Please contact the vendor for additional information.

Article 17159: "Locating Vendor Information" can help you search for a particular vendor's address and phone number. Keywords: ktech kmosx"

Re:a way to make money

[drsmithy]

Technically correct, but any malware that runs purely with user privileges is going to be pretty tame [...]

Just what is it you think the average piece of malware might want to do, that it can't do with regular user-level privileges ?

[...] - especially as it should be DEAD easy to find and kill (admittedly therefore some kind of "antivirus" software would actually be needed, but nowhere near the complex scale of current things)

The rather large assumption here is that the average user would even notice that something was wrong, let alone start looking for a cause.

Re:a way to make money

[xbytor]

>I don't know why you want to wait,

Because, after a decade and a half running Windows of various flavors and several years doing tech support (aka virus removal specialist) part time, I've learned that keeping a Windows system clean takes more than a bit of common sense in addition to time and (possibly) money. Now that I'm on OS X, I just need common sense. I'm not going to waste any time or money on this "problem" until I hear of thousands of other Mac boxes going down in flames. When these dead canaries start being reported, I'll start paying attention.

Re:a way to make money

[mrdoogee]

I'm with you there. My XP box I bought in '05 had Systemworks pre-installed, and of course I didn't pay the extortion money when my "subscription" ran out so now I've got Norton popping up every few weeks running like its always been. Never mind that I uninstalled the whole program in 2006. And again in 2007, 3 times. And this year, twice. I will never use another Symantec product again. Sadly, I used to use McAffe, but on my dad's laptop, he's running the latest and greatest VirusScan and its just as bloaty as Norton now. I had to disable half the services just to get his computer to run programs AND AV at the same time.

Re:a way to make money

[vux984]

Hmmm... I had to really think about this. I GUESS it's possible that code could be executed by a user's process that then causes some more code to be auto-executed at the user login with the privileges of that user only... Would be VERY noticeable to the system though,

Really? I doubt most Mac users would know how to get a list of running processes. Most windows users sure don't.

and killing it would be trivial,

You've got know its there.

so I guess some kind of "very light" antivirus may be employed to guard against this kind of thing if anyone considers it to be a potential threat.

Very much so. Hell, most XP malware runs in user space too. Sure there is some bad stuff that gets deep into the system, but a shocking amount really doesn't do much more than setup a start up item in the registry.

Re:a way to make money

[Cowmonaut]

The lab is not the same as the real world. A lot of the time with exploits it isn't because of lazyness as much as the people testing it just didn't think the same way. This is why security is as much recovery from damage as preventing damage. I can't even count the number of times I've seen something tested in the lab to perfection work wrong in the field, or read of an exploit where in hindsight it seems like you would of tested that but when you really think about it just wouldn't have the time to come up with that attack vector in the lab. This is partly why new exploits are found in Windows. Sometimes it just takes that long for people to figure out that they even CAN exploit this or that service.

Re:a way to make money

[emaname]

This is in response to the fact that they've taken more market share from winD'ohs. They know that every script kiddie and his sun-light deprived cousin are going to start taking a shot at the Mac OS. Not to mention the criminal element. There is something to be said about prevalence re opportunity. (ie, The more there are, the more attempts there will be.)

Although malware *might not* penetrate as far into the Mac OS (because of it's Unix underpinnings) as on winD'ohs, it still comes down to NOT opening any suspicious emails and being careful about where you browse. Doing that coupled with a decent AV app is about as good as you can do.

Disclosure: I'm OS whatever.

Re:a way to make money

[Bobfrankly1]

Real virus writers are more concerned with making gobs of money with as little investment as possible. Mac doesn't play into that role yet, as the aforementioned marketshare is still small by comparison.

Also, virus writers are likely to stick to Windows for the same reason many users do, they already know it. Why spend the extra time learning a new OS to infect the minority when you can target the majority in much less time? That leaves you with so much more time to spend your pilfered moneys.

Re:a way to make money

[YttriumOxide]

That's pretty much what I meant when I said trojans rather than viruses... and I did specifically say that stupid users are a problem on any OS... so yes, you're 100% right, but you weren't actually disagreeing with me.

Re:a way to make money

[aliquis]

I didn't paid for it but it's legal.

Re:a way to make money

[daybot]

It will define the word under the cursor.

I should have read that more carefully - I kept trying to do it by selecting / highlighting the word...

Re:a way to make money

[aliquis]

Not that I'd care, 10.6 will most likely be pirated.

The difference is that since there don't seem to be any piracy defence system in OS X it works just as good anyway.

And in most software even if you block network access and can't update the software and so on it's still usable.

But for a virus program to work somewhat reliable you need to have the latest rulesets and if you can't get those unless you pay, well .. So a pirated copy won't help but it's not like I will pay for an antivirus software for OS X. As I said.

Re:a way to make money

[Anonymous Coward]

Agreed. Even with 5-10% of the market share, cybercrime is worth billions upon billions of dollars annually.

You can't tell me the reason the Russian Mafia isn't exploiting Macs is because they turn their nose up at anything less than a few billion a year.

Just think. A whole OS to yourself, full of people with more disposable income than PC owners and an attitude that their Macs are untouchable. The only positivist reason the Macs haven't been hacked is because they're designed to be more secure out of the box. You can't install a program without the password, ports are stealthed as standard. It's not because Mac exploiters won't get out of bed for less than ten billion a year... it's because there aren't any Mac exploits of this nature to be had, even for that amount of money.

Re:a way to make money

[pak9rabid]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

True, but the greater the OS market share, the more motivation there is for crackers to exploit it's vulnerabilities (if you think OS X (or any other OS) is 100% vulnerability-free, then you're living on the moon, in a cave, under a rock, with your fingers in your ears).

...and OS that was never meant to be a multi-user OS

Maybe that was the case with the non-NT versions of Windows, but certainly not with the NT-based versions of Windows, which haven't been in production since Windows Me. From Wikipedia:

Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was originally designed to be a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Actually, no it wasn't. From Wikipedia:

In the 1970s the project was named Unics, and eventually could support two simultaneous users. Brian Kernighan invented this name as a contrast to Multics; the spelling was later changed to Unix.

Unix (aka Unics), originally was NOT multi-user. That feature was added on later.

Re:a way to make money

[argiedot]

If I recall right, most viruses these days work by social engineering rather than by remote exploit. And marketshare does have a huge impact on that. To take an example, if I were to receive a .deb file which I wanted to install, I double-click it and after typing my password in, I install it. There is nothing here that would protect me from a malware writer.

If (and without the actual information I can't be sure about this) most malware is run by users who are just "trying to get that screensaver that I got in the mail" then this is going to hit the Mac crowd as bad as the Windows bunch.

At one point I thought that the repository system for Linux distributions would keep them safe, but it's obvious that in the search to make things easier, other (less safe) methods of installing (double-clicking a .deb, for instance) have been allowed. Remote root exploits are highly unlikely on my computer, but that doesn't matter, I'm already the weakest link.

Re:a way to make money

[philipgar]

And I'll ask you a question, how far into a system does a virus have to penetrate to achieve the virus-writers objective? Does a virus need to have root access to be part of a Botnet? Does malware need root access to start issuing excessive popups to the user? Does malware need root permission to run when a user logs onto a machine? Didn't think so. The only reason many of these malware programs get root access is because they can, and doing so makes them harder to detect, and harder to remove at a later point. Considering the majority of viruses are out there to make money (popups, botnets, etc), you really don't need root access to do this. No reasonable amount of security at the OS level will remove the threat of locally run malware on the system. It just can't be done unless the system restricts what programs can and cannot be run.

Phil

Re:a way to make money

[Sheik Yerbouti]

The whole Mac is immune to viruses is a myth. Most trojans would easily be able to trick a Mac user in to installing as they would Windows users.

Imagine thing pops up on web page and says you need xyz program to view this funny video download here they download it open the dmg and install it except it's a trojan pwned! The only thing that has prevented this thus far is a lack of interest in the OS X platform on virus writers part. Also many Windows exploits take advantage of drive by web browser infections by taking advantage of flaws in the browser or it's plugins. Again OS X is not immune to these either if the virus writers start targeting OS X. Ok so they get user level privilege but that's probably enough to steal keystrokes or exploit a race condition to get root. And if you think all of the myriad programs on OS X aren't susceptible to having a few race conditions you are nuts.

Re:a way to make money

[FellowConspirator]

You'll note that the cited knowledge-base article is itself an update to a previous article that said the same thing (with different links/products). In fact, for those paying attention, that same message has been on their site since the release of OS X. Apple's position has always been that antivirus is not a bad idea. Even if there are no viruses that target OS X, there might be someday, and in the mean time you do everyone a service by identifying, removing, and not passing on viruses targeting other platforms.

Re:a way to make money

[dave562]

It will only be a matter of time now that Apple is using the x86 architecture. All of the good virus code is written in x86 Assembly because that is what allows low level access to the memory registers and the CPU. The x86 virus code base has been evolving rather rapidly since the early 1990s. The initial difficulty of getting the code to run is pretty high due to a slightly better security model built into OSX. However like others have pointed out, there are dumb users of every OS.

Re:a way to make money

[FellowConspirator]

I'm kind of new to Macs, actually, but my experience so far is that only one vendor still operates on the one-user idea: Blizzard.com. Even MS doesn't do that.

Re:a way to make money

[rgviza]

No, they've come to realization that OSX, like any other operating system, is not immune to viruses and decided to admit it. Just because nobody's written one yet doesn't mean it can't happen.

All it takes is an individual to be interested in writing a virus for the OS, and have the ability, and a virus is inevitable.

Now we just need to educate linux users so they come out of cloud 9 too. I've been harping on this since I saw the first post by a linux user saying linux is immune to viruses. It's just plain wrong and is a mindset that people should not have.

Unfortunately it's also the dominant mindset.

-Viz

Re:a way to make money

[Sheik Yerbouti]

WTF this is a complete fallacy. UNIX is not a secure OS and was never designed from the ground up to be secure. Ever hear of the Lion worm?

  Actually the Windows NT line has better fine grained access control than most NIXes. I mean seriously you get owner and group RWX permissions and that's it unless you bolt on RBAC or something. A Solaris OS system out of the box is horribly insecure. UNIX was designed as a time sharing system before security was even a real issue.

Neither Windows nor Mac OS X nor Linux or UNIX would be considered secure by most security professionals. They can be made to be secure to a point and that point fails quickly when users are allowed to surf the web or read email on them.

Bottom line if you are using an unmodified default install of any of these OSes at the NSA you are doing it wrong unless you are setting up a honey pot.

Re:a way to make money

[hairyfeet]

While what you say is true, that it would be harder to find the next Mac to attack, I'm personally expecting a malware writer to come up with a truly "OS Agnostic" bug. Perhaps by creating a Trojan dropper that calls upon services specific to Windows, Mac, or Linux and then calls down a different payload depending on which services report back?

And for those saying "it is all about market share" I think you are missing half of the equation. While it is true that most virus writers follow the money don't forget or underestimate how much they like thinking of themselves as the "big bad" and how much of a rep they would gain if they pulled something like that off. I mean, look how many have tried in the past to create a Andy Warhol worm which we all know that if spread at the speed required to truly be a Andy Warhol worm would pretty much grind the entire Internet to a halt. So never underestimate the rep that one would gain by cooking up a nasty that could hit all 3 major Operating Systems.

And finally many Mac users have popped off their mouths on way too many forums about how tough their OS is compared to Windows. And we all know you get a special kind of satisfaction when you are able to wipe the smug right off of someone's face. So I'm sure there are plenty of writers of nasty things out there that would love to cook up a truly nasty Mac bug just so they could go "Nah nah" to all the elitist Mac users out there.

Re:a way to make money

[neoform]

So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

That's nice, but irrelevant.

He's attacking the line people spout "oh, there's no viruses for OSX cause not enough people use it", thereby implying that once enough people use it, there will be a similar number of viruses once that market share has been achieved. That of course is a logical fallacy since it's possible and even likely that OSX will never have anywhere near as many viruses as an OS like Windows.

Re:a way to make money

[dwlovell]

The whole foundation of your argument is flawed. UNIX was not designed with security in mind. In a 1979 document titled "On the Security of UNIX", Dennis Ritchie said

"The first fact to face is that UNIX was not developed with security, in any realistic sense, in mind; this fact alone guarantees a vast number of holes."

http://www.kernelthread.com/publications/security/tunix.html

Certainly Unix as well as other OS software have come a long way in security and none of them is perfect, but to make such a false statement that Windows is bad because security was an afterthought while thinking that Unix is any different is just foolish. There have been massive internet worms for Unix in the past, there will be virii for their vulnerabilities in the future.

Re:a way to make money

[el3mentary]

Took 5 hours to remove Norton the first time, and 2 the second, it's like a fungus, if you don't completely destroy it it just grows back.

Re:a way to make money

[el3mentary]

It's not probable that they make their own soft if they start saying that everyone should buy another one.

But for the virus question, it's true that there haven't been many viruses yet on anything but Windows, but don't forget that MacOS and Unix have another type of users which will maybe not click on every button on the internet.

I think that has more to do with the situation than any other single factor.

Re:a way to make money

[Too Much Noise]

Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

Yeah. Why achieve the fame and glory of being the first to write a real Mac OS X virus? Why feel satisfied in crushing the worldview of every Mac fanboy in existence?

There's just no draw.

The 90s called andd they want their virus-writer stereotype back. In case you haven't noticed, these days big viruses get written for money - huge botnet herds and all that. Search for it on /. if you're really that new here. There is also stealing CC info, but I'd guess the guys writing browser exploits have at least the 2 neurons required to look at the stats of the browsers hitting the sites they infected to see what targets make more sense to code for. Once it makes sense financially to add detection and infection code for Macs, there's little doubt that it will be added. It's a 'free market' and it will behave as such.

So, for glory and fanboy crushing, no draw indeed.

Re:a way to make money

[arminw]

....I don't know why you want to wait, it will happen in time...

Anything can happen, given enough time, according to evolutionists. Before even THINKING about installing performance robbing AV software, I will wait until I learn that at least 1000 OSX Macs have gotten infected by a self-spreading virus or have become part of a large bot-net. I think I will be waiting for a long time, certainly a lot longer than the life of any computer system.

Creating and running under an additional non-admin account should be part of the default Mac installation procedure. In many situations a person such as the father, mother, boss, etc, other than the day to day user of a computer should be the only one that knows the administrative password. That will prevent the kids, secretaries and other normal users from installing damaging crap that messes up the entire computer. A good network firewall and/or a program such as "Little Snitch" will also help protect Macs without sucking up a lot of performance for nothing.

Re:a way to make money

[TheRaven64]

Most malware authors these days are motivated by money - big botnets are worth a lot, for sending spam, launching attacks, or hosting scams.

There have been a few cross-platform exploits that could have been used to launch a worm, however. The mDNS vulnerability I mentioned earlier was almost one - it ran on Windows and on Macs (although it was only really exploitable on 10.4) and even on several open source *NIX flavours, and so the same code could have run on Windows and x86 Macs, trying a Windows system call to see which OS it was on and then setting up some usable syscall trampolines. Vulnerabilities in PHP (and there have been a lot) have allowed the same worm to run on any OS, as long as it had PHP and a web server installed. A vulnerability in a piece of common desktop software with an interpreter, FireFox maybe, would have a similar effect.

Re:a way to make money

[nsayer]

Windows NT, which was designed, from the beginning, to be "a multi-user OS connected to the internet".

[citation needed]

I will grant you that NT was designed to be connected to a network, but I find it incredulous that the designers had in mind a publicly accessible one, much less the Internet as we know today. Even Billy got it wrong in the first edition of The Road Ahead and had to revise his pontifications.

Re:a way to make money

[arminw]

....plenty of writers of nasty things out there that would love to cook up a truly nasty Mac bug....

Do you really think that some of the smartest, meanest, nastiest, glory hungry hackers have NOT tried in all these years to do just that? So far, they have failed miserably. A few isolated trojans preying on stupid users is all even the smartest and best hackers world wide have managed to come up with. When there comes into existence a 10,000 Mac bot-net, spewing forth tera-bytes of spam, there may be cause for the perps of that to crow a bit.

Re:a way to make money

[DesertBlade]

Went to avast.com and they are promoting their 'NEW' anti virus for MAC. Good timing.

Re:a way to make money

[pimpimpim]

maybe Jobs will introduce the first dangerous apple virus, the iVirus, on the next keynote.

Re:a way to make money

[SL1200MKII]

"There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system."

I agree with you. Has everyone forgotten the MOAB project last year?

http://projects.info-pull.com/moab/

This was a brief insight into what could be accomplished if a group of people really wanted to put forward the effort to uncover vulnerabilities. It has been argued that some of the vulnerabilities could be further enhanced and developed into malware. If there was a good enough monetary incentive to target Macs, it will be done. Currently malware witters target windows because the market share provides a more efficient monetary return on the time they invest. It would be foolish to think that the brightest malware writers (the real ones that actually develop new malware as opposed to script kiddies) are any different from the best software developers - they make efficient use of their time.

Re:a way to make money

[chaim79]

let me reiterate:

#1: If Windows became as Secure as OS X (as hard to write viruses for) then the 'market share' would effect the number of viruses written.
#2: Given the likelyhood of the above, 'market share' will never come into the equation.

You completely passed over that part of the comment... I'm not saying that market share has nothing to do at all whatsoever with virus writers, I'm saying it's only a small percentage of the equation (something like 1%) and the rest is ease-of-creation. Since windows will always be easier to write viruses for (considering MS's constant commitment to backwards compatibility) the market share will never be a meaningful part of the equation, and there will always be significantly more viruses for Windows than for OS X, even if OS X gains a higher "market share" than windows.

Re:a way to make money

[shutdown -p now]

You do understand that if a user runs a trojaned executable under a Unix system (Linux or OS X, doesn't matter), it will not be killed by some magic fairy dust, but will happily open some port above 1024 and start running?

As for true viruses, out of Linux, Vista and OS X, the latter is actually easiest to hit by a virus because it makes it so easy to install apps in user home directory (~/Applications), to which the user of course has write access (and so will any virus that he runs!). Linux users typically use package managers so their binaries all live in /usr/bin (and manually-installed software usually goes to /opt). On Vista most stuff gets installed into \Program Files, with some occasional libraries into \WINDOWS, neither of which are writable to user accounts without elevation.

Re:a way to make money

[xouumalperxe]

local user privileges are more than enough to use the computer as a zombie in a botnet.

Re:a way to make money

[shutdown -p now]

The devs refused to stop writing apps that just "oh lets just assume we have full write access to the entire hard drive" etc. and so MS has had to go very slowly to avoid completely destroying their established software market. That's hard to overcome.

Actually, it's already overcome. The only two apps I have on my two Windows PCs that requires elevation to run is Acronis True Image - and it makes sense for it as it's a sector-level backup application - and Age of Wonders, a game released in 2000 that I still occasionally play.

The thing is, not "assume we have full write access to the entire hard drive" has been a requirement for "Designed for XP" logo ever since it appeared in 2001, and is still a requirement for "Designed for Vista" logo. And yes, marketing departments for desktop ISVs actually consider those important enough to force developers to bring their code to the standard.

Re:a way to make money

[mrinvader]

AFAIK, OS-X processes run as the (nonprivileged) user, and only during software installation and system changes are user actions run as root. HAL implementations and things allow user interactions, such as a user being able to execute a dialup operation or to mount media. When a system update or a new piece of software is to be installed, or a system setting such as en/disabling a service, a dialog asks for the user's permission. Most better linux distros do this through sudo or it's guified variants. I almost NEVER am asked for permission to do something because I almost never make changes to the SYSTEM.

To play devils advocate, the same may be said for Fista, but Fista asks permission for EVERYTHING!! The user is so often annoyed by the stupid mother%$#@%%^# UAC bull%$#% that they no longer pay attention to whats going on requiring a priv elevation and just click (I agree)(I agree)(I agree)(I agree)WTF!?(I agree)(I agree)Leamme alone willya(I agree)(I agree)STFU i keel you(I agree)(I agree)(I agree)AGGGGGHHHHHHH THE %$#@!?(I agree)[DOOMSDAY] %&^%% NO CARRIER

That implementation is a recipe for disaster. I actually ship all Fista installs with UAC Off because it does no good anyway, plus, most remote control implementations don't work for %$%# under it.

Now, anything prior to Winders Fista, it's practically a hard REQUIREMENT to run as admin. Even something as harmless as Acrobat Reader will not run well without God privileges.

Re:a way to make money

[stickystyle]

Damn it. Tried to be a smart ass with my reply, only to mess it up by forgetting the ctrl key.

Oh well, I guess that's what I get :)

Re:a way to make money

[reallocate]

It's a statement of reality, that's all.

As for the "payfor" thing, I'm only aware of one free AV program for the Mac and that one often fails to receive glowing reviews. In addition, many people don't trust free software.

No computer is immune to attacks, including Apple's. And, I don't think Apple has ever actually claimed they products were immune. They've calimed Macs are far less likely to be attacked. That's true. Times change, though, and more Macs means greater incentive for lowlifes to target them.

Re:a way to make money

[reallocate]

"From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software."

I thought so, too, but on second reading I decided that Apple is trying to say that a user base that runs a variety of AV packages will help defend against the bad guys by increasing their code-around-this burdens.

Re:a way to make money

[trabisnikof]

This seems to me more like a run up to 10.6. AV seems like a feature that apple would love to ad to show off to windows. I can just see the Mac/PC ad where Mac is telling us how 10.6 will automatically scan for viruses for you, out of the box.

Re:a way to make money

[mrinvader]

Oh and trojans and worms require dumb users and exploits, respectively. Virii require homogeneous platforms with consumer accessible scripting languages and universal admin access... Thusly Windows is the most fertile platform for pestilence of any and all kinds, due to by-design perfect availability of all these conditions.

Windows is a Norway rat or a smallpox blanket.

Re:a way to make money

[Neoprofin]

Ferraris are stolen because they're worth vastly more than Toyotas. Are you implying that each infected Mac would somehow provide a multiple of what an infected PC would, thus justify the extra work involved? What's the point? If you could steal the most common car in America and get the same money for it as Ferrari would you really go through the effort of dealing with all the security and added attention?

BTW there;s far more to cybercrime than botnets so the idea that you'd get anywhere close to 7% by switching platforms just isn't going to happen. Plenty of things like phishing, fraud, and spam are completely platform independent and already running at a good clip as we speak. Crime is a high risk, high reward, game. If there was as much money as you think to be made from cracking Macs someone would have done it by now, or do you honestly think that there's no one in the world talented enough to find a hole in OSX with $28 billion on the line?

Re:a way to make money

[Khyber]

"I'm not going to waste any time or money on this "problem" until I hear of thousands of other Mac boxes going down in flames."

Yep, you've never worked at Flextronics before. Otherwise you'd know just how many Apple computes literally burn themselves up.

Re:a way to make money

[cyborch]

mac:~ Me$ ls ~/Applications
ls: /Users/Me/Applications: No such file or directory

I guess you were misinformed somewhere. Come back when you've had access to a Mac and actually seen how it works.

Re:a way to make money

[LandDolphin]

I still say you are incorrect. Having ~90% Marketshare will always have some effect.

Not being a "meaningful part of the equation" does not mean that "Market share will never come into the equation" as you previously stated.

Re:a way to make money

[Penguinisto]

Err, you do realize that DOS was/is utter pants for online use in the first place, right?

It made no sense to write (network-vectored) worms for DOS back then, because if you ran a DOS box, odds were excellent that you also ran it on a crap-slow modem with an intermittent network connection (mostly, the DOS users were offline).

That said, there were certainly no shortage of floppy-based malware written for DOS back in the day, in spite of the attack vector.

Now once Windows 95 and its built-in TCP/IP showed up... whoa, momma!

/P

Re:a way to make money

[shutdown -p now]

I apologize for incorrect information - apparently, they've got rid of the per-user application folder in Tiger. That is, in a clean install, you won't get it; if you upgrade an old installation, you still have it.

Of course, there's absolutely nothing magical about it, and you can (and people do) create a folder named "Applications" (or anything else) in their home dir and install applications into it via drag&drop, as usual.

Re:a way to make money

[Penguinisto]

Real virus writers are more concerned with making gobs of money with as little investment as possible. Mac doesn't play into that role yet, as the aforementioned marketshare is still small by comparison.

So millions of machines that no fellow botherder can swipe from you, almost off of them running no A/V, almost all of them running fairly homogeneous software and hardware setups...?

One would think that all that virgin territory would be well worth the effort for just those reasons, no?

/P

Re:a way to make money

[Mister Whirly]

Yes, i do realize that. But even you state yourself that many of the first viruses written for the platform made their way around through use of the "sneakernet" - passing around on floppies that went from one system to the next and infecting every system. Back then that was a perfectly viable delivery method that was quite effective. You also have to keep in mind that most viruses back then were written for the "glory" of simply writing them - now the motivation is to make vast zombie networks for profit utilizing fast connections. And the fact that most viruses back in the early 90s were only several K of bytes in size, and a "crap-slow" modem would be just fine for transmitting them (even though it wasn't a common transport).

Re:a way to make money

[mlts]

There are still holes that affect both Windows and UNIX variants.

One of the biggest culprits are Web browsers and Web browser plugins. Even if malware gets in and only runs as the user, it still can do a great deal of damage, from logging keystrokes via a transparent window, to copying and modifying files, to running its botnet code.

Even the most securely written Web browser is really not enough, due to the amount of browser plugins out there. What is needed is for the OS to step in and handle the Web browser as a special situation; a program that is in contact with untrusted sites all the time. Vista has gone one step by having it run in a low privilege mode, but even that hasn't helped in some cases.

Perhaps the best thing would be running the Web browser in a VM, with a shared directory so the user can save files. The VM would have CPU, RAM, and disk limits to help mitigate the damage malware can do. Perhaps even segment it further so an instance of the Web browser browsing evilpr0nsite.com that gets compromised won't be able to access the instance that the user is using to browse their bank's site.

Additional features can be added, such as when the Web browser is closed, the VM shuts down, preventing a process that forked off from running in the background. Perhaps functionality to roll back the filesystem of the Web browser back to its initial state before being run would be good too, so if the Web browser's VM does get breached, the changes by the malware are dumped.

A well written hypervisor has far less of an attack surface than a Web browser that could be running any types of plugins, themes, extensions, or other code.

The key would be making the VM encapsulation be as transparent to the user as possible. Of course, a chrooted jail is another solution to this, but its better to completely isolate the Web browser from the rest of the OS.

Re:a way to make money

[arminw]

...than setup a start up item in the registry....

The fact that OSX does NOT have an arcane, obtuse construct, such as that miserable thing called a registry, goes a long way in protecting OSX. Any program that wants to start automatically upon user login, has to install itself into an easily understood and very visible entry in the login items preferences panel. Any time a user wants one of their legitimate programs to start at login, they have to access that list. They would be easily be able to delete any or all entries. Mac users, in contrast with Windows users, NEVER need to have admin privileges for normal computer operation. A non-admin OSX user account will offer a large measure of protection from malware. A simple, unobtrusive program such as "Little Snitch" will alert a user that some program is wanting to go somewhere new on the Internet and give the user the opportunity to deny this access.

Re:a way to make money

[arminw]

..Any app that asks for and gets your admin password is going to play with your computer...

That is impossible, since our normal users don't know the admin password to their computers. Even in a family, it is easy to have the head of household be the only one who knows the admin password. That will prevent the kids from installing dodgy stuff that would damage the computer. In a work situation, only the IT persons knows the admin password. We reject *any* software that requires admin rights to run.

Re:a way to make money

[MLS100]

I think it's more a legal issue so they can cover their asses for their advertising insinuations that OSX is immune to viruses.

Now people can't blame/sue Apple when the first big Mac virus does hit.

Re:a way to make money

[Bobfrankly1]

R.O.I.
Return on Investment.
Lots of work for millions, or lots less work for billions. As well, when attacking Macs, you are restricting your attack largely to desktops. Apple is still getting their server game together, where Microsoft has been huge in the server OS market for years. There are Mac servers, but they are largely used on intranets, as they still lag behind Windows and Linux server offerings, even though they are working on catching up. Write a virus for Windows, you may catch some servers in the process!

Also, a virus doesn't equal a botnet. Though the botnet is the most glamorized threat out there today, a virus that re-directs your paypal, ebay, or amazon account to a fake site is very common and effective as well.

Re:a way to make money

[ickoonite]

A good example is Adobe Reader.

Actually, that's a terrible example. Adobe consistently produces (some of) the worst applications on the Mac. Even Microsoft now produce more Mac-like applications than Adobe do (e.g. use of Installer packages). If you're trying to prove OS X is teh fail, you'll have to try harder.

:|

Re:a way to make money

[bug_hunter]

I'll tell you my theory why people don't often try to write viruses for OSX (writing viruses for money and OSX is more secure aside).

You probably will need to be running OSX to write an effective virus for OSX and obviously have quite a bit of skill with it. If that's the case then you're probably a member of the mac community, and they don't wish harm on each other.

It sounds lame I know, but fanboys stick together and OSX community is a close one.

Re:a way to make money

[Penguinisto]

Depends - those "billions" of zombies have to be defended against other bot herders, are likely to have already been strip-mined of any useful identity information (e.g. the data has already been stolen and sold) and are highly liable to simply bog down and/or die, causing the owner(s) to get a clue and fix the thing(s).

Meanwhile, you still have all those Macs sitting there, with 99.9% (or so) of their owners perfectly oblivious to anyone putting it towards nefarious use.

Sure, you have to put more work in up-front, but once you get in, you get a much greater and more long-term return, and/or get some very quality information. Why? Well... one: the owner obviously has some ducats in his wallet - he bought a Mac. two: odds are very good that nobody else has pilfered the data. three: there's almost always enough resource horsepower to go around on a Mac, so you can get a lot done on one without alerting anyone --especially the owner/user-- that you're doing it.

No matter how you slice it, you simply get a better return on busting into OSX machines... but then, crims are usually too lazy to think such things through, no?

/P

Re:a way to make money

[jbezorg]

If there was as much money as you think to be made from cracking Macs someone would have done it by now, or do you honestly think that there's no one in the world talented enough to find a hole in OSX with $28 billion on the line?

But... but.... there's a whole page dedicated to how secure Macs are.

Re:a way to make money

[Nonseq]

Faith in their software? There have been Mac viruses around for 25 years or more. Before networking computers came out, I used to always use the same floppy when I went to the computer labs, and it always got infected there. They haven't lost faith in their product, they just don't want their consumers to be ignorant of dangers out there.

Re:a way to make money

[vux984]

The fact that OSX does NOT have an arcane, obtuse construct, such as that miserable thing called a registry, goes a long way in protecting OSX.

Not really. What Windows accomplishes with its registry *nix accomplishes in its file system along with hard and symlinks. And really, browsing the registry is no harder than browsing the file system.

Windows "System Configuration" applet is equivalent to OSX's "Startup Items".

Any program that wants to start automatically upon user login, has to install itself into an easily understood and very visible entry in the login items preferences panel.

Which is just a GUI interface to \System\Library\StartupItems and \Libary\StartupItems\ in the filesystem not much different than what Windows System Configuration (msconfig) does.

Plus is that REALLY the only place programs get get started up on OSX? Or is that just the obvious approved way?

I honestly don't know enough about OSX, but I find it doubtful that you couldn't manage to get an application started up very easily in user space from half a dozen other places.

Folder Actions triggers?
launchd? cron?
Safari extensions?
dashboard items?
hook something up as keyboard shortcut?
modify an existing perl / shell scripts that are run at start up or run regularly "enough"? (A lot of people have apache running in userspace, lots of places to hook something malicious in there.)

A non-admin OSX user account will offer a large measure of protection from malware.

Not relevantly more than a non-admin Vista account.

A simple, unobtrusive program such as "Little Snitch" will alert a user that some program is wanting to go somewhere new on the Internet and give the user the opportunity to deny this access.

And one of the first OSX bits of pseudo-malware, called 'opener' revealed that "LittleSnitch" could simply be killed before the app phoned home, and then started up again afterwards. Ooops. Although I'm sure that hole has been patched now the fact of the matter was that it was trivial to bypass and a lot of people thought they were safe.

Furthermore, LittleSnitch type software isn't unique to OSX. Windows has equivalent software... ZoneAlarm for example has been around forever. The built in Windows firewall introduced in XP SP2 can do this too.

Re:a way to make money

[_Sprocket_]

As a criminal, let's say that it's going to cost me $10,000 to hire some eastern european hacker to develop malware for my criminal enterprise (number totally made up). I get to chose which platform I have the hacker target - I can target Windows with 90% of the market, I can target OSX with 8% of the market or I can target Linux with 2% of the market (market share numbers also made up, but probably in the right ballpark).

That means that if I'm interested in profit (and this IS a criminal enterprise, so profit is the primary motive), I want to have my hacker target the platform with the highest ROI. That means that the hacker's going to go after Windows and ignore OSX and Linux.

As the Mac's market share increases, it is going to be an increasingly more attractive target for hackers, because the ROI is higher.

Sure - market share is one factor on ROI. But it's not the only factor. Another big part of ROI is how long you get to keep control of your target. If the target doesn't remain compromised very long, then you've wasted your resources (unless of course you only needed a short window - but that's implying a targeted attack and is beyond the scope of this conversation). The thing is, if you look at malware in the wild, you'll find that there are plenty of examples for Unix malware but they just don't survive long (with one exception - more on that shortly). This makes Unix platform poor ROI performers for bot herders to target.

Yet that 8% of the market issue still persists. Is that a significant enough number to warrant interest from malware producers? I don't see why not. An 8% market still a sizable number of potential hosts - far larger than most botnets. The Witty worm demonstrated that not only will small numbers be targeted, but doing so can be very successful. If the Mac's 8% were fertile territory, it would be very much in a botnet herder's interests to target it.

We know 8% market share is suitable because botnet herders are going after smaller targets; namely the 2% Linux market. But there's some caveats to this. First - we're dealing with a very different mode of attack. Researchers at Sophos believe that the attack involves a 6yr-old piece of malware - a virus called Linux/Rst-B. But the interesting thing is that if the virus is being used, it's as something of a simplified rootkit. Hosts are either being intentionally infected by this virus to provide a quick root shell or the attackers are moving around tools that are unintentionally infected. In either case, the existence of this malware is due to an already bad situation. Secondly, we're probably not really dealing with 2% - its more like ~12% of the server market. So we're dealing with a larger market share but hardly the largest (still a strike against marketshare driving attacks).

So what is making Linux worth the ROI? Smaller numbers. Compromised Linux hosts are providing stable controllers for botnets. As one needs fewer controllers than zombies in a botnet, Linux fits the bill nicely. All one needs is a mismanaged server on a stable link and a controller is gained.

So what do we get with all this? Marketshare isn't the driver that people make it out to be. Numbers are important. But there are additional factors that add weight to that importance. In the end, it's all about ROI. And that determines whether a platform makes a good target.

Re:a way to make money

[Falconhell]

Symantec, where good software goes to die.

Re:a way to make money

[PenguSven]

Of course, there's absolutely nothing magical about it, and you can (and people do) create a folder named "Applications" (or anything else) in their home dir and install applications into it via drag&drop, as usual.

so what exactly stops a virus writing to the user's home folder under Linux or Windows?

Re:a way to make money

[Lars T.]

It does sound like a possible "setup". Macworld 2009 debuts new AV software? Who knows.

Errm, yes. Apple says people should get anti virus software and names three apps - all that so people will go dump whatever they got and use Apple's solution in 1.5 months.

Re:a way to make money

[benthurston27]

Wouldn't someone have already developed effective malware for mac os or linux by now just because no one had already, like, for the challenge? It seems to me if linux has 2% of the marketshare 2% of the malware would be targeted at linux but maybe thats not true.

Re:a way to make money

[g-san]

My hat goes off to you sir.

Re:a way to make money

[g-san]

That's called Ctrl-Cmd-D'oh!

Re:a way to make money

[colmore]

It's like recommending a home security system to both someone who lives in the suburbs and someone who lives in Compton.

I've been using OS X for four years now as my primary OS and I do all the wrong things. I download warez and porn, I wait to install patches sometimes a month at a time, I don't have any virus protection installed and so on and so forth. I scanned for viruses about a month ago and there were none.

Use Windows for a similar amount of time in a similar behavior with no anti-virus software and the result will be different. There could be a sea-change and this could all stop becoming true, but right now the vulnerability of the two operating systems isn't really comparable.

All that said, the security system for the house in the 'burbs is still an OK buy.

Re:a way to make money

[jonesdog]

I agree with you x2. New product, all of a sudden macs are at more risk.. in saying that vista has bombed, more and more people are converting, making macs a little more worth the effort.. that will teach mac users for boasting so much :)

Re:a way to make money

[Bobfrankly1]

Well... one: the owner obviously has some ducats in his wallet - he bought a Mac.

The economy is where it is because people have been living beyond thier means. Possessions are not a sign of wealth, just a sign of credit which may be maxed out. So the owner of the computer having money or viable credit is a "maybe".

two: odds are very good that nobody else has pilfered the data.

Odds are that they were using a windows PC laden with spyware that stripped their information and due to the resulting slowness, so they bought a mac. Another maybe.

three: there's almost always enough resource horsepower to go around on a Mac, so you can get a lot done on one without alerting anyone --especially the owner/user-- that you're doing it.

I'm writing this on a current generation Aluminum iMac that sometimes has me wondering if there's spyware due to slowness and the occasional kernel panic. Apple makes a nice computer, but it's not the perfect machine some would have everybody believe. It's a computer, with it's own perks and shortfalls. So I count three maybes. No matter how you slice it, you might get a better return busting into OSX machines. But the criminals are more likely to go with the hacking what the know. What they know how to hack and what they know scores a better chance of R.O.I.

Re:a way to make money

[ToasterMonkey]

Well, there is the idea that with no AV at all, a virus could theoretically linger longer on a Mac. But, a widespread one would probably get weeded out with a system update, the same way Microsoft started pushing monthly malicious software removal updates.

I think it's safe to say from a botnet perspective anyway, one hacked Mac is worth more than one hacked Windows PC for that reason alone.

If there was as much money as you think to be made from cracking Macs someone would have done it by now, or do you honestly think that there's no one in the world talented enough to find a hole in OSX with $28 billion on the line?

How long can you continue to devalue what is now 8% of the computer market? It is growing, and the malware representation from it is... what? Which is it, REALLY secure, PITA to hack/compromise, or just not as valuable as other platforms? Are you expecting a rubber band effect when it reaches some larger market percentage? If you really want to think market size is the only factor, then what about Vista vs. XP/older? As Vista adoption continues, do you seriously expect malware incidents to continue at the same rate as XP? Why is it so hard to consider that maybe Mac OS X is/has already been in the same category of PITA to compromise.

It could just be that Mac OS X & Vista are secure enough, and make malware easy enough to detect & remove that the malware penetration rates we have today cannot be sustained in the future.

Re:a way to make money

[node 3]

Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

This is a tired argument. People write software for the Mac, why wouldn't they also write viruses? Why are IIS worms so much more prevalent than Apache worms? And why did the classic Mac have viruses?

All of these things make the market share argument less reasonable.

The problem is viruses are extremely hard to write, let alone distribute, for the Mac. Trojans are much easier, and it's no surprise that everything seen so far have been trojans.

The argument could be turned around against windows. Why create a virus for a system that has a strong antivirus market, when you could write one for a system where virtually no one uses antivirus software?

Besides, even if every virus writer really does do a market analysis and decides Windows is more profitable (as though all, or even most, viruses somehow create revenue!), being the first to conquer this new land and giving us Mac users our comeuppance seem like they would be strong motivators.

Re:a way to make money

[node 3]

There never was a ~/Applications folder in OS X.

Re:a way to make money

[saleenS281]

Telnet? RSH? Ya, definitely built from day one to be secure.

Re:a way to make money

[pineapplechild]

I *constantly* have to uninstall multiple av products that are fighting with each other, on the student pcs i see everyday.

Re:a way to make money

[svank]

The only computer that is guaranteed to be secure is one that is encased in concrete and dropped to the bottom of the ocean.

Not if it's encased with a large battery and satellite connection to the Internet.

Re:a way to make money

[node 3]

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

This is called critical mass. The fact that there's a very healthy third-party developer market for OS X is strong evidence that it's reached a sufficient critical mass to attract virus writers. The fact that there are trojans out for OS X is strong evidence for such critical mass.

So, you must be wondering, why aren't there any actual viruses for OS X? It's because they're too damned hard to write. Trojans? No problem. Worms? Sure, but they won't be long-lived. Viruses, though, on OS X are a nut that's yet to be cracked.

People always like to bring up how most malware is meant to earn money, or that most people use Windows, so it's a bigger target. This only explains why OS X has less viruses than Windows. What it doesn't explain is why OS X has no viruses. You'd expect at least one or two, if for nothing else than the fame and to take Mac users down a peg.

The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

You do not understand how Mac OS X operates. Admin accounts are not the same as the user Administrator or the group Administrators (on Windows), nor the same as root on Unix. They are basically equivalent to a Unix user in the sudoer's file. You have to enter your password to elevate your privileges, just like you do in Unix, and similar to what you have to do in Vista (although the OS X/Unix way is a bit more secure in that someone can't just walk up to your unlocked computer and start wreaking superuser havoc without your password).

Re:a way to make money

[mjwx]

Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

Didn't RTFA huh. The goal isn't to create a Mac virus per se but rather to create a multi platform virus. so to fix your logic:
Why target 85% of computers when you can target 90% of computers.

Also Mac's tend to attract the less tech savy users so they are considered easy targets and less likely to figure out that something is wrong, the "it just works" philosophy only adds to this as users tend to ignore the fact every system suffers problems, even if its just entropy.

Re:a way to make money

[afxgrin]

How about Apple just writes a bunch of different anti-virus programs for hackers to circumvent?

Aren't they the ones interested in maintaining their crown?

They know their own operating system better than anyone else (well aside from a small subset of nerds), they are in the best position to do this. Just include the additional cost into whatever premium Apple already charges on their computers.

The antivirus application scene for the PC is fucking annoying as is, don't bring this stupidity to Apple. There's 20 different names for the same virus, the viruses that do get caught depend on which AV software you're using, and the age of the virus ...

Isn't this really the future of computing anyhow? Writing an operating system that doesn't get hacked by some random teenager on IRC.

Re:a way to make money

[CFTM]

At least what it wasn't lost on every one. I didn't thoroughly articulate some of my points but it's amazing how some people decided to read one sentence and then launch an attack. Thanks for clarifying my obfuscated point.

Re:a way to make money

[v1]

My most recent encounter was with LifeTouch. They come to your school and take pictures of all your students, and then send you a CD that lets you organize them, print class photos, print student barcodes, make IDs, etc.

When installing the software, it behaves like a good mac installer. But then the installer FAILS halfway through with an error. We assume it's trying to write to somewhere that WHEEL has write access to, without using SUDO, since it never asks for a login/password.

So we login as an admin, and the installer runs fine. It doesn't even ask for a password and finishes the install. So almost certainly somewhere WHEEL.

Relogin as the secretary and it works fine. Oh, no it doesn't. None of the PICTURES show up. Everything else works, just no PICTURES. This *IS* their product and it's the only part of it that doesn't work.

Further investigation finds that the pictures are copied into a folder on the hard drive, and the folders they are stored in are executable (directory readable) only by the user that installed them. (the admin)

I called them on this and they said "oh your secretary needs to be an ADMIN to use this software". Idiots. We have a tech-savvy superintendent, and she has wisely decreed that her and the three principals are the only admin users in the building. Just nonchalantly saying "oh just make them an admin" demonstrates a dangerous lack of understanding about computer security, particularly in a public environment like a school. If your only justification for making a user an admin is because a harmless app needs it to run, that's justification to find a different piece of software.

In retrospect, I bet we could have promoted her to an admin , ran the installer, and then demoted her, but still, no other users on the computer could use the software even then.

So after I installed it I went around and fixed all the permissions and it worked fine from there on.

Re:a way to make money

[v1]

CS4 last I checked, you cannot run the updater if you are not an admin user. The versioncue sys pref won't properly unlock when it opens, and unlocking the padalock doesn't help.

Trying to download and run the updates manually only works for some of the updates, others also require you to be logged in as an admin to run them without errors.

Re:a way to make money

[v1]

Actually, it's already overcome. The only two apps I have on my two Windows PCs that requires elevation to run is Acronis True Image - and it makes sense for it as it's a sector-level backup application - and Age of Wonders, a game released in 2000 that I still occasionally play.

There's still no reason for the former to be true. Why can't Acronis pop up a dialog and ask you to provide an administrator's user/password, and use those credentials for privileges? That's how OS X has always worked.

And you are fortunate indeed to only have ran into those two examples. The small amount of pro software I've interacted with on the PC hit pretty much 100% admin-login-required to install, and maybe 45% admin-login-required to RUN. Countless other minor titles had issues, like libraries, bundles, and various packs being inaccessible to non-admin logins. Works did that with most (but not all?!) of its clip art libraries for reasons I have yet to fathom.

Re:a way to make money

[domatic]

So after I installed it I went around and fixed all the permissions and it worked fine from there on.

Yeah gods, I'm a K-12 netadmin myself. I forgot to rant about that sort of thing while I was at it. Radmind has been my friend here. I install such things, get the permissions set, then push them out with Radmind. Still a pain and I've had to figure out those hassles too many times as well.

While I'm at it, want to commiserate about educational software catalogs that are full of either grotty Classic software they go and order behind your back or software from the 10.2.x days that makes Rosetta blow up? Apps cored around PowerPC Flash projectors are great at doing that. Even recent ones are built that way. Is it that hard for them to check the UB box when they build this crap?

Re:a way to make money

[domatic]

I wasn't trying to prove OS X is the fail. I was making the point that many that develop for it and then sell the apps for good money are. Here is a non-Adobe example (I have to support CS3 on OS X btw): Scholastic makes server-based reading assessment software called Scholastic Enterprise Edition. The Reading Counts and SRI apps allow the server IP to be set globally. The SAM application that teachers use to track student progress has to be set per user/per machine to log into that same server. Recently they added a config tool like the ones SRI and RC use but it the app doesn't respect the setting. I've been fudging my way around that one for years now.

I run into this sort of hassle frequently and often. OS X application developers often have no inkling their products will be used on managed machines and networks. Again, not the fault of the OS. That is what /Library/Preferences is for. I rather commend Apple for addressing all of the bitches I used to have with OS 9 and before but many of the third-party developers are still rooted in that old mindset and making trouble for people using OS X on managed LANs. I DON'T want OS X to fail. I'd soon be stuck with Windows 7 boxes in their place.

Re:a way to make money

[Z34107]

I work at a help desk at my college, mostly removing viruses from student laptops and answering phones. Practically all the viruses I see on the Windows side of things are Trojans - half the time it's some fake-antivirus scareware that gives a million false positives to try to get you to by the "full version" for removal.

So, at least in my (limited) professional experience, it's mostly trojans already. People click on the "Your computer is broadcasting an IP address!" ads and do whatever they say.

But, I have seen a few infections on Macs - 2 on the same day, in fact. It would constantly change your DNS server to one that would resolve bank website addresses to phishing site. Scary.

But, I would posit that no software company will ever patch the user behind the keyboard, and everyone is already targeting that oversight quite effectively. Unless Mac OS HelloKitty prevents the user from installing software.

Re:a way to make money

[Immerial]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

Look at AROS! It has no security whatsoever, not even memory management between processes, so despite only having a hundred or so users, it must have zillions of virusses. But, of course, it DOESN'T. So far as I'm aware, nobody's bothered to write one, and it's unlikely any AROS virus would actually be effective.

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

Well look at the earlier days of the Mac. Mac OS 9 it had a smaller market share than we have now (~4.6% in 2001 according to IDC) and yet had more viruses. Only reason my a**.

I'm surprised we haven't seen anything major. Current installed base is <20 million (1997 numbers, Wikipedia), with almost all without any anti-virus stuff installed. You'd think that would be an interesting enough target.

Re:a way to make money

[arminw]

....Not relevantly more than a non-admin Vista account...

Except there is significantly more software for all flavors of Windows that will not work correctly if the user doesn't have admin rights. Knowledgeable administrators can often work around that, but normal users are stuck. Their choice is to run as admin or throw away their software investment. There is NO OSX software that needs for a user to have admin rights.

(...And one of the first OSX bits of pseudo-malware, called 'opener' revealed that "LittleSnitch" could simply be killed before the app phoned home...)

Except that that an admin password was needed first if the user was not running as an admin. Even the stupidest user is safe against such an attack if he/she doesn't know that password. In businesses the IT person(s) would ensure that only those that REALLY need that information to do their job would have it. In families the head of household could keep that information, thereby not letting the kids or their friends install every program they can find on the Internet.

(...Plus is that REALLY the only place programs get get started up on OSX?...)

Yes it is for any user not running under an admin account. The data is in a text file in /users/username/library/preference/loginwindow.plist

Moving or erasing that file eliminates all non-admin user accessible startup commands. Therefore simply trashing that file as well as the /users/username/library/preference/com.apple.loginitems.plist restores the user account to what it was when first created. Any malware created startup commands will be removed, thus effectively killing it.

In any computer, including OSX, once a program has the proper access, it can do whatever it wished within that constraint. The key is to not let a program have unfettered access in the first place. OSX makes that much easier to do than Windows.

Re:a way to make money

[Neoprofin]

I think the Mac as a platform will continue to be ignored for as long as there is a large enough population of poorly managed Windows machines that money can be mad with little to no work. If you were pulling in 500K a year doing absolutely nothing other than letting a botnet run wild would you really care if you could be making more? I'm not saying it wont be done, I'm just saying that if I were a botnet herder unless times got tough I don't think I'd bother with putting in any kind of effort at all.

It doesn't matter how much or little of a pain in the ass to compromise it is, the point is that it's clearly enough of a pain that no one bothers to do it. It's not possible vs. impossible, it's easy and plentiful vs. anything else.

Re:a way to make money

[Lord Flipper]

Correct me if I'm wrong, but my impression is that the "administrator" setting of an account allowed sudo access. That's a little different than running as root. Is there something else going on in the Mac userland?

Nope. You have it right. Admin is just a 'group' that the user/owner can be a member of, and it 'can' get privilege escalation. Sure. But the best defense against ANY process trying to piggyback onto to an admin account's escalation (during an install, etc) is to defeat the 'timestamp' on the escalation (su or sudo), itself. This is the same in Unix and all the Linuxes out there, as well as the Unix known as OS X.

With a timestamp of zero, any process polling the System with a 'do-we-have-root/access', etc is given a boolean 'no.' In combination with Little Snitch (somewhat similar to blackICE, as far as 'phoning home' goes) it keeps control in the hands of the user/owner/admin.

On the other hand, smart people make the stupidest mistakes, and if we add in a 'fatigue' factor, well, anything is possible. heheh.

But, if a script needs either Internet access or privilege escalation to do harm, then those 'conditions' can be put entirely off the table. Most Mac users, 'smug' or not, employ neither of those defenses. And all I can say is: Too bad for them.

Apple's typo in a shell script associated with one of the iTunes updates was all the proof-of-concept we needed, as far as vulnerabilities go. But that was a self-destructive (data loss) situation, and most script/botnet people aren't concerned with that, as an outcome.

The healthiest attitude is to assume that everyone who is 'not me' is an adversary. Kinda like having a mindset that mirrors the default 'deny, allow' that makes Apache such a gas.

Re:a way to make money

[shutdown -p now]

Absolutely nothing, but why would it want to? The point of a virus is to infect as many executables as possible to propagate. Typically, there aren't many (or even any) executables under the user's home folder in either Linux or Windows.

Re:a way to make money

[shutdown -p now]

There's still no reason for the former to be true. Why can't Acronis pop up a dialog and ask you to provide an administrator's user/password, and use those credentials for privileges?

That's precisely what it does. I merely pointed out the fact that it actually requires to do so, and cannot just work under a normal user account.

Re:a way to make money

[PenguSven]

the same applies to OS X. I've been running OS X for YEARS and I've never seen the ~/Applications folder created automatically, not any applications that install there by default.

Re:a way to make money

[LO0G]

There are TONs of PoC exploits for the Mac and Linux (don't forget that the Mac was the first machine to fall in Pwn2Own this year). But they're not widespread because there's simply no money to be made by them - why deploy an exploit that hits 1,000 machines when you can deploy an exploit that hits 1,000,000 machines with the same effort?

And there IS malware for the Mac. I wouldn't be surprised if there are botnets out there that were entirely composed of Macs. After all, you don't need any special privileges to run a botnet client.

I KNOW that there are malware authors who are modifying their malware to run with limited privileges.

Re:a way to make money

[jroysdon]

They read that Microsoft's marketshare is down, and OS X is up. The more popular and OS is, the more viruses will be written. It's only a matter of time until OS X becomes a much bigger target due to increased marketshare. I think they just want their users prepared.

Of course, I think they should write the antivirus app for free and/or license it from whomever, and provide is as a form of regular support.

Re:a way to make money

[v1]

reason is, the vendors want to pay to build it once, and then sell it for the next 8 years. They're too cheap to update it.

Unfortunately sometimes the teachers don't mind. When the budget is tight and there's a whole storage room full of retired out imacs running 9.2.2, and they have boxes of old learning software, it's hard to argue with them that it's not still useful, and it's certainly cheaper than buying new computers for the classroom AND new software.. ABC is still ABC even 8 years later.

In a way that's a double edged sword with macs... they tend to have a surprisingly long useful lifespan, especially in some areas, and people start depending on that and putting off upgrades to the point of where you can't really upgrade anything anymore, you just have to pitch it all and start new. (hardware and software)

I'm finishing up upgrading a newspaper here, their entire company ran on OS 9 until last year. Quark, Photoshop, Illustrator, PageMaker, you can just imagine their horror when they found out they could not BUY a new machine that would run ANY of their old software. And the older versions of those apps can't open the docs the newer ones make, so they had to upgrade all of them at the same time. Eight new imacs, mbp, and a mini, plus pro software all around. I bet their accounting department had a stroke.

Re:a way to make money

[v1]

oh ok well that's reasonable. The apps that just assume you're an admin and immediately smash into a wall are the ones I have a problem with.

Re:a way to make money

[domatic]

reason is, the vendors want to pay to build it once, and then sell it for the next 8 years. They're too cheap to update it.

No kidding. But why the hell is an app published in 2006 not built universal? I've got a couple like that on my hands.

In a way that's a double edged sword with macs... they tend to have a surprisingly long useful lifespan, especially in some areas, and people start depending on that and putting off upgrades to the point of where you can't really upgrade anything anymore, you just have to pitch it all and start new. (hardware and software)

We've hit that point. We plan to have all Intel Macs by 2012. We started bringing them in as dual boots in 2006 in places where there weren't CD caddies full of software going back to the mid-nineties. They made better Windows machines than the Dells they replaced.

We've started replacing machines that were new in 2000 with Intel Macs so we're starting to feel the pain. A big problem that bedevils me is that software catalogs will state that educational package X is "Mac Compatible" but they don't state how. Things that run in Classic are almost useless (I keep a desperation load of SheepShaver around but by no means intend to depend on it), things that need Rosetta tend to be hit or miss, and things that are either Intel or Universal binaries tend to run very well. The problem is that many educational software houses haven't bothered to join the rest of us in the 21st century.

Re:a way to make money

[Zero__Kelvin]

"Oh, this just makes me laugh. Operating system the first Internet worm ran on? UNIX. It wasn't until the mid '90s that people started saying 'UNIX Security' without laughing."

Many may be unaware that Robert Tappan Morris is the son of Computer Security expert Robert "Bob" Morris, who served as chief scientist of the NSA's National Computer Security Center at the time, so he may have had a little bit more inside information than most when creating the RTM Internet Worm :-) Dya' think?

That being said, he exploited holes in the sendmail and fingerd applications , and trusting admins (i.e. the transitive trust enabled by people setting up rexec/rsh network logins without password requirements) UNIX was always secure. At no time did it compromise UNIX via holes in the UNIX OS. Sendmail is not UNIX any more than GNU is :-) It is not an OS at all, it is an application.

I don't care how secure an OS is, if I write an application that hands out root access willy-nilly, install it, and run it, my system will be compromised. Can I then blame the OS? Of course not; don't be silly. If I built the same sendmail code for OS X and Windoze could I suddenly claim that they are insecure, and mysteriously, all have the exact same flaw in their OS !!!! NOT.

Re:a way to make money

[Zero__Kelvin]

Nobody ever laughed at UNIX security. Theraven64 is a troll.

Re:a way to make money

[vux984]

Except there is significantly more software for all flavors of Windows that will not work correctly if the user doesn't have admin rights.

That will change as time goes on, now that windows has finally forced the issue. In point of fact, I currently run Vista, and don't have a single piece of software installed that requires admin priviledges that it shouldn't need.

I have open office, acrobat reader, itunes, firefox, thunderbird, visual studio, eclipse, photoshop, virtual pc, simply accounting, utorrent, notepad++, filezilla, pgadminiii, filemaker pro, citrix ica client, vnc, and a variety of games mostly new ones.

The only time *any* of it needs admin privs is when I have 'auto-update' turned on, and it needs to update itself.

The ONLY software I have that needs admin privs to run are some old games (half life) and yes, I've left that behind (and I wouldn't be surprised if the latest half-life retro-pack on steam has resolved that issue). But regardless that's software from the same era that Mac were PPC and ran OS9, and its not like THEY can run OS9/PPC games on their new intels osx macs either.

Except that that an admin password was needed first if the user was not running as an admin.

No. The first versions of the littlesnitch ran a process in user space that could be killed within the user account without an admin password.

Yes it is for any user not running under an admin account.

I provided a list of other ways for programs to get started in a normal user account. I'm am 100% certain that most of them work.

Moving or erasing that file eliminates all non-admin user accessible startup commands. Therefore simply trashing that file as well as the /users/username/library/preference/com.apple.loginitems.plist restores the user account to what it was when first created. Any malware created startup commands will be removed, thus effectively killing it.

If malware injects itself into a folder action, than trashing the login/startup items will have no effect whatsoever. All the malware does is wait until the folder action is triggered (probably something common like adding a file to the desktop), which then launches the malware, and adds itself to the startup items again.

If its anything like the nasty multi-vector PC malware, there will be a browser extension, a folder action, a start up item, and so on, and so on, and any of them will regenerate the rest.

Seriously, you are being naive. OS X is very much as vulnerable to this sort of crud as Windows is.

Re:a way to make money

[nmg196]

> Market share has nothing to do with how easy it is to break into a system.

Nobody is claiming it is. They're claiming that nobody will BOTHER to break into a system which has a very small market share.

> UNIX on the other hand was designed from day one to be networked multi-user OS

REALLY bad example! Viruses were *invented* on Unix!

Not suprised

[SchizoStatic]

Well what do they expect they start to get a larger market share they start to be the target of more blackhats.

Re:Not suprised

[Midnight Thunder]

Well what do they expect they start to get a larger market share they start to be the target of more blackhats.

True, but at this current point in time the only thing that this anti-viruses application will detect are MS-Windows viruses. On the other given that a Mac could become a carrier for a virus, being infected through connecting to various networks, this probably helps protect networks that the computer connects to.

On a side note, does anyone know if there is decent GUI for Clam AV?

Sophos

[gammygator]

I've been running Sophos on both my Macs for a year or so... Not so much because I felt I needed them... but because I come from the PC world and felt nekked without an AV program... and my work covers the license costs which made the decision a no brainer.

Interestingly enough... to date, they have only detected MS based viruses.

Re:Sophos

[gEvil (beta)]

Interestingly enough... to date, they have only detected MS based viruses.

When I ran a lab of Macs several years ago, we ran AV software on all the machines. It was mostly there to strip out the Word macro viruses that students would bring in from their home computers. I'm not aware of the software catching any viruses that could actually have done anything to the machines themselves.

Re:Sophos

[vertinox]

I use ClamX. In fact I ran it last night though I wonder if it only looks for windows specific viruses.

As precaution I usually look at what programs are set to automatically start up and the file sharing security.

From my understanding, the only Mac viruses are really just trojans which manually have to be run instead of just browsing to a webpage and then being hit with it.

Re:Sophos

[SaDan]

The only Trojan I've ever seen for Mac was in a Word document macro years ago. The payload was empty if you opened the file on a Windows system, but on a Mac system it would try to wipe the drive.

Re:Sophos

[TheRaven64]

I'd be interested in buying Mac Antivirus software if any of the AV products for the Mac could point to a single Mac virus that they could prevent, or a single Mac security flaw that they provided a work-around before Apple fixed. The second is a lot easier than the first, but I don't see it in any adverts. With 10.5, Apple introduced a nice syscall interception framework and with 10.6 I expect to see it used by default for a lot more things (it already prevented an mDNS vulnerability being exploitable on 10.5).

Re:Sophos

[powerlord]

I'd be interested in buying Mac Antivirus software if any of the AV products for the Mac could point to a single Mac virus that they could prevent, or a single Mac security flaw that they provided a work-around before Apple fixed. The second is a lot easier than the first, but I don't see it in any adverts. With 10.5, Apple introduced a nice syscall interception framework and with 10.6 I expect to see it used by default for a lot more things (it already prevented an mDNS vulnerability being exploitable on 10.5).

Neat! It's nice to see OSes become more robust and secure without bothering the user as much. [allow] [deny]

Re:Sophos

[Alomex]

FWIW I've been running AV software on my PC for over then years. This PC is is connected to the internet using a fixed IP address. It has found three viruses in that time, one in a USB key, another inside a shareware utility and the last one on an email message that was never oppened.

Let the flame wars begin

[m0s3m8n]

Yes Apples can get malware (general term) if you are a complete dumb ass. Until self-propagating zero-interaction attacks appear, leave me alone.

Re:Let the flame wars begin

[houghi]

Yes Apples can get malware (general term) if you are a complete dumb ass.

So for them it would be good to run such a program. Dumbasses exist regardless of the OS they use.

Re:Let the flame wars begin

[FiloEleven]

Well sure! These things don't write themselves, you know!

Re:Let the flame wars begin

[powerlord]

Pretty sure the GP was referring to zero-interaction attacks for OS X. As you mentioned, there have been quite a number of attacks, but they've almost exclusively targeted Windows or Windows related products (IE, IIS, MSSQL, etc.)

I don't need a virus to affect my system

[Shivetya]

I have Quicktime.

Does a Mac AV program really do anything?

[grapes911]

Don't those AV programs mostly scan for Windows viruses on the Mac so you don't pass around those viruses to Windows users?

Re:Does a Mac AV program really do anything?

[FictionPimp]

That is what I always thought, in fact looking at clamXav it appears to only scan for windows viruses.

Re:Does a Mac AV program really do anything?

[Golias]

Don't those AV programs mostly scan for Windows viruses on the Mac so you don't pass around those viruses to Windows users?

I remember about a decade ago MS Office implementation on the mac was good enough that Macro virus would run. Fortunately, the file structures were different enough that they wouldn't do much, but at the same time we could also point out how the Macs structure made trojans more effective, and we'ver alreaqdy seen how OS X's Unix underpinnings and x86 architecture make it vulnerable to stuf old MacOS & 68k macs shrugged off

(Psst. The Mac file system is still different from what either Unix or Windows uses. But shhh! I'm really enjoying reading all this concerned hand-wringing as I continue to run my Macs on-line 24/7 with no AV software installed.)

Re:Does a Mac AV program really do anything?

[kimvette]

It also detects apache worms. Back in the day SuSE shipped with a vulnerable Apache build and I had to clean a server. ClamAV made it simple to remove the worm, without my having to prune every directory by hand.

Re:Does a Mac AV program really do anything?

[FictionPimp]

I guess when I see slashdot warnings about massive OSX viruses sweeping the net I'll look at installing an antivirus suite.

Old document

[Anonymous Coward]

This story is just wrong. That document is several years old. Apple advises to install security software since years. They just added new names for recommended software products and therefore updated the issue date on the document.

Re:Old document

[Anonymous Coward]

so what you are saying is that i shouldn't have forwarded this article to every smug apple advocate that i know?

shit.

Re:Old document

[chaim79]

It doesn't matter, they will still laugh at you when you get your next windows virus. :)

NOTE: the above does not apply if you are running a Unix/Linux based OS.

Re:I'm sure there is a side deal with the AV comps

[BradleyUffner]

Hey, if our sales go up by 10% we'll float you a $50,000 hold back check.

So basically the cost of 2 new mac books?

[rim-shot] Thanks folks, im here all week.

Anyone know?

[gEvil (beta)]

I noticed the "Old Article: 4454" string on the page. Anybody have any idea what the old knowledge base article used to say? And what era it was from?

Re:Anyone know?

[Golias]

Noooo! Don't give up the game! This whole discussion is proving to be a terrific honey-pot for identifying anti-Mac platform bigots! And here you had to go and ruin it by pointing out that the "news" story isn't actual news.

Oh well. This is slashdot. There will be more.

A good sign for Apple

[elrous0]

Actually, in a way, this is a good sign for them. It means that they're getting enough market share for the virus and malware writers to actually give a shit.

Re:A good sign for Apple

[Yvanhoe]

Stop this myth. It has more to do with ease of attack than market shares. There used to be (I don't know the numbers these days) more than 50% of servers on various unix. Still close to no virus there (and, I believe, none active).

1% of the market share would still make a valuable bot-net. Even 10% of this 1%. It translates into cash money. If it were easy, some people would have done it.

Re:A good sign for Apple

[gad_zuki!]

>There used to be (I don't know the numbers these days) more than 50% of servers on various unix

Malicious users dont spread viruses on servers, they root them via known vulnerabilities or weak password. No one is sitting at a production servers downloading poker programs and opening attachments from strangers. These are completely different strategies for compromising a box. There's no shortage of rooted boxes out there.

The point is still valid. OSX has been targeted by malware developers recently, starting with that fake video player that is still making the rounds. Most likely the malware developers are seeing OSX as an untapped market. Apple knows this is a threat and is doing the sensible thing. Expect more of this malware.

Re:A good sign for Apple

[JasterBobaMereel]

The market share myth - is a myth

Most used Webserver - Apache
    But Webserver with the most Virus attacks was always IIS (It has improved due to the bad publicity) ...and Apache on Windows always had more flaws than Apache on other platforms, according to the writers of Apache due to the security flaws in Windows

If, as is generally thought, OSX has 1% of the market then it should have 1% of the Viruses, but it has only ever had a handful of viruses and all of these not found in the wild anymore? Since the vast majority of OSX systems do not run anti-virus they should be an obvious target.. and still there are few if any viruses ...

Malware however is another story and can (and does) affect all systems, but does not require antivirus, but does require the system to be properly configured and secured and may require anti-malware plugins for the browser ....?

Re:A good sign for Apple

[elrous0]

Very few virus writers target servers, Unix or otherwise, because they're generally not admined by some grandma in Albany who will open an exe file sent to her by a stranger with the subject heading "I love you."

Re:A good sign for Apple

[M-RES]

Is that a traditional English folk-dancing invertebrate?

Re:A good sign for Apple

[Yvanhoe]

My point exactly : some things are harder to attack than other. A server would be far more valuable if infected than a dozen of enduser PCs but it happens more rarely. Marketshare has nothing to do with anything.

M-Apple

[ionix5891]

http://www.dailymotion.com/video/x7kr6e_mapple-the-simpsons_fun

Re:M-Apple

[Mister Whirly]

Best....video...ever!

Re:Multiple antivirus products?

[Geoffrey.landis]

Not multiple antivirus products on the same machine!

Having multiple products deployed mean that the virus programmers have different applications to circumvent. But that's multiple products on different machines-- you wouldn't expect one user to run all of the anti virus products on one machine.

a necessity

[Anonymous Coward]

Well, duh... With the Apple CEO engaging in the unhygienic practice of peeing on all the hardware before it ships, no wonder users are being advised to get some sort of protection against pathogens.

Or was that the Mapple CEO... meh, they probably all do it.

Makes sense in heterogenous networks

[bomanbot]

Well, aside from the fact that this Apple support document is not exactly brimming with information, using an antivirus program on a Mac makes perfect sense in a mixed environment with other operating systems.

Although your Mac may be safe from the vast majority of malware stuff circulating right now, it can still spread them around and infect for example the other Windows machines on the network (those Microsoft Office macrovirus infections are a good example).

Also, with all the nice virtualisation programs available on the Mac and BootCamp, it makes sense as a Mac user to be more aware of potential malware problems , although then the antivirus solution should be inside that environment, I think. Also those antivirus programs open up a whole other can of worms, because those antivirus companies are splendid examples of honesty and efficient programming, as we all well know :)

Re:Makes sense in heterogenous networks

[Ed_1024]

I agree - it seems to be much more about being a considerate neighbour than covering vulnerabilities in the OS. What do the virus checkers available for OSX look for, anyway? I haven't heard of anything out in the wild (yet) for OSX that can auto propagate, so I'd expect all the definitions are for other OSs. On the XP side of my Mac, the anti-virus software seems to fulfil all the criteria for an actual virus, in terms of the effects on the system.

Overall, though, I think it's a good thing for Apple to recommend to get their users thinking about the possibilities as undoubtedly there _will_ be a successful viral attack on OSX, although we've been saying that for some considerable time now...

Re:Makes sense in heterogenous networks

[egotripper]

Teachers do get homework assignments handed in by email. As the files can contain malware for PCs and MS Office, you'd like to protect against handing all the annotated assignments back completely infected.

I had to remove an AV package TWICE because it went hog wild on an instructor's Mac by spawning 30 copies and taking up nearly 100% of the CPU. Mac AV packages need some work.

Re:Herd Immunity

[Anonymous Coward]

This doesn't apply. Macs are not an isolated community. They share data and documents freely with Windows systems, just as Linux systems do. The reason why there are fewer viruses for MacOS is similar to why there are fewer botnets that run on Linux servers.

Antivirus and antispyware protection is like putting buckets in the attic, instead of fixing the roof.

Re:Oh Shit

[Aphoxema]

You have strange ideas of trustworthy sources for 'facts'.

Admin user

[javacowboy]

Isn't the main problem with Windows security, and thus the spread of viruses on that platform, due to the fact that Windows users run as root by default? Since Mac users must enter their password anytime they or a program attempt to write to system directories, isn't the Mac platform largely safe from viruses?

I'm not bashing Microsoft. If Microsoft could find a way to force all third party software developers to make their programs run from non-admin users, I'm sure they would have made users non-admin by default by now.

Re:Admin user

[SuiteSisterMary]

Well, that's the issue. You've been able to write software for Windows that allows for non-admin since 1999. My Documents, no user files in Program Files, non-admin logins, the whole nine yards.

But, of course, developers are lazy. They don't want to write proper software.

Can Microsoft force it? Of course. They tried it with Vista and UAC; pop up a little 'fuck you' every time a program does something the Windows 95 paradigm. And they got raked over the coals for it.

Re:Admin user

[krunk7]

You are incorrect.

Re:Admin user

[ciderVisor]

I'm not bashing Microsoft. If Microsoft could find a way to force all third party software developers to make their programs run from non-admin users, I'm sure they would have made users non-admin by default by now.

That's what they tried with Vista. I've been running my XP box for the past two years without any AV software by making sure all users have Limited Accounts and the Admin account is only ever used for installing software or drivers. If a particular application still requires Admin privs, it simply doesn't get to run on my machine and I might even let the writers know, if I feel it's an important program.

Lots of good stuff about Limited User Accounts here - http://blogs.msdn.com/aaron_margosis/pages/TOC.aspx

Re:Admin user

[3dr]

This is totally false. An AC doesn't deserve the time for a more complete reponse than "admin" perms != "root".

Re:Admin user

[Archangel Michael]

They tried it with Vista and UAC; pop up a little 'fuck you' every time a program does something the Windows 95 paradigm. And they got raked over the coals for it.

AND rightly so. They should BREAK win85 paradigm and be DONE with it! And by "break" I mean "do not install this program, it isn't written right" kind of breaking.

Microsoft had and still has the ability to dictate to the market, and they should use that power to do things right.

Vista could have been lean mean awesome OS, if Microsoft took the approach that it was dropping everything that wasn't coded to WIN2K standards, and not the crap from before. They had 5 years to get applications re-written to work right.

The even could have created a virtual backwards compatibility mode where it ran such applications in a sandbox, away from the system internals.

But they didn't, they took a half assed approach trying to not piss on anyone, and in the process pissed on a whole bunch of people. And still have a broken model it is still trying to get away from.

Re:Admin user

[krakelohm]

Thanks for the insightful rebuttal, I can only imagine how bad javacowboy pissed his pants on that one.

Re:Admin user

[krunk7]

Well, he made a simple statement: "Mac users run as root. No password is needed to run 'as root'."

There's no need for some lengthy rebuttal. It's not an argument or a debate. It was a fact claim with only two options: a) mac users run as root and need no special action for superuser privileges and b) mac users do not have root privileges and must do something special for privilege escalation.

"You are incorrect." Is all that is required. The fact that his claim is incorrect requires that the converse is true.

What is amusing is that such a lengthy explanation would be needed to clarify what should be glaringly obvious.

Re:Herd Immunity

[CFTM]

To add to your statement, I also think they're protected by the fact that if you're taking the time to right a piece of malicious code you generally want it to have the greatest impact possible. Why cut out 80% of the market by finding something to exploit on the mac? Seems like a lot of work to get oneself in to a niche market.

Legal Protection

[mario_grgic]

This has more to do with the protection from law suit from clueless users who might get some virus or whatever installed and claim "what, you have not told me I need an anti-virus software".

But in all seriousness, I would never ever, ever install any kind of anti-virus crap on Windows, let alone non-Windows OS. Those things are more taxing and costly (as in CPU and disk arm cycles) than a virus :D. I have used Windows for decades and never had a virus, and I sure as hell won't be installing anti-virus software on my Macs now.

Re:Legal Protection

[drquoz]

How do you know you haven't gotten a virus if you don't have antivirus software? If you've used Windows for decades, I can pretty much guarantee you've gotten one at some point. I can't recall getting one myself in probably three or four years, but to say I've never gotten one would be an overly pretentious lie.

Re:Legal Protection

[ciderVisor]

How do you know you haven't gotten a virus if you don't have antivirus software?

When I was experimenting with Limited User Accounts on XP, I kept anti-virus and anti-spyware products on my machine and scanned on an occasional basis. The AV program (AVG Free) found nothing after months of use (and didn't detect any live threats whilst browsing). The Anti-Spyware programs would alert me to things like tracking cookies (woooooh, scary !) and Most Recently Used document lists for various apps. I even kept a third-party firewall (Zone Alarm) going to trap anything that tried to 'phone home' without my authorisation. Zip. Nada.

Find out the benefits of LUA's here:

http://blogs.msdn.com/aaron_margosis/pages/TOC.aspx

The weakest security link in any current OS is the user. Having a list of signatures for possible trojans, keyloggers, etc. is a good way to flag up potential problems to non-techie users before they click on something dangerous. In that sense, an AV scanner might be worthwhile for Macs.

Re:Legal Protection

[mario_grgic]

Because I know windows inside and out (I'm a software developer) and because I had million little command line utilities to monitor my system (from UNIX korn shell and utilities) to sys internals utils etc.

Before I would install anything, I would research the reviews. Then I would install it on virtual machine and monitor what it does to the system, then when satisfied I would install it on my "production" machine. I would never install anything that was not necessary. I would know exactly what each program does, which registry keys it modifies, what files it accesses, what ports it opens, which ones it listens on, if it connects online, where it goes and what does it send etc.

This is really tiresome though, and it requires enormous knowledge to run your system smoothly, but I do have a single windows XP installation that I installed in 2002 and that is still running fine without re-install (quite a feat in windows world).

Not using Internet Explorer, and good hardware firewall are also essential.

Re:Legal Protection

[LtGordon]

The weakest security link in any current OS is the user.

Absolutely. I've had my current installation of XP Pro running for about 18 months with AVG Free and have never gotten anything worse than tracking cookies. Alternatively, I've got family members that need to run a complete System Restore to OEM every few months because they can't help but download the most ridiculous stuff they can find. Ultimately, there are only two ways you can minimize this risk: you can educate the end users, or you can design the OS to babysit them.

alert("You are attempting to insert Clippy into Electrical Socket. Cancel or Allow?")

question...

[apodyopsis]

Because of the better inherent security in the operating system model is true that mac/linux is probably safer from direct attacks on the OS but is just as prone to browser attacks and social engineering attacks?

I mean, when root privilege is required to affect the core system this should inherently be safer then Win32 where everybody is an administrator.

Disclaimer: Feel free to flame me to a crisp on my lack of knowledge, but I'll make it clear that I am not an expert in computer security and I am interested in a genuine answer about how vulnerable Linux is compared to Windows.

From what I can tell of the article Win32 is hit hard because it is the softer more numerous target, but as Linux takes hold it will become a more attractive target. But because everybody has the source code presumably this means more eyes scanning for errors and potential security risks fixed faster?

Re:question...

[powerlord]

Something to bare in mind, that a lot of the security in a Unix system means that if you flub something and get hit with a Trojan or malware as a general user, your personal information might be at risk or infection/deletion, but the system is more likely to remain stable/secure.

The problem with this thought though is that the vast majority of unix systems are single user, where the users personal data is more valuable than the system stability/security.

Not saying unix isn't inherently more secure than windows, just that sometimes people overlook the tradeoffs in its security.

"Apple Quietly"??

[jhalstead]

What is up with all of the "Apple Quietly" articles? Search for the phrase in google, you'll see what I mean.

Re:"Apple Quietly"??

[Bearpaw]

Any information release by Apple that doesn't occur during a Special Event seems to be suspect.

("In other news, Steve Jobs quietly blows his nose. Will this fuel more concerns about his health?")

If you listen carefully...

[scubamage]

...you can hear the heads of a million fanboys going poof!

Re:If you listen carefully...

[ettlz]

That's the great disturbance in the reality-distortion field. I bet the Organas were Mac users, too.

Re:Bullshit.....

[Mascot]

I did. They do. I'm clearly missing your pun. Mind clarifying it for me?

Re:Bullshit.....

[danhuby]

Did you click the link in the article?

http://support.apple.com/kb/HT2550

Re:Herd Immunity

[AvitarX]

I assume the roof in that metaphor is the user?

Because running a Trojan is something people do, downloading and installing malware usually is too.

The "this file came from the internet" warning could help, and the "enter your password" warning may also, but in the end, if someone wants to do it, you need AV software to stop them.

My campus requires it

[tecker]

The college I attend actually requires all mac users to install Symantic Corporate to be allowd on the network. Their justification is that this will prevent WINDOWS virus from passing through macs and then hitting the Windows boxes as the mac users send them on. We have a good security team and I can understand why they would want to do this.

As macs are being used in Enterprise environments they can harbor virus infected files silently before going back into the network. One computer that missed new definitions can be taken down when that file gets passed to it. Its up to you but if you are in Enterprise situations you better comply.

As for multiple AV systems, that is retarded. They will fight for resources and cause performance to be brought down. Just pick one and run with it. If you want.

Re:My campus requires it

[SydShamino]

As for multiple AV systems, that is retarded. They will fight for resources and cause performance to be brought down. Just pick one and run with it. If you want.

No, they don't mean all on the same computer at the same time. They mean in general there should be multiple anti-virus programs, not just one, so that the affected base is smaller if an exploit is found in one of them.

And no, I don't plan to rush home and install one on my new MacBook Pro. =p

Re:Herd Immunity

[maztuhblastah]

The only reason macs have been able to get away with claiming such great security records (statistically) is herd immunity.

Indeed. Just look at Linux. It had a great security record up until the start of this decade. Then, once it gained a lot of popularity on servers, we started to see millions of infected Linux servers, linked together in botn...

Oh. Well damn. It seems that despite being the near ideal target for virus-writers (always on, very fast links, powerful hardware), the most popular server platform on earth doesn't have a major virus problem. Huh. Maybe an OSs security record isn't directly linked to its popularity...

Um huh? Apple has always recommended protection

[falcon5768]

Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.

Re:Um huh? Apple has always recommended protection

[Golias]

Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.

Very true.

And I've been ignoring the recommendation for years now. Guess which AV app I'm going to install today.

That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

Re:Um huh? Apple has always recommended protection

[Prien715]

They have been saying to use protection for YEARS now.

And yet, AIDs is still an epidemic.

Re:Um huh? Apple has always recommended protection

[Jeppe Salvesen]

That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

With the Apple market share increasing, we're becoming a target. The bad guys don't want to wreak havoc - they want to profit. We're becoming an attractive target. The bad guys want to turn our pretty, easy-to-use Macs into pretty, easy-to-use spambots and/or phishing hosts and/or

If they could somehow bundle their malware with commonly used software for OSX that requires us to enter a password, then that'd be an attack vector. Or maybe subvert the mechanisms that require us to enter a password before installing system software? Or how about using two holes in combination - first attack some library, and then have the uploaded software install itself using a second hole.. Remember those security updates we're receiving? Before we installed them, we were vulnerable to some exploit. Luckily, Apple is mostly ahead of the bad guys though. But if they slip up?

And you know, I doubt is necessary to have the malware run as root to steal your identity or simply spam the internet..

Re:Um huh? Apple has always recommended protection

[Golias]

Yes, and a tornado could pull my car out of the garage and send it spiraling into the air, but I still have no intention of lashing it to the rafters. To do so would be 1) A pain to bother with, and 2) Probably unhelpful if it was ever needed anyway.

My metaphor stands.

Re:Um huh? Apple has always recommended protection

[Jeppe Salvesen]

Indeed your metaphor stands. But remember, the climate is changing. The likelihood of car-sucking tornadoes it on the rise.

Re:Um huh? Apple has always recommended protection

[M-RES]

For some reason, when I was quickly skimming through the comments I read yours as "The likelihood of car-sucking tomatoes is on the rise"... DOH! :D

Re:Um huh? Apple has always recommended protection

[Golias]

Indeed your metaphor stands. But remember, the climate is changing. The likelihood of car-sucking tornadoes it on the rise.

And yet, I brashly leave my car untethered.

Madness, I know, but I like to live on the edge.

Re:Um huh? Apple has always recommended protection

[Free the Cowards]

Anti-virus software only works against known threats. As far as I know, there is no software intelligent enough to detect that a piece of unknown software is a threat.

Therefore it doesn't matter if the climate is changing. Until a threatening piece of software is actually released into the wild (and antivirus vendors start protecting against it) there is absolutely no point to installing anti-virus software on a Mac.

Re:Um huh? Apple has always recommended protection

[jeffasselin]

Correct. They've always had a similar article, listing antivirus solutions. This is just an updated version with current products.

Re:Um huh? Apple has always recommended protection

[poetmatt]

Marketshare has been an excuse for a long time. It's not the real reason they pick a specific OS. I'm sure when people start to actually dig deeper they'll see that it's more about where the vulnerabilities are laid out and how quickly they get fixed.

It's not that MS is popular. It's that you can probably take a 3 year old vulnerability and still exploit to today. If Mac had a crapload of vulnerabilities of that style, it would be a bigger target for virus writers.

Re:Um huh? Apple has always recommended protection

[jeffasselin]

And yet, AV vendors still can't deliver preventive systems that actually work, and still sell you what is essentially snake oil.

AV products to go on with the thread's analogy is like tying your car down with a bungee rope. You'll probably find the car after the tornado is past, but it will probably be already blown to bits anyway.

Re:Um huh? Apple has always recommended protection

[blazin-asian]

who needs antivirus when you have an AR-15 with a chainsaw!

Re:Um huh? Apple has always recommended protection

[Uberbah]

There are easy counter-arguments to the old marketshare chestnut. Apache vs IIS - the latter (since improved) had far more exploits than Apache, despite the former having much greater marketshare. The trophy factor - you write the latest Code Red and it shuts down a million Windows machines - whoop de do, it's been done before. But imagine the bragging rights if you wrote the first virus to take down a million Macs instead.

And for the malware snooping for credit information, a large chunk of PC's are set up in education, government offices, or in businesses, where they are unlikely to have personal information. Whereas a higher percentage of Macs are going to be personal computers, with owners who probably have more disposable income since Apple doesn't make $400 POS specials like Dell or HP.

But in any case, it's not marketshare that made Windows the object of attacks, it was Microsoft's sloppy coding. If Apple integrated the browser into the operating system, made Active X, and had services and ports open all over the place, they'd have had problems too.

Re:Um huh? Apple has always recommended protection

[sdpuppy]

Ah, a car analog on /. I'll bite.

That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

I don't think that is what you mean. If you tie your car down with a rope, a car thief can still get in do his stuff and drive away breaking the rope.

Now if you protest that the rope is very strong and you tie very good knots, well the thief has a knife (watch it - metal rope? - thats a cable - anyhow thief also has a hacksaw)

What you want to say is that its like parking your car in the garage always next to the unlocked BMW (who has its hood open and a nasty sounding alarm system) and your car has all doors locked with a steering wheel lock, ignition auto cutoff, hood keyed lock, tire boot.....

and running an AV program is like adding a nasty sounding alarm system to your car

But then to get out of the car, if you get an email from an infected PC person, you don;t want to accidently forward it to some other poor PC person.

Re:Um huh? Apple has always recommended protection

[dkf]

Indeed your metaphor stands. But remember, the climate is changing. The likelihood of car-sucking tornadoes it on the rise.

The metaphor stands even more strongly. Lashing the vehicle to the rafters wouldn't help with a car-sucking tornado since that'll take the rafters too. Similarly, AV on end systems is not helpful because it is trying to fix things up after it is rather too late; making sure that systems are Very Hard Targets (strongly locked down services, email filtering at the corporate/ISP level, that sort of thing) is far more effective.

Re:Um huh? Apple has always recommended protection

[Golias]

Ah, a car analog on /. I'll bite.

That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

I don't think that is what you mean. If you tie your car down with a rope, a car thief can still get in do his stuff and drive away breaking the rope.

No, that's pretty much what I mean. AV on the Mac is currently both redundant and ineffective.

Lawyers?

[javacowboy]

Somebody on AppleInsider brought up this very interesting point:

http://forums.appleinsider.com/showpost.php?p=1344735&postcount=13

I agree.

There are no shortages of bottom feeding trial lawyers looking for a meal at Apple's treasury.

Think of the liability, if Apple wasn't cautioning users about security and the steps they should consider, when someone finally cracks OSX, and OSX malware finally breaks into the wild.

This is just smart business.

Apple and "security theatre".

[argent]

I am increasingly annoyed by Apple's following Microsoft in "Security Theatre" techniques like the Leopard "OMG you downloaded that file from TEH INTERWEBS!" dialogs, but this is going too far.

Antivirus software does not make any difference to the virus writing process. It can only detect and block existing exploits. Until there ARE active exploits in the wild all it can do is cause time and data loss through false positives.

Re:Apple and "security theatre".

[ohcrapitssteve]

"Security Theatre" techniques like the Leopard "OMG you downloaded that file from TEH INTERWEBS!" dialogs

I'm actually a big fan of this particular approach. I feel as though the real way to solve the malware problem as it exists today on all platforms is user education in best practices. Vista's UAC nag screen (because that's all it is) is useless. You are presented with a dialog that looks the same every time. The Leopard one you describe actually tells you "you've never run this before, it came from blahblah.com website," and most importantly, I think, "click this button right here to visit the website you got this program from and see for yourself "

I think on the whole, you end up with fewer yet more meaningful dialog messages in the Leopard user experience, usually leading to the user actually reading and heeding them.

Re:Apple and "security theatre".

[Oooskar]

The reason for the dialog you get when launching a downloaded application for the first time is to counter an otherwise existing flaw where an application could be disguised a document.

The key part of the dialog message is not that the file was downloaded from "the Internet", but rather the fact that the file is "an application".

Re:Apple and "security theatre".

[argent]

The reason for the dialog you get when launching a downloaded application for the first time is to counter an otherwise existing flaw where an application could be disguised a document.

So fix the bloody flaw. STOP HIDING FILE EXTENSIONS.

Adding a warning before doing something that is almost always the correct thing just trains people to approve dialogs where it's usually the wrong thing.

Warning dialogs should ONLY be brought up before *rare* and *irreversible* actions. Not common ones.

Re:Apple and "security theatre".

[argent]

The Mac bugs you exactly once. If you really hate it, you can add a folder action to your downloads folder to fix it.

Depending on the file, it may bug you more than once... I've had it hit me three times for an application in a disk image in a zip file.

And using the folder action means that Finder wakes up and steals focus.

And, finally, the problem isn't what I'm doing, it's all the people Apple is training to reflexively approve security dialogs because they see so many of them and they're almost always wrong. I've watched the rot on Windows for a decade, as a system administrator, and that's EXACTLY what it does.

Re:Apple and "security theatre".

[argent]

Oh, Apple is not as bad as Windows yet, by an order of magnitude. But they were already too far down the slippery slope when they tried to avoid fixing the 'Open "Safe" Files' hole by adding a dialog instead of turning off 'Open "Safe" files' by default, and Leopard just put them on ice skates.

At least they can learn. They did make 'Open "Safe" files' off by default, eventually... maybe they'll figure out that this is ALSO a stupid idea.

But not when so many people think anyone criticizing a decision by Apple must be a Microsoft shill, instead of thinking about the real problem.

Re:Apple and "security theatre".

[Oooskar]

So fix the bloody flaw. STOP HIDING FILE EXTENSIONS.

I'm not saying that I disagree, but in that case they would also have to stop supporting running unix executable files from within Finder or disable custom icons for such files.

Warning dialogs should ONLY be brought up before *rare* and *irreversible* actions. Not common ones.

Depending on point of view, launching a downloaded application for the first time could be considered rare and could definitely result in something irreversible.

Re:Apple and "security theatre".

[argent]

in that case they would also have to stop supporting running unix executable files from within Finder

I would accept that. They don't (or didn't used to) support running shell scripts from Finder... I had to add a handler for ".sh" to run some scripts I'd created from Finder. That comes back to "instead of asking if you should do some stupid thing, make it not stupid".

Depending on point of view, launching a downloaded application for the first time could be considered rare and could definitely result in something irreversible.

If they only did it for downloaded UNIX executable files, I might agree, but they do it for EVERYTHING. Multiple times, sometimes. That is NOT a rare action, nor a rare dialog. It's training people to answer "Yes" when a program asks "I'd like to install a botnet node on your computer, is that OK?".

Re:Apple and "security theatre".

[reallocate]

...it's all the people Apple is training to reflexively approve security dialogs ....

I suspect that the difference in the number downloads on machines used by folks here and the typical Mac user is at least an order of magnitude.

It's not like most people are going to be seeing this warning on a daily basis.

Re:Apple and "security theatre".

[reallocate]

STOP HIDING FILE EXTENSIONS.

File extensions have nothing to do with the contents of a file, as I suspect you know.

Re:Apple and "security theatre".

[argent]

File extensions have nothing to do with the contents of a file,

Since according to the human interface guidelines applications should not modify or set Finder Info for other applications, unless the browser is violating the HIG the only thing that LaunchServices has to go on for a freshly downloaded file is the extension.

Unless you have "Open 'Safe' Files After Downloading" set, and the file is an archive type that is set as being "safe", Downloading a file should not set Finder info, or the execute bit, the icon, or anything else that could lead a user to misinterpreting the file type other than a double extension.

"Open 'Safe' files after downloading" is now off by default.

Unless you explicitly turn that on or you have upgraded Safari from a version that had that flag enabled, there should be no way for any of the attacks described to be made via downloading a file and opening it in Finder. If you have this flag enabled, then I can see adding a warning (but include a note that you can get rid of it by removing that unsafe option).

If there are, if Apple has left a backdoor that allows files to be unpacked automatically after downloading, then that is the security flaw that needs to be fixed, instead of making a dialog come up for every downloaded file you open.

Re:Apple and "security theatre".

[argent]

It's not like most people are going to be seeing this warning on a daily basis.

My experience supporting a large range of users as a network and system administrator indicates that people perform operations that lead to these kinds of dialogs... even ones who have NO business-related reason to be downloading ANYTHING... far more often than you would suspect. Certainly far more than *I* would suspect if I didn't have to clean up after them.

Boasting?

[cunamara]

"After years of boasting about the Mac's near invincibility..." I've been a Mac user for over 22 years. While I have heard many of my fellow Mac users boast about the lack of viruses and other malware for Macs- mainly out of ignorance or just to taunt Windows users- there have been Mac viruses in the past (e.g., nVIR) and there will be Mac viruses in the future. I've always been concerned that complacency regarding Mac malware would eventually result in heinousness once some bad actor sunk their teeth into it.

The result of these years of complacency is that there are no good Mac antivirus applications. There are some passable ones and there are some awful ones. One of the better ones is ClamXAV but it is only as good as its virus definitions.

Re:Boasting?

[Golias]

Kinda tough to build a good table of virus definitions when there are none out in the wild for you to define.

Re:Boasting?

[cunamara]

You got it.

Get a grip

[actionbastard]

This is not news. Apple has always recommended that users of its products run anti-virus software. The reason that this got 'amped-up' was because Brian Krebs at the Washington Post 'noticed' the Apple Support document while trolling around their site enjoying the new, harder to use, design layout. What he failed to notice -and mention in his blog- was the article was modified from an earlier one that said basically the same thing. It's prudent for Apple to have been saying this all along so as to avoid any liability. To use the old /. saying, "Nothing to see here; move along."

Re:Get a grip

[shawnce]

Apple even inked a deal back in early iTools and later .Mac days so that folks with such accounts could get a free copy of a 3rd party virus scanner (cannot recall which product it was). You basically could pull a copy down from your iDisk.

Of course that virus scanner dictionary contained a handful of Mac OS X specific malware (mostly trojans), tens of Mac OS (9 or earlier) era items, and the other 99.9% Windows items.

Re:Herd Immunity

[YouWantFriesWithThat]

i agree with what you are saying, but i think you mean 94%. because as far as i can tell apple market share is hovering around 6%. that is based on actual units sold, not a page view metric. every % that i have seen that is higher is not based on real numbers but an extrapolation of site visits.

if anyone has firm numbers reflecting a different market share, i would be interested to see it.

Re:Herd Immunity

[TheMeuge]

"Herd Immunity"

You keep using that expression. I don't think it means what you think it means.

Also,

[nitsnipe]

as a young geek, the internet has taught me that security through obscurity is pointless.

It's in the Details

[jDeepbeep]

If you follow the apple store link in TFA, it's interesting to note the description for the first product (Intego VirusBarrier X5) says this:

Now that you've installed Windows on your Intel-based Mac, you're vulnerable to a whole new range of security threats: Viruses, spyware, adware, and hackers are all waiting to compromise your Windows setup. No matter if you're running Windows in Boot Camp, Parallels Desktop, or VMWare's Fusion, it requires Windows-specific protection. VirusBarrier Dual Protection is the answer. It provides security for both Mac OS X and Windows, ensuring that you'll have total protection for both operating systems.

Re:its about the dominant os

[Tony Hoyle]

As others have stated that's a total myth and is simply not true.

Apple has about 10% right now, so by your theory 10% of viruses should be for OSX. Number of viruses in the wild? Zero.

Re:Oh Shit

[TheP4st]

Doh! I completely misread the post as "take the time to code a antivirus for their system?"
But if Mcafee and Symantec perform on Macs as they do on Windows I reckon that I weren't completely off target.

Re:Herd Immunity

[UnknowingFool]

The only reason macs have been able to get away with claiming such great security records (statistically) is herd immunity.

I think that's a bit of faulty reasoning. For though Macs are a small percentage of the computers, they still represent millions of consumers. If that reasoning was correct, since Macs and Linux represent X% of users, they should be getting X% of viruses. By their nature they don't get viruses mainly due to the nature of their OS that programs can't autorun without permission. As demographics go, they also represent more affluent consumers. So more likely Macs will be the targets of malware as opposed to viruses.

Not a technology problem

[SCHecklerX]

Viruses and trojans (as opposed to worms) are a user stupidity issue. You can't fix that with technology. For a computer to be useful, it needs to run programs that the user launches. Trying to put something in the way to analyze whether what that user wanted to do is not what the user wanted to do is never going to be successful.

of course, things like MSIE make things bad, as the user has no control over what is going on with the software they run. But that is a problem with a single piece of software that is used as a propagation tool. Surely, the problem should be solved THERE. Same goes for office software with built in interpreters.

Even a not-so-savvy user can avoid infections without running AV (which, IMHO is an infection of its own), simply by using software that does not have the vectors in the first place.

Re:Not a technology problem

[powerlord]

Viruses and trojans (as opposed to worms) are a user stupidity issue. You can't fix that with technology. For a computer to be useful, it needs to run programs that the user launches. Trying to put something in the way to analyze whether what that user wanted to do is not what the user wanted to do is never going to be successful.

Yeah ... try telling that to all the C?Os that clicked on the "NUDE_CELEB.EXE" link in their email.

If you are an intelligent user you shouldn't need anti-virus software to protect you from Trojans. If you are a less clue-full user, then a program that checks the program you are about to run against a list of "known Trojans" might be EXTREMELY helpful.

A way to make news.

[Ostracus]

Agreed, however this is still news because the platform is under such control by Apple. They could quietly and easily put not only hardware and software in place. But implement more effective procedures in their software process to make security tighter. And we wouldn't be the wiser.

Re:A way to make news.

[mrinvader]

Since it IS under such an Iron Curtain by the Turtlenecked-One, they could also just as easily just paint on some secure looking interfaces and in reality only have lukewarm porridge behind the scenes..

They could implement more effective procedures, but skilled programming requires either programmers whose input is revered and who are justly compensated, or it requires an open development model based on a meritocracy and peer review where people won't get shot at for finding, documenting, and responsibly disclosing flaws.

I had a boss who always said, "Don't just come to me with a problem, come to me with a 'how things are' and a 'what to do about it'."

Re:Herd Immunity

[deraj123]

I could be wrong on this, but it seems to me that as a virus writer it would be much more lucrative to target desktops of average home users (who seldom have a clue what they're doing) than to target servers run by admins who supposedly know what they're doing and are paid significant sums of money (and thus spending a significant amount of time) for the sole purpose of keeping these systems running properly.

Re:Multiple antivirus products?

[somersault]

you wouldn't expect one user to run all of the anti virus products on one machine.

It seems you've never had to do IT support for any rich old clueless porn addicts. Lucky you.

Re:Herd Immunity

[phillymjs]

if you're taking the time to right a piece of malicious code you generally want it to have the greatest impact possible

Yes, and being the first person to come up with a true Mac OS X self-replicating malware wouldn't have any impact at all, would it?

Please just stop with the stupid 'market share' argument. Not everyone who writes malware wants to run a Windows botnet for fun and profit. There are also a lot of people out there who would looooooooove the notoriety that would be attached to being the first guy to do it on Mac OS X. They've been working at it for nearly eight years and haven't succeeded yet. And Apple is working hard to ensure they don't succeed.

~Philly

Re:Herd Immunity

[TheRaven64]

Yup, no Linux viruses in the wild. I take it you missed the articles that periodically appear about Windows worms being spread via compromised Linux servers starting around 2001?

Re:its about the dominant os

[wiedzmin]

Where did you get that statistic, Apple website? Or are you just simply confused about the defenition of "the wild"?

http://www.symantec.com/security_response/writeup.jsp?docid=2006-063013-2645-99
http://www.symantec.com/security_response/writeup.jsp?docid=2001-060806-1018-99
http://www.symantec.com/security_response/writeup.jsp?docid=2006-060110-4631-99
http://www.symantec.com/security_response/writeup.jsp?docid=2006-021715-3051-99
http://www.symantec.com/security_response/writeup.jsp?docid=2006-031413-1704-99
http://www.symantec.com/security_response/writeup.jsp?docid=2008-062513-3120-99
http://www.symantec.com/security_response/writeup.jsp?docid=2008-111315-1230-99
http://www.symantec.com/security_response/writeup.jsp?docid=2006-021614-4006-99
http://www.symantec.com/security_response/writeup.jsp?docid=2006-110217-1331-99
http://www.symantec.com/security_response/writeup.jsp?docid=2007-110101-2320-99
http://www.symantec.com/security_response/writeup.jsp?docid=2008-062404-1222-99

OsX really that secure ?

[DaemonKnightVS]

http://blogs.technet.com/security/archive/2008/05/15/q1-2008-client-os-vulnerability-scorecard.aspx Really don't know how 'truthful' this article is, but it appears to show OS X as really quite vulnerable.

Standard suite of software

[AnalPerfume]

The market share is (as plenty others have already mentioned) is a myth. Both Apple and *nix have enough units connected to the internet to be a valuable target. Of course the easy pickings are Windows PC's due to multiple reasons (also mentioned many times by others).

Apple & *nix tout their invulnerability to malware but Apple has one flaw here that Unix / Linux does not....a standard suite of apps the malware writer KNOWS is installed, and knowing Apple's Stalinist view to giving the consumer choice, they KNOW Apple have all but blocked any competing app from their platform.

Writing malware apps for Linux / Unix is much harder due to the variety of apps installed on any given system. Do you write for KDE? That leaves about 60% of Linux / Unix PC's unaffected. Do you write for Thunderbird? Not everyone uses (or has installed) Thunderbird. Linux / Unix come in all flavors with widely different choices of applications both installed by default, and in the repos. An attack which exploits a flaw in Thunderbird on Ubuntu may not affect Thunderbird on Fedora because of the way that either distro modifies a library.

Windows has long had the same problem in that the same suite of apps like Internet Explorer, Windows Explorer, Windows Messenger, Outlook Express are installed on EVERY Windows PC with no way to remove them, even if the user uses a different application for the purpose.

If a malware writer exploits iTunes they know it will affect EVERY Mac. They also know Apple have an image to protect and will know through watching Apple's corporate actions that they have no problem sticking their heads in the sand pretending nothing is wrong until they get a fix for the problem.....which gives the malware writers a window to exploit Apple users, to make it worthwhile writing the malware in the first place.

By comparison any exploit found to Linux / Unix will be out in the open and developers will be discussing then fixing it in no time, so the window is much, much shorter.....in addition to being a lot less certain how many users could be infected.

Just because your PC (with any OS) is vulnerable to an exploit until it's patched, does not mean you're going to be exploited. You may never visit a site which has the drive by malware ready to hit you in that time window, or receive that spam email with the JavaScript instruction hidden inside.

It does also help that for the most part people who use non-Windows OS's tend to have made the conscious choice to avoid Windows, which means they are a little more tech savy, many of whom will have other protective measures in place, like plain text emails and some level of control over scripted actions from websites.....oh yeah, and not running by default as an administrator helps a LOT.

Re:Standard suite of software

[yankeessuck]

... and knowing Apple's Stalinist view to giving the consumer choice, they KNOW Apple have all but blocked any competing app from their platform.

I gotta call you out on that. Valid argument for the iPhone app store but I can't think of any such restrictions on the Mac.

Re:Standard suite of software

[Geoffrey.landis]

The market share is (as plenty others have already mentioned) is a myth. Both Apple and *nix have enough units connected to the internet to be a valuable target.

Google "percolation theory".

Basically, in order to replicate, every newly-infected machine has to infect at least one other machine, or the virus dies out.

If the OS of a randomly-chosen machine is, say, 95% likely to be Windows. and 5% likely to be Mac, then it is e to the (20N) times easier for a virus to survive in the Windows environment than the mac environment (where "N" is the product of the number of times each virus tries to replicate, times the probability of success).

Re:Standard suite of software

[AnalPerfume]

Admittedly they are more open on the Mac, they are more subtle there. If you own an iPod and a Mac can you use any other media player to sync them? If another one does sync fine, how long before Apple release an update which "mysteriously" cause the competition to fail? The result is that it's easier just to go with the flow and use Apple's own stuff.

The lack of choice is more to do with the fact that if you don't like iTunes, do you need to use have it installed and use it to sync your iPod?

When I wrote that comment I was kinda rushed, it did sound a bit strong on some parts because I didn't explain it right; my bad.

Re:Standard suite of software

[M-RES]

No I think it's a fair point. They even took on one of their biggest third party app supporters (Adobe) by writing Final Cut Pro and undermining the install base for Premiere and After Effects. There are other instances - not forgetting the Konfabulator/Dashboard debacle of course. They do have a record of doing this so I think the OP makes a good case for an issue of concern.

There is of course no guarantee that you'll USE iTunes/Mail/Safari and may choose another app if one exists, and the difference between OS X and Windows is that you CAN remove Apple's default apps quite easily and not be affected by any exploits for those particular apps, but most users are generally lazy and too scared to go installing their own apps if there are pre-installed apps which do what they want - fact! And that's the biggest security hole of all - the luser.

I AM a MacEvangelist btw, just not a fanboy - I'm oldskool, not one of these newbie types. So I can admit where there are problems, and look for solutions rather than blindly going 'lalala, can't infect me'. heh ;)

Re:Herd Immunity

[somersault]

Yes. That must be the only reason. Windows is obviously just as secure as OSX and other Unix based OSes. *rolls eyes*

With the amount of people that hate Mac fanboys you'd think that virus writers would be well on their way by now if there were any real remote exploits they could make use of. I'm not saying it's impossible to write a virus for Macs or Linux - the authors of any software are only human after all. But the whole design ethos is just much better than that of Windows. If I were a virus writer I would try to write a virus for Macs/Linux just for the challenge and the geek cred.

Legalese is funny

[wxyze]

From Apple's support page:

"Apple encourages the widespread use of multiple antivirus utilities..."

and further down:

"Information about products not manufactured by Apple is provided for information purposes only and does not constitute Apples recommendation or endorsement."

In an unrelated story

[RemoWilliams84]

Slashdot announces that thousands of low uid's have become available as many long time slashdotters heads mysteriously explode.

Big Performance Hit

[MazzThePianoman]

Anti-Virus software sadly is sometimes a huge performance hit, especially to the hard drive and especially coming from Norton of McAfee. Anybody have any suggestions on a Nod32 equivalent for Mac? We need something with good real time protection, highly efficient and not bloatware.

Re:Quietly?

[eniacfoa]

they never should have touted "practically zero virus's" as a mac feature...especially when they were gaining market share. But they will never really take a massive slice of PC market the way they run things. Closed x86 HW is stupid. There was a reason for apple HW when they were PPC, but not now... All I want from apple is to be able to run macOS on my intel box...why are they sooo scared of upsetting MS? they dont sell many desktops anyway and they would still sell lots of funky looking apple laptops IMHO...I want competition. Linux cannot provide it. Apple never really tried. Why wont they take MS head on? Imagine in this anti-vista climate they release macOS for ALL PC's...MS might be forced to really make a better OS...this is what competition does...

But, but...

[vvaduva]

...it's so sterile!

security was bolted on to UNIX too

[Anonymous Coward]

In the apt words of Dennis Ritchie, "One of the comforting things about old memories is their tendency to take on a rosy glow."

According to one of the guys who was there on day zero, UNIX was *not* designed from day one to be a networked multi-user OS and security and separation of concerns were *not* there from the beginning.

http://cm.bell-labs.com/who/dmr/hist.html/ In the latter half of 1971 (nearly two years after UNIX's "day one"), "with no memory protection ... every test of a new program required care and boldness, because it could easily crash the system". Sounds like somebody describing Windows a decade ago, doesn't it?

Please stop parroting the fallacy that the reason UNIX is more secure is because it has always been secure. Security, networking ... these were later additions to UNIX too, the real difference is that the additions were better architected.

Only to brainless idiots

[C_Kode]

Reader wild_berry points out the BBC's story on the unexpected recommendation.

Only to brainless idiots that actually believed the hyperbole feed to them by Apple would it actually be an unexpected recommendation. The "we are secure and Windows is not" garbage was just a marketing ploy. Anyone with a brain would have known that any Networked Operating System has some level of vulnerability and is likely to be exposed at some point.

Re:Only to brainless idiots

[geekoid]

Prove it.

Re:Only to brainless idiots

[toadlife]

Sure thing....

* The vast majority of malware is written for financial gain
* The vast majority of malware are propagated via social engineering.
* Apple computers are operated by people.
* People who own computers have money.

It all comes down to market share.

Anyone who thinks otherwise has their head up their ass.

Re:Herd Immunity

[windsurfer619]

I have to say that many admins also do not have a clue what they're doing.

ClamAV is included with Mac OS X Server

[Gary W. Longsine]

ClamAV is included with Mac OS X Server, but not the desktop Mac OS X.

Also, it doesn't appear that Apple is recommending that a user stack more than one AntiVirus package on a given system, rather, they are refraining from picking a single package so that the market is heterogeneous. This affords better protection to the herd as a whole. I agree the technical bulletin is a bit ambiguous on this point.

Re:Herd Immunity

[noob749]

im not sure i agree fully.

although linux is widely used in the server world, there is no dominant linux distro. each distro (even the big three: redhat, suse and debian) is a combination of varying security tools (firewalls, ssh, etc) and kernel configurations - each of which could be at any version. if it's too hard for software companies to port their software over to linux because of the inter-distro incompatibilities, it's probably even harder for the malware people. (i think it's called 'security-through-incompatability' - the very same thing that protects vista ;)

i think the same thing protects os x, albeit to a lesser extent - they release a new version roughly every 18 months, each one adding significant security enhancements. from a hackers point of view, it fragments an already tiny market.

xp on the other hand, has been around for a heck of a long time. patches are released, but overall the security model has remained unchanged for the better part of a decade. it's not nearly as much of a moving target, but even if half the users upgrade to the newer secure patch, then hackers will still have many millions of targets in either half of the market.

CONFESSION: i made up all my numbers to help convey my point.

Really?

[blackroseMD1]

"Multiple AV products"? More often than not, that is going to cause all kinds of issues. If Apple is recommending virus protection, they should also recommend a specific one or two, instead of having some of their users install 2 or more AV clients, which could totally bork their machine.

Re:Herd Immunity = BeOS is most secure OS EVER

[insanechemist]

So if Windows is the least secure because is is the most used, the least used systems must be the most secure? Right? So things like BeOS, Amiga OS etc. are the best thing to migrate to for security!

Re:its about the dominant os

[C_Kode]

Wrong. There are OSX virus out there. Also to note, just because Apple has 10% (I would have to check that number) doesn't mean it will have 10% of all viruses. With a 90% to 10% ratio of use, the higher use OS will have an order of magnitude more viruses. Most virus writers want to attack as many people as possible and there for will devote their effort to the platform that will effect the most computers.

Re:Herd Immunity

[CFTM]

I love riling Mac fan boys, they get so uppity, especially early in the morning.

Windows security model

[alexhmit01]

The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

No, the Windows problem was that to migrate from DOS + Windows shell to Windows NT, was a slow, painful 10 year process with LOTS of growing pains. Windows 4.x series (Win95, Win98, WinME) were supposed to be a singular OS before the transition to NT, and was created because the uptick to NT 3.51 was low because of the RAM requirements. The original plan was 3.1 for home users, NT 3.1 for "Workstations," and Win32s was released to let people target both OSes.

As we moved through Win 3.11 w/ Win32s -> Win95 -> Win98 -> WinME, the NT systems grew in popularity. Lack of advanced DirectX support prevented NT 4.0's being the transition, Win2K was close but price kept it out, and WinXP finally merged the OSes. By that point, it'd been 8 years or so since the first 32-bit programs came out. The ones targeted mass market, originally Win32s, and later Win95/NT4 libraries, were generally assuming the consumer version. On the consumer Windows, there WAS NO SECURITY model, so it was common for applications to assume lots of access. This meant that while NT 4.0/Win2K gained market share and had the security model from the NT system, the security wasn't used and users had full access to the drive, because the alternative was broken software.

To not break applications from 1995 - 1998, in the early 2000s we were still shipping OSes with most of the system being world writable.

So while Windows possessed a security model that could work, in practice, it was never implemented, because it required locking down the system on each system, so instead of protecting OS directories, we used the "bolt on" security like Group Policies, etc., to prevent users from doing things. I worked with a bunch of Citrix systems in the late 90s, and we were able to lock down those machines, because you were only talking about locking down a single machine or two, and the defaults were more reasonable. There was PLENTY of software that wouldn't run under Winframe 1.x/2.x gold (2.0 never shipped, Microsoft pulled the license, then bought it to ship Terminal Server and Citrix moved the addons into Metaframe), not because it required the NT 4/Win95 libraries (we could always confirm that using 2.0 Gold that was NT 4 based), but because it made assumptions about access that was reasonable for Win 3.11/Win95, but not NT based OSes. Citrix, targeting big budget Enterprises could get away with that, Microsoft reaching the entire market could not.

I assume that this has been fixed in Vista, but I haven't used it, I switched to Mac OS X in the mean time.

Re:Windows security model

[Anonymous Coward]

"I assume that this has been fixed in Vista, but I haven't used it, I switched to Mac OS X in the mean time."

Isn't it funny how so many people here admit to not having used a Windows operating system since 3 or 4 versions ago, yet they also seem to be "experts" on how Windows security works. That would be akin to a Windows user complaining about how crappy Macs are now because OS 7.5 was so sucky.

Re:Windows security model

[el3mentary]

To be honest many Mac users are system agnostic, I for one use Mac at home but every other computer I have access to runs Windows, using one OS does not stop you from being fully literate with the other.

Re:Windows security model

[shutdown -p now]

To not break applications from 1995 - 1998, in the early 2000s we were still shipping OSes with most of the system being world writable.

You were absolutely correct up until that point. In any NT-family OS (this includes 2000, XP and Vista), most of the system is not world writable. It does in fact have sensible permissions similar to what you'd expect to see on Unix (user is confined to his home directory). The problem with pre-Vista Windows versions was that the default user account - the one automatically created during installation - was given Administrator rights. In that sense, Windows is no less (or more) secure than your average Linux distro with desktop running under root.

Vista finally brought it in line with modern expectations - no-one's root, and privilege elevation is explicit and always requires user confirmation. In that sense, as far as viruses go, Vista is just as well protected as OS X or your average Linux distro - a virus, even if run, wouldn't be able to find anything it can infect (because neither \WINDOWS nor \Program Files are writable). It can still infect some application installed per-user - such as Google Chrome, or a ClickOnce app. The same can happen on OS X if user installed an application into his own ~/Applications directory.

Re:Windows security model

[Neoprofin]

It does when you say "I haven't used it".

Re:Windows security model

[Haeleth]

I assume that this has been fixed in Vista, but I haven't used it, I switched to Mac OS X in the mean time.

Yes, it's been fixed in Vista. Attempts to write outside the proper places are silently redirected to the "virtual store", which is specific to the combination of user and application. The app may think it's written to C:\Program Files, but nothing else can see any changes.

When viewed through objective eyes, Vista is the best version of Windows yet on many counts. The problem is all the mindless XP fanboys who refuse to believe that anything that's different from XP could have any merit at all. It's weird how it's the Unix/Linux users like myself who are most able to appreciate the progress Microsoft has made...

Re:Windows security model

[PsychoElf]

"It's weird how it's the Unix/Linux users like myself who are most able to appreciate the progress Microsoft has made..."

I love that quote. The reason being that I felt the same way the first time I used Vista. People complained about all the clicking you have to do, but I smiled inside knowing that when I have to use Vista I don't have to worry as much as I did running =XP. Now if I could just make it as pretty as Linux...

Re:Windows security model

[Strep]

This XP fanboi just hates the Vista interface. It's like microsoft decided that their workstation test was too easy and needed to update the questions so wrote an shell around new convoluted questions.

Re:Windows security model

[alexhmit01]

I thought that that was a fair disclaimer. I'm an NT 4 MSCE, and Citrix Metaframe 1.8 CCA. I disclosed that I'm not aware of how this plays out on Vista, but that I assumed it was fixed, Vista broke a lot of backwards compatibility to modernize things.

I discussed the historical problems with Windows Security, why it was a difficult problem to fix. I can't comment on Windows Vista, I use OS X as my desktop OS now, Red Hat Linux as my server OS, and run XP under Parallels for the occasional Windows App.

Comparing Windows NT 5.x (2000/XP) to Mac OS 7.5 is beyond absurd. The Win2K/WinXP product line is one major revision back. OS 7.5 is about 6 major (treating System 8/9 as one major version, OS 10.0/10.1 were pretty similar, 10.2, 10.3, 10.4, and 10.5 were major revisions under the hood). There is no Windows NT system 6 major revisions back, you'd be comparing Windows 386 2.0 (or being generous, 3.0) to get something as comparatively archaic.

However, a user's opinion on OS X from 10.3 or 10.4 wouldn't be irrelevant to a discussion of OS X, because while the architecture has underwent substantial changes, the core is similar. Vista appears to be a major break from the NT 3.51/NT 4/Win2K_XP product line, not as substantial a break as Windows -> Windows NT (Or Mac OS -> Mac OS X) was, but similar to the NT 3.1 -> NT 3.51 break... the major break from NT 3.51 -> 4.0 was the introduction of the Win95 libraries for applications and migration of the video system into the kernel.

truth

[Tom]

At least they are truthful, you know. They "get" it. Not like the antivirus companies.

Using virus scanners makes it more difficult to write a good virus. That's it.

Re:Herd Immunity

[chaim79]

I actually trust the 'page hits' stat more then the 'units sold' stat. The 'units sold' stat does not cover anything more then new units this year, there is no accounting for junking old systems, wiping and installing linux, etc. The 'page hits' sold is only based on usage, which doesn't really care if the unit is new or old, just that it's connected and used on the internet. If you have a sufficiently broad spectrum of websites covered by the stat tracking you can get a fairly good idea of the number of units out in the market. (at least for the user side, server side is more difficult, especially when considering internal servers that have no exposure to the internet).

So I guess what I'm saying is that both are inaccurate in different ways, I just think that the 'page hits' are closer to the truth.

Veni Vidi Virii

[SoupIsGood Food]

The old MacOS had a free product that almost everyone used, Disinfectant, maintained by one guy who quit because the virus writers had completely given up with improvements to the Mac's OS, around when OS 8 came out. MacOS X is on a completely different plane, in terms of security. It would arguably be more useful to come up with software that would look into downloaded files for trojan profiling, maybe as part of a user-friendly HIDS, than worry too much about AV.

That said, AV on a Mac is useful for:

1) Self-modifying environments - What comes immediately to mind are MS Office macro viruses (or virii if you're a lazy typist, and I am). It's conceivable that Javascript may be the new way forward with this, with browsers suddenly a new platform all their own, and one that has access to your Mac's file system.

2) Being a good netizen - Stripping out virii from anything that crosses your file system is good manners, whether it can infect your box or not. Helps cut down on useless network traffic and DDOS attacks, even if just a very little bit.

Re:Veni Vidi Virii

[geekoid]

"...Virii..."

There goes any credibility you may have had.

Re:Veni Vidi Virii

[SoupIsGood Food]

Reading comprehension: Develop it. Read the things in parentheses, too - it may save you some embarrassment later.

Also, to derail a bit, the "proper" plural form of computer virus being computer viruses is a fairly late development. Virii was a bit of geek humor, like a collection of 8 bits becoming a byte, or the acronym GNU, that became more commonplace and mundane in everyday tech as the topic became more important. Virii was, for a while, in wider usage than viruses as it relates to tech (and remains easier to type). I can't really say why the term didn't stick around, apart from virii annoy my spellchecker, where viruses do not.

In short: get off my lawn! Whippersnapper.

Re:Herd Immunity

[chaim79]

To add to your point, Vista is XP with a service patch and a spiffy UI, so windows virus writers have a huge market to go after (XP and Vista) :)

Re:Quietly?

[M-RES]

No, the closed hardware platform makes sense - they can write an OS that runs much more smoothly on the hardware they KNOW is in there. Fewer issues with cheaply made third party crap needing support so smaller install footprint (check how much bloat installing all the printer drivers that come with OS X by default adds - personally I always uncheck them at install and just install the printer drivers I need from the manufacturer's sites).

Additionally you CAN run OS X on your intel box. You just have to purchase your intel box from Apple. Too expensive? Then have a look at ebay for second hand Minis going for a couple of hundred quid. If you're really not seriously into running OS X enough to fork out for more high end hardware to run it then surely this is a viable option for something to 'play' with. If you DO really want to run OS X seriously, and want decent hardware to run it on to get the best performance out of it, then what's so hard about buying a new Mac? I really don't understand all the fuss. If I want cheaper fuel (price per litre) in my car I'd run a petrol car, but I want better mileage so I have a diesel - I don't moan every time they drop the price of petrol but not diesel just because it won't run my car. There is a choice (and even some cheaper options for just dipping your toe in), it's really that simple.

Tsssk... some people ;P

Re:New Commercials?

[maugle]

That's all? Let's make it even more accurate...
The Vista guy, in his kingly garb, also weighs 350 pounds and has the flu. When he tries to whack the Mac guy over the head, he misses and collapses, coughing and wheezing.

And the Mac guy is smirking the whole damn time.

New Security app 4 OS X- 100% accuracy, low cost!

[Eganicus]

1) I write an application using interface builder. The icon is extra shiny - the UI is sexy - attaching knobs, sliders, buttons, progress bars showing "blood vessels" being filled with pure green glowing fluid. It looks like it is doing all sorts of things, claims to utilize a new Quantum computing algorithm no one else can. 2) In order to detect all zero computer virus, trojan, etc. It doesn't need to "do" anything. I therefore make sure it does nothing. Just looks sexy and like it's always working away.... 3) I include a full warranty, plus up to $1,000,000 if any Mac OS X virus destroys your data. Satisfaction guaranteed, 90 day money back offer. 4) Profit!!!!! In fact, since there has never been a virus on Mac OS X, what criteria can we use to evaluate the ability of antivirus software which has nothing to detect? Republicans confirm, it is easy to scare people, especially non tech people.

Re:Herd Immunity

[meringuoid]

"Herd Immunity": You keep using that expression. I don't think it means what you think it means.

It's just misspelled. 'Hurd Immunity': a system gets no viruses because it has no users.

Security through obscurity...

[suitepotato]

...can't last forever. As in, the Mac platform is no longer a minor niche thing, and with the fundamental change to a BSD/*nix base which opens the architecture to creative accessibility, viruses were a matter of time on the Mac. About damn time they came clean and did the responsible thing and admit it isn't invulnerable. If you want a large market share, it will come with a price of making it a target for miscreants.

Re:Security through obscurity...

[geekoid]

They have always said it wasn't invulnerable, and becasue it is open there is LESS of a chance for an exploit.

So where are the viruses? experts have been specifically attacking BSD and OSX for years, with no luck.

No to say it is invulnerable, only to counter your implication that some how virus vulnerability is depended on the number of users, which it is not. The number of times an exploit is used is, but the actual exploit is not.

We've run Sophos on Mac and PC for a while

[zerofoo]

I work in a school with a mix of Macs and Windows machines. We've run Sophos AV on all of these machines for a couple of years now and I found that by protecting the Macs, we've also enhanced the protection of our Windows machines.

One of our teachers attached one of those cheap digital photo frames to one of our Macs, and Sophos found and removed a Windows virus. We may have prevented the infection of her home computer by detecting the virus on a Mac.

While the Mac was not vulnerable to the Windows virus, having anti virus software on the Macs may have prevented a Windows infection at her house. No matter your platform preference, we can all agree that one less spam spewing bot on the internet is a good thing.

The entire computing ecosystem benefits from everyone running AV software.

-ted

Re:Herd Immunity

[UnknowingFool]

Even though Mac users are a small percentage of computer home users, they still represent millions and millions of consumers. Also the average Mac user is likely to be more affluent and less technologically minded. So there is a market. Due to the nature of OS X (which is Unix based), they are less likely to be affected by viruses because viruses cannot self-replicate and run in OS X. Trojans on the other hand will affect all systems. I would expect to see more OS X specific Trojans in the future.

None of those are viruses

[yabos]

All of those are trojans with exception of 2 proof of concept worms from 2006 and 2007 that have long been patched.
All those trojans require a user to double click the executable/installer, enter their administrative password and allow the thing to execute. That's hardly a virus and has everything to do with user stupidity and nothing to do with OS security or popularity.

Re:None of those are viruses

[wiedzmin]

Has the Storm trojan not demonstrate that targeting user stupidity can be quite successful? And not to generalize or anything, but I think anybody can agree that the majority of Apple userbase is a lot less technical and virus-aware (partially thanks to the "no viruses" myth maintained by the company) than PC userbase. Never underestimate the power of stupid people in large groups.

Questions for the /. experts

[Jerry]

I don't use or know about the Mac but, unlike Windows, I have yet to hear of a virus bringing down hundreds of thousands of Macs within a short period of time. (CodeRed, anyone?) Until that event appears in the newspapers, and there would be no way to keep it secret, how can one say the Mac is vulnerable? It's looks like a concession to the anti-virus houses, now that windows has pre-empted them with its own product.

How much of Apple's "new vulnerability", if it is indeed vulnerable, could be attributed to the fact that their OS is a proprietary, closed source application which lacks the "To a 1000 eyeballs all bugs are shallow" benefit?

Linux netbook market share is now around 30%. How long do you guys think it will be before a real (infects tens or hundreds of thousands) virus shows up. (Ya, I know. Some wanker is going to suggest that they have to sell a hundred thousand first. ha ha.)

Mac's security was a myth?

[amanjsingh]

So all that hype about Macs being really safe is actually dependent on the Market share?

Re:Mac's security was a myth?

[geekoid]

No, it is not. That's not to say they are perfect, just that it is a fallacy to compare two systems with different architecture, different design methodologies, written by different people , on how many people use them.

Add to that they amount of attention, street cred and hype someone who could write an exploit would get, it is probably attacked by serious attempts more often.
Obviously that is just speculation based on the assumption that people with the correct skills would want to get up at defcon and blow apple out of the water.

Re:Mac's security was a myth?

[amanjsingh]

That sounds real to me too. I believe Apple is 1) either playing safe or 2) Want some Anti-Virus companies to have more business, for a share. :)

Doesn't add up

[Toreo asesino]

...when you consider that 99% of malware requires user interaction with said malware (clicking, opening, whatever) to get it onto the system in the first place....which you never do with any server, let alone a Linux server.

Desktop dominance != server dominance; you can't compare infection rates between the two.

2009, the year of...

[xbytor]

Is 2009 going to be the Year of Mass OS X Infestation or the Year of the Linux Desktop?

That latter is more likely.

Even DNF is even more likely.

Some 20-year-old apps are still in production

[tepples]

They had 5 years to get applications re-written to work right.

The even could have created a virtual backwards compatibility mode where it ran such applications in a sandbox

What kind of sandbox would you recommend for non-free applications between 10 and 95 years old? A lot of these were published by a company that has been out of business for years. In fact, some 20-year-old applications are still in use, such as NES games running in Nintendo's Virtual Console emulator or fan-made emulators. Should Microsoft likewise incorporate its PC emulator and a copy of Windows 98 Second Edition into future versions of Windows?

Re:Some 20-year-old apps are still in production

[M-RES]

Really, a NES game running in Nintendo's Virtual Console emulator IS sandboxed, in that it's running inside a virtual machine environment, not as a native application.

I think one of the smartest moves MS could make WOULD be to use it's existing code - VirtualPC - to build a 'classic' style environment (similar to Apple's when they migrated to OS X) so that they could write a completely new OS from the ground up and dump the legacy rubbish. At least that way the legacy apps would have time to degrade gracefully and they'd not upset the applecart (er... should that be MSCart?) with their longstanding customers. It's the smartest move, but they don't seem bold enough to just bite the bullet and go for it, even though it's a proven strategy.

Re:Some 20-year-old apps are still in production

[Archangel Michael]

What kind of sandbox would you recommend for non-free applications between 10 and 95 [wikipedia.org] years old?

I don't care. I've learned that people hold onto things because they can, not because they need to.

Digital Packrats.

Besides, they could just VMware a DOS/Win98 session on a LINUX box and be done worrying. If it doesn't run on VMware, then it probably doesn't run on modern architecture anyway.

This has always been Apple's policy

[Me! Me! 42]

AFAIK this has always been Apple's policy. All they did was update the posting slightly to show the latest leading commercial AV software. Here's the previous update from a year and a half ago. I assume it was just an update of the one previous to it. (I think you will find that it looks very familiar!)
http://web.archive.org/web/20080113164722/http://docs.info.apple.com/article.html%3Fartnum%3D4454
"Mac OS: Antivirus Utilities
Last Modified on: June 08, 2007
Article: 4454
This article describes the antivirus utilities that are available for the Mac OS.
Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one program to circumvent, thus making the whole virus writing process more difficult. Here are some of the available antivirus utilities:

Intego VirusBarrier X4
Publisher: Intego
License: commercial

Norton Anti-Virus for Macintosh (formerly SAM)
Publisher: Symantec
License: commercial

Virex
Publisher: McAfee
License: commercial

This article provides information about a non-Apple product. Apple, Inc. is not responsible for its content. Please contact the vendor for additional information.

I know our posters say, think differently' but our

[geekoid]

real slogan is 'no refunds'.
Steve Mobs.

Re:New Security app 4 OS X- 100% accuracy, low cos

[DaveV1.0]

There was never a virus for an MS product until there was one.

As soon as we see something in the wild ...

[motorsabbath]

... let me know.

"Some 3rd party vendors have spent quite a bit of time and money catering to CIOs freaked out about Macs appearing on their networks and have created or ported AV apps to the Mac, but no-one is buying these apps at all. We promised them we'd at least suggest to people that they buy AV software, just to keep them happy."

Nothing to see here, please move along.

User base

[lilfields]

This is obviously a result of their growing user base, much like Windows more market share means more viruses or attacks...but not always, of course. I think this happens, because not only is their market share expanding, but their consumers are getting dumber. It's easy to get someone to put a virus on their own computer when they don't know what's going on. Even with Windows a smart user can avoid viruses, but incompetent users are more prone to viruses.

The summary seems strangely balanced..

[bill_kress]

I don't remember hearing apple bragging about their invincibility. Could I see a reference?

I can fully believe they discussed the fact that PCs are generally full of viruses and macs are not, that's just an observation--but there is a big difference between that observation and actually claiming that you are invulnerable.

Now, if the article had claimed that Mac fanboys have claimed that the mac is invincible, I wouldn't have blinked.

I guess they are virgins!

[hesaigo999ca]

>Run multiple anti virus solutions...

Are they serious, they never tries to turn on a computer that had symantec, mcafee, adware, spybot all installed at the same time.... I guess M$ is a bit ahead of them on that then...

I've got to call cough! *bullshit* cough!

[gordguide]

Apple has NEVER not recommended users install AntiVirus software. One of the first benefits of subscribing to Apple's DotMac web service, a service that is roughly as old as the first Gold Master release of OSX itself, was a complimentary copy of AntiVirus software (McAfee Virex 7.0, released September 2001).

The offer only applies to v7x; which no longer compatible with the latest OSX version, which probably goes a much longer way to explain why Apple is now recommending users install their own choice of a competitive application.

The most recent ad campaign, which does mention vulnerabilities to various malware on Windows machines, comes after more than two decades of people clamoring for Apple to do just that in it's marketing and sales literature. Rather than all of a sudden "quietly" recommending AV software, Apple has always (quietly) recommended it.

The (very lightweight) BBC article comes across as written by someone who only recently started paying attention to Apple, perhaps after her dad bought her an iPod in Journalism school.

NOTHING to do with UAC!

[argent]

UAC in Windows Vista is there to protect users from themselves.

I'm not talking about UAC. Apple's already got that, sudo and the password dialog... and it comes up a lot less than UAC because OS X is based on UNIX... which has had that kind of protection for almost 40 years now.

I'm talking about using dialog boxes as if they're a security system.

I'm talking about "Internet Explorer wants to do something really stupid, that nobody would ever want to do, but we're going to wrap it up in a bunch of jargon that sounds complicated so you just hit the 'allow' button." "Allow" "Cancel".

I'm talking about "Automatically open 'Safe' files after downloading". At least Safari lets you turn that off. To turn off the equivalent in IE you have to make the "stupid security dialog" problem worse!

I'm talking about "Let's pretend software installers and disk images are 'Safe' files." Not as stupid as Microsoft's ActiveX mess, but still pretty damn stupid.

I'm talking about "Let's warn about EVERY downloaded file, to train people to automatically approve all the dialogs they see." In 20 years as a system administrator, I never had anyone download an infected file and run it twice. I've had a number of people, including PhD programmers and engineers, come to me with "I hit OK *AGAIN* and now my computer's acting funny" multiple times.

If Windows was an airplane, when you got to 20,000 feet a dialog would pop up on the seat in front of you saying "Should the aircraft explode now?"... and someone would ALWAYS press "yes".

THAT is the kind of security theatre I'm talking about. Not UAC, but the decade of absolutely daft and criminally stupid design decisions that went before it, and that have now infected Apple with the meme that "asking before we do something that might be dangerous makes it OK".

Sheesh.

They've had it too good for too long...

[dannydawg5]

Well, if there's group of users that has been told repeatedly that their computer is safe from viruses, that it "just works," and that they don't need to be concerned with computer threats of any kind...it's Apple users. Sitting in their offices, wearing their turtlenecks and sipping their lattes, the only thing about phishing they've heard about is that it happens to other people. Uglier people. They're not used to having to defend themselves, not like Windows users. Windows users have a battle-scarred paranoia...they've seen worms that can rewrite their BIOS, steal their credit cards, and kidnap their firstborn. Their 50 yard stares have been earned by fixing their mom's computer for the eighth time this month, and damnit if they're going to lose another computer to some Ethiopian scammer...not after the last time. Their nightmares are the stuff of Steven King novels, the earlier stuff with lovecraftian clowns and superplagues that are the start of apocalyptic battles between good and evil. Their best days on the internet involve life and death struggles against the next pop-up, because it might be their last. Ironically, Mac users have never had to live with the terror that clicking on that "win a free iPod" might just cause their computer to explode, spamming their grandmother with anal tranny porn on its way out. Maybe it's time they should... ...wait, what the hell was I talking about?

Re:Herd Immunity

[YouWantFriesWithThat]

you have a good measure of units in the market that hit a group of websites that are reporting back to the market research company. there are all kinds of factors that can manipulate the stats to favor or disfavor a certain OS. the gaming rig that you don't allow on the net isn't getting counted and neither is the mac pro that is rendering video all day long. i have a pile of pcs in my basement running a combination of ubuntu and win2000 and they rarely are on the net.

i wish there was a better way to get true numbers, but i can't agree that it is most accurate to only count PCs that are actively browsing the web.

iNoculation?

[VindictivePantz]

Might be a good name for an Apple-developed AV solution.

On the other hand, virus writers have a lot of opportunity for virus names like iFormatYourDrive.

Re:Duh

[M-RES]

Rather than giving the root account a password and then disabling which should in theory block this kind of attack AFAIK?

This is a misconception

[ghjm]

Viruses do not inherently require root access. If your user account is capable of downloading and executing outside code, then it can in theory be infected. Email viruses, for example, generally run and propagate just fine in a Windows restricted user account. The presumably-secure FreeBSD kernel of MacOS would do nothing to prevent this. It's a combination of saner email clients (no talk of "rich experiences" like on the MS side), and the lack of high value targets (botnets require homogeneity so they can all run the same spam server / DDoS / whatever).

-Graham

OSX a transport for virus and malware?

[w0mprat]

This is interesting their encouraging this. This would be in the same way that a anti-virus scanner is a good idea on linux. Your OS, although may be immune, it could be a carrier for viruses with the movement of files. Also without widely installed AV if there is an OSX specific outbreak then it could cause havoc and undo alot of the Apple PR machines hard work.

Re:Multiple antivirus products?

[noppy]

Sounds like a bad idea to me. I have never used a Mac before, but this is a no no in Windows.

It might makes sense that more layer of AV means more security, unfortunately in practice things doesn't work that way.

AV works by installing hooks in OS itself to monitor system activities. (eg. open a file) Having multiple AV means different AV might interfere each other. In the end, you might end up with unstable system instead of more security.

Re:Herd Immunity

[AvitarX]

They generally come in before you type your password.

Since installing game pack makes sense to need a password, a site that has been compromised by SQL injection can spread the bad.

But the Virus scanner will say: This installer has a virus, hopefully that will stop someone from entering their password.

Of course attempting to get porn, or illegally free games can lead to similar problems without the compromised site.

I guess the hope is that the AV software makes people realize they are doing something stupid/the site they were browsing was.

Just market share?

[janopdm]

Virus: a computer program that can copy itself and infect a computer without permission or knowledge of the user.
Apple has 20% market share in US, 10% market share in the world. So far 0 virus.
Note that according to the virus definition above Im not counting those that you have to execute yourself and provide with your admin password.

Do you think the difference is just attributable to Apple's market share?
In comparison Windows has 100,000+ and its the only support of the whole antivirus industry.

Re:Herd Immunity

[shutdown -p now]

There aren't many virus-infected Windows servers out there, either. Viruses have always been the desktop disease - by their very nature, they rely upon desktop usage patterns (downloading and installing new software from untrustworthy sources on the Net and other external sources such as floppies/USB sticks); and guess what OS still takes up the majority of that?

Fix the real problem.

[argent]

It doesn't really matter. If the downloaded file does not automatically open people are rarely "caught" by it... and in the past decade I have only had one user come to me a second time after explicitly opening a downloaded file saying they had gotten a virus from it... I've had several people repeatedly come to me telling me they "clicked the wrong button" again and their computer was acting funny. Not just two or three times, some of them.

The exposure from downloaded files that do not automatically open or unpack is very low, and virtually everyone learns not to open files in their download folder they didn't expect to see there. The security problem is caused by automatically opening or unpacking downloaded files, and is best fixed by simply not doing that.

The greatest security flaw is...

[w0mprat]

... between the keyboard and chair.

Mac users may be more vulnerable to social engineering due to complacency. In away this may be social engineering by apple to counter this?

Re:Symantec *IS* the virus

[Macrat]

takes up 30% of the CPU.

There's no story here.

[Anonymous Coward]

Apple merely updated their standard antivirus recommendation page to increment the version of one of their recommended antivirus products from v4 to v5.

The page obviously popped to the top of the watchlists of some hysterical tech "journalists" who didn't know any better, and they immediately started screeching "Macs get viruses too! Yay!"

Still, it got a few more pageviews and no doubt some ad clickthrus for the sites in question, so I guess it met or exceeded the only journalism standards that really apply these days.

DEFCON

[kieblerh]

People didnt bother hacking apples before because there wasnt any information worth taking stored on them. The majority of large companies used PC or Linux. Now with more companies using apples there is more insentive to hack em.

Shame on you, Slashdot!

[Silas is back]

Even you cover this story, which is totally wrong! This support document has been there for quite some time, but was only recently updated. Just click the German or French link at the side and you'll see that those documents were last updated July 30, 2008.

I hoped that at least here on slashdot, a little research would be done before claiming that "now, Apple suddenly recommends Antivirus Software". Not to mention that Apple itself offered an Anti-Virus Software until 2005...

Re:Viruses? On a Mac? Nooooo Waaaaay?!

[scot4875]

Your need to run a daily virus scan to clean out your 24 hours' accumulation of crap says more about you and your usage habits than it does about Windows.

--Jeremy

Re:New Commercials?

[mjwx]

That's all? Let's make it even more accurate...
The Vista guy, in his kingly garb, also weighs 350 pounds and has the flu. When he tries to whack the Mac guy over the head, he misses and collapses, coughing and wheezing.

And the Mac guy is smirking the whole damn time because he has syphilis but no-one else knows it. Shortly after the Mac guy is knocked over by a slight breeze.

Because no-one likes a smug hippy.

Re:non-Admin user

[toddestan]

If it's the one I'm thinking of, it dates back to the Classic days and thus didn't have to deal with any of that pesky Admin/non-Admin stuff as it happily wiped your drive.

False alarm

[jordan314]

As digg and gizmodo point out... http://gizmodo.com/5100996/false-alarm-apple-mac-os-x-anti+virus-recommendation-is-old

What about using ClamXAV occasionally?

[erostratus]

I'm really surprised that the vast majority of people have never run anti-virus software. I always assume people have the software and just run it every once in a while. I use ClamXAV when I want to scan a file I've downloaded or received via email, but I don't have it set up to continually scan. I read a post today at Mac Guru Lounge on the Top 5 Mac Security Tips for the Holidays, which also talked about running AV software.

How do we know antivirus works? zero virii in wild

[Eganicus]

1) Write app which "looks" like it does something. 2) Make it shiny icons & UI 3) Guarantee up to 1 million USD 4 any data loss via virus. 4) Profit!!! I think physical access is required for even theoretical exploits. How do we know "any" Mac OS X antivirus app works? It has to find nothing to prove it.... hmm. What a racket!

MISTAKE: See new info.

[Futurepower(R)]

New Information: Apple pulls support note recommending antivirus software

My understanding is that Microsoft Windows is allowed to have so many vulnerabilities because vulnerabilities make Microsoft more money. See the July 17, 2005 New York Times article, Corrupted PC's Find New Home in the Dumpster.

Windows allows several degradation paths, all of which make more money for Microsoft. People who don't know how to maintain Windows, a very difficult and very technical task, buy new computers and in doing that pay for another copy of another vulnerable version of Windows. Here are a few of the paths of degradation:

1. Fragmentation. Defragmentation is not built in, customers must know how to run it. Without defragmentation of files on the hard drive, computers become very slow.
2. Temporary files. A study we did showed temporary files store in more than 40 places. Temporary files on computers we analyzed showed operation enormously because Windows becomes slow when the operating system partition is slow.
3. General sloppiness. It's difficult to maintain Windows because there are so many areas of sloppiness.

Not anymore....

[GrendelKhanmac]

http://www.appleinsider.com/articles/08/12/03/apple_pulls_support_note_recommending_antivirus_software.html

"It was later revealed that the document was about a year old and only caught the attention of industry watchers after Apple recently updated it"

"Apple has removed a widely publicized support document from its website that encouraged Mac OS X users to install antivirus software, explaining that its operating system was designed with safeguards to protect against malicious attacks on its own."

ROTFLMAO

[JonathanPDX]

It appears that there is a worm in the Apple as well. There is no such thing as a bulletproof or totally safe OS, and smugness will definitely not protect a system, either.

Cancel or Allow ?

[DrYak]

On Vista most stuff gets installed into \Program Files, with some occasional libraries into \WINDOWS, neither of which are writable to user accounts without elevation.

Oh ? You mean the thing that 99% of all Vista users quickly disable because they are fed-up of constant "Cancel or Allow ?" screen-blocking pop-up ?~
And the remaining 1% have taken the habit to "ok-/allow-" click through and developed it into a spinal reflex which doesn't require any thinking effort from the brain ?~

Re:Cancel or Allow ?

[shutdown -p now]

It's not any better or worse than similar prompts in OS X or, say, Ubuntu. When copying files to a system folder, you will get precisely one prompt. What else do you expect from it? To read your mind?

not surprising

[votershatefreedom]

macs were never invulnerable, it's just that no one ever bothered making viruses for macs as they were pretty much unused in any sort of serious way. the recent apple revival and hardcore attacks against windows inevitably led some people to actually making viruses for the mac. it's entirely believable, and entirely plausible, and it's one more fallacy apple can no longer spin. enjoy your apple tax people.

Bad design

[DrYak]

It's not any better or worse than similar prompts in OS X or, say, Ubuntu.

I'm not against the idea it self of having write restriction to system folders.

I mean, in fact, it is a good move from Microsoft to finally try to enforce privileges (like every decent OS did for the past decades) instead of the tradition of "user-land software can pretty much do anything" carried over from the Win9x family and from DOS before that.

What else do you expect from it? To read your mind?

What I want is a slightly better organised system which doesn't *constantly* submerge the user under a constant flow of pop-ups.

Take a good OS : my favorite OS is OpenSUSE - everything administrative is in an administration program called YaST. If you want to setup something, you fire up yast, type your root password one single time to run YaST as root, do all the administration you need and then close YaST.
Nothing anoying.

Under Vista the situation is a different beast :
- navigation inside the control panel isn't straight forward and you get constantly authorisation pop-ups.
- lots of configuration is dispersed at separate places, where you have to "right clic"+"properties" on different objects. Not a single tool, but lots of entry points each asking its privilege.
- Linux has a tendency to make a difference between "configuration" and "setting" (a system wide parameter that change how the computer works vs. something that the user set to her/his taste). The former needs privileges, the later doesn't. Under Linux you can freely set the keyboard layout or the timezone used on your desktop. Vista will require privilege once entering the clock settings (...well at least its an improvement over XP which required privilege even to show the calendar because it was on the same window too...)
- Windows completely lack an elegant drivers to access several important function. Thus there's a proliferation of simple "status" programs which nonetheless require direct hardware access.
Hardware monitors (CPU, GPU & HDD temperatures, etc.) require full authorisation (either to give full access to the software or because the software relies on non-Microsoft-approved drivers).
Under Linux, kernel drivers (i2c and lm_sensors, for example) take care of that and the monitors don't require any special privilege
- Some time up to 3 pop-up can appear in a row for a single logical action. This multiplication of alerts exacerbate the problem and pushes more user into ignoring the message and just clicking OK.

And that's not counting all the application which for some reason or another decide that they should do restricted stuff, because up to XP this has always worked as the system was constantly running with full rights and thus trigger "Cancel or Allow" for trivial user actions which should never have.
Yes this is mainly the fault of 3rd parties writing bad code. But Microsoft is guilty a lot, because :
- they are the one which kept the "run as administrator" strategy for all this years, thus encouraging 3rd party developers to make crappy software
- they should have put more efforts in abstracting/sand boxing/isolating/emulating these privileged operation. There's something like that, but given the constant flow of pop-ups it isn't enough efforts yet.

All this add up into a bad user experience, with alerts always interrupting and annoying the user. To the point that lots of them disable this security and revert to XP-style policy, thus negating any benefit that the reintroduction of privileges in Vista would have brought.

Re:Quietly?

[eniacfoa]

I posted a reply, but it appears it didnt work so here goes again - Closed X86 makes it easier for apple yes but they will never compete for real market share if they dont abandon this policy at some point. I still think closed x86 is silly. apple easily has the resources to fully support x86. with their cash cows IPOD, IPHONE, they are in a position to compete with ms directly for once in their histroy and they would probably do well. Competition is serisouly missing from this market and people are crying out for a choice. you talk about stability - I have an xp system, its stable as any mac. Why? I know what Im doing. the reason pc has this rubbish instable tag is due to 98% market share and a bunch of twits that get tonnes of virus's searching for porn and whatever else...they should go back to their typewriter and forget about the computer. You ever done tech support? sometimes the halfwits dont know where the space bar is...I shit you not If mac had more market penetration they would have same problems...simple. But the pro's outweigh the cons IMHO... I have also never had any issue with any 3rd party devices and drivers no matter how cheap. and ive used a crapload of devices. PS... car analogies are just lame