Apple Quietly Recommends Antivirus Software For Macs

Barence writes "After years of boasting about the Mac's near invincibility, Apple is now advising its customers to install security software on their computers. Apple — which has continually played on Windows' vulnerability to viruses in its advertising campaigns — issued the advice in a low-key message on its support forums. 'Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult.' It goes on to recommend a handful of products." Reader wild_berry points out the BBC's story on the unexpected recommendation.

Comments

a way to make money

[Bizzeh]

is this a scare tactic for apple to push some payfor software and get people to buy it. or have apple started to loose confidence in their operating system? or even worse, do they know something we dont? are they expecting an attack?

Re:a way to make money

[bytethese]

It does sound like a possible "setup". Macworld 2009 debuts new AV software? Who knows. Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts? After all, Mac does seem to be gaining market share year by year.

Re:a way to make money

[YttriumOxide]

Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts?

Perhaps, but I am still waiting to see a real "virus" that hits MacOS. There's been a few trojans (such as the one mentioned in TFA), but nothing that qualifies as a virus yet as far as I know. It is likely much harder to write a real virus (rather than a trojan) for MacOS than Windows as you'll need to find a privilege escalation exploit (need I say, without local access) in one of the standard services first, all of which tend to be pretty robust and having a core that comes from the open source and Unix worlds... as far as I know, there aren't any such exploits known right now.

Trojans can of course still be fairly nasty, as there's a lot of stupid users in the world (of any OS)

Disclosure: I do use MacOS X as my primary OS at home, but I'm definitely not a "fanboy" (I also have Linux systems at home and use primarily Windows at work - I consider myself "OS agnostic").

Re:a way to make money

[mario_grgic]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Re:a way to make money

[v1]

Macs definitely are susceptible to malware, as the recent DNS trojan has demonstrated. Any app that asks for and gets your admin password is going to play with your computer, that's pretty hard to beat.

Viruses, and worms in particular, do covert, automated spreading. Worms are able to exploit on-by-default network services remotely in the background. (we just had a new one announced yesterday! affects xp AND vista, good lord you'd think they'd learn by now!) Viruses require the ability to circumvent LOCAL security, and get their hooks in the system and replicate locally without user interaction/permission. OS X (and unix in general) are designed from the ground up with this in mind, and have always been far less vulnerable to these two issues.

I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice. Windows started in the wide open, and their devs got used to it, before they realize the scope of their mistake and tried to close the doors. The devs refused to stop writing apps that just "oh lets just assume we have full write access to the entire hard drive" etc. and so MS has had to go very slowly to avoid completely destroying their established software market. That's hard to overcome.

Even today I can count on one hand all the mac apps I've ran into that either (1) have to be installed while logged in as an admin, or (2) will only run properly (or completely) when logged in as an admin. And I count those developers as idiots for not knowing what they're doing and just assuming they have privs. Until Windows software approaches these numbers, I don't think we can call the Windows security model "fixed".

There are two things that most interest me here. First, Norton has been considered anything from "bad" to "poison" to OS X from the get-go. It's been known to create a wide variety of system problems, and in most cases, when OS X is misbehaving, and they admit they are running norton, the first advice they get is to remove it. (and "good luck removing it" to boot) Symantec has been of little help there, their first "removal tool" was 300+ lines of terminal commands, and still didn't completely uproot it. Their current removal tools are more effective and user-friendly though. So to see Apple RECOMMEND norton is something of a shock. I don't know of a single person in any of the mac support forums that recommends anything for Norton besides uninstalling it.

Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it. From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate? I seriously question where they're going by recommending you install additional (or possibly multiple) AV software.

Re:a way to make money

[deraj123]

Except the GP didn't say that it was easier to break into the system - he said that more people are going to try. I think he neglects to mention an underlying assumption that no software is perfect, and given enough time and effort, the chances of finding a security flaw that can be exploited is greater than zero in ANY piece of software. While this assumption won't always be true, it's completely reasonable for us to make it when considering the security of our systems - for we don't really have any way of disproving it for any particular piece of software.

Re:a way to make money

[TheRaven64]

It doesn't when you're talking about manual attacks, but it does for automated attacks. Compromise one Windows machine, and it's trivial to find a load more Windows machines to attack. Compromise one Mac, and it's much harder to find the next Mac to attack.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

Oh, this just makes me laugh. Operating system the first Internet worm ran on? UNIX. It wasn't until the mid '90s that people started saying 'UNIX Security' without laughing.

Re:a way to make money

[squiggleslash]

I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

Look at AROS! It has no security whatsoever, not even memory management between processes, so despite only having a hundred or so users, it must have zillions of virusses. But, of course, it DOESN'T. So far as I'm aware, nobody's bothered to write one, and it's unlikely any AROS virus would actually be effective.

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

It's frankly hilarious that Unix, on which the first worms operated, can be held up as some system that had security built-in from the start. It's also untrue that Windows, that is, the operating system known as Windows today, was "never meant to be a multi-user OS connected to the internet". Unless you're talking about Windows Me and its predecessors (98, 95, 3.1, et al), then that's completely false. Current versions of Windows (XP, Vista, 2003, et al) are derived from Windows NT, which was designed, from the beginning, to be "a multi-user OS connected to the internet".

In fact, Windows NT and its successors have a more advanced security model than Unix, allowing more than a separation of users and groups.

The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

Re:a way to make money

[domatic]

I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice.

There is another common stupidity that many Mac developers seem to have that still persists from the Classic days. Many OS X devs still act as though the user installing the app is the only one on the system. A good example is Adobe Reader. EVERY user that runs Reader for the first time will be pestered to enter an administrator password the first time the software is run. The only workaround is to copy some preference files into every home directory on the system and if there is an update to Reader then that has to be done again. Yeah, yeah, I know just use Preview but things like that happening are common. It isn't OS X' fault. There is provision for system wide app settings; it's just that OS X devs tend not to use them the way Windows devs assume everyone is an administrator.

Re:a way to make money

[VirusEqualsVeryYes]

Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

Yeah. Why achieve the fame and glory of being the first to write a real Mac OS X virus? Why feel satisfied in crushing the worldview of every Mac fanboy in existence?

There's just no draw.

Re:a way to make money

[Mister Whirly]

I recall people saying just the opposite when DOS for PCs was starting to become popular. Back then, people were writing worms for Unix systems, and there wasn't much "in the wild" for DOS. But no need to change your strategy as things obviously never change in the technology realm...

Re:a way to make money

[_Sprocket_]

All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

Fair point. However, Mac OS X has far more market share than something like Aros. We're talking somewhere above 8% of the market right now. That's an appreciable install base and certainly worth targeting. By comparison, the Witty worm targeted (and infected) an install base of only 12,000 systems. So sure - install base might be a factor. But it is hardly the only one.

There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

Wait a minute here. Correct me if I'm wrong, but my impression is that the "administrator" setting of an account allowed sudo access. That's a little different than running as root. Is there something else going on in the Mac userland?

It should also be noted that we've heard these warnings before. The doomsday scenario has yet to come to pass. And while I agree that some of the perception of imperviousness is misplaced, I am also inclined to believe there's a bit more at work here than some critics want to believe.

Re:a way to make money

[LO0G]

Good points all, but I think you forgot one major aspect of the "market share" argument.

There hasn't been a true "virus" out there in the wild for years (to me, a true virus means self propogating malware - malware that modifies existing binaries and relies on those modified binaries being distributed). Instead there's a TON of malware intended on converting machines into botnet clients.

The vast majority of malware (maybe as much as 95% or higher) these days is really "crimeware" - software intended to aid in criminal activity (identity theft, click fraud,etc).

As a criminal, let's say that it's going to cost me $10,000 to hire some eastern european hacker to develop malware for my criminal enterprise (number totally made up). I get to chose which platform I have the hacker target - I can target Windows with 90% of the market, I can target OSX with 8% of the market or I can target Linux with 2% of the market (market share numbers also made up, but probably in the right ballpark).

That means that if I'm interested in profit (and this IS a criminal enterprise, so profit is the primary motive), I want to have my hacker target the platform with the highest ROI. That means that the hacker's going to go after Windows and ignore OSX and Linux.

As the Mac's market share increases, it is going to be an increasingly more attractive target for hackers, because the ROI is higher.

Re:a way to make money

[Me! Me! 42]

Mmm, I don't think so.
AFAIK this has always been Apple's policy. All they did was update the posting slightly to show the latest leading commercial AV software. Here's the previous update from a year and a half ago. I assume it was just an update of the one previous to it. (I think you will find that it looks very familiar!)
http://web.archive.org/web/20080113164722/http://docs.info.apple.com/article.html%3Fartnum%3D4454
"Mac OS: Antivirus Utilities
Last Modified on: June 08, 2007
Article: 4454
This article describes the antivirus utilities that are available for the Mac OS.

Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one program to circumvent, thus making the whole virus writing process more difficult. Here are some of the available antivirus utilities:

Intego VirusBarrier X4
Publisher: Intego
License: commercial

Norton Anti-Virus for Macintosh (formerly SAM)
Publisher: Symantec
License: commercial

Virex
Publisher: McAfee
License: commercial

This article provides information about a non-Apple product. Apple, Inc. is not responsible for its content. Please contact the vendor for additional information.

Article 17159: "Locating Vendor Information" can help you search for a particular vendor's address and phone number. Keywords: ktech kmosx"

Re:a way to make money

[Bobfrankly1]

Real virus writers are more concerned with making gobs of money with as little investment as possible. Mac doesn't play into that role yet, as the aforementioned marketshare is still small by comparison.

Also, virus writers are likely to stick to Windows for the same reason many users do, they already know it. Why spend the extra time learning a new OS to infect the minority when you can target the majority in much less time? That leaves you with so much more time to spend your pilfered moneys.

Sophos

[gammygator]

I've been running Sophos on both my Macs for a year or so... Not so much because I felt I needed them... but because I come from the PC world and felt nekked without an AV program... and my work covers the license costs which made the decision a no brainer.

Interestingly enough... to date, they have only detected MS based viruses.

Re:Sophos

[gEvil (beta)]

Interestingly enough... to date, they have only detected MS based viruses.

When I ran a lab of Macs several years ago, we ran AV software on all the machines. It was mostly there to strip out the Word macro viruses that students would bring in from their home computers. I'm not aware of the software catching any viruses that could actually have done anything to the machines themselves.

Let the flame wars begin

[m0s3m8n]

Yes Apples can get malware (general term) if you are a complete dumb ass. Until self-propagating zero-interaction attacks appear, leave me alone.

I don't need a virus to affect my system

[Shivetya]

I have Quicktime.

Does a Mac AV program really do anything?

[grapes911]

Don't those AV programs mostly scan for Windows viruses on the Mac so you don't pass around those viruses to Windows users?

Re:Does a Mac AV program really do anything?

[FictionPimp]

That is what I always thought, in fact looking at clamXav it appears to only scan for windows viruses.

Old document

[Anonymous Coward]

This story is just wrong. That document is several years old. Apple advises to install security software since years. They just added new names for recommended software products and therefore updated the issue date on the document.

Re:Multiple antivirus products?

[Geoffrey.landis]

Not multiple antivirus products on the same machine!

Having multiple products deployed mean that the virus programmers have different applications to circumvent. But that's multiple products on different machines-- you wouldn't expect one user to run all of the anti virus products on one machine.

a necessity

[Anonymous Coward]

Well, duh... With the Apple CEO engaging in the unhygienic practice of peeing on all the hardware before it ships, no wonder users are being advised to get some sort of protection against pathogens.

Or was that the Mapple CEO... meh, they probably all do it.

Makes sense in heterogenous networks

[bomanbot]

Well, aside from the fact that this Apple support document is not exactly brimming with information, using an antivirus program on a Mac makes perfect sense in a mixed environment with other operating systems.

Although your Mac may be safe from the vast majority of malware stuff circulating right now, it can still spread them around and infect for example the other Windows machines on the network (those Microsoft Office macrovirus infections are a good example).

Also, with all the nice virtualisation programs available on the Mac and BootCamp, it makes sense as a Mac user to be more aware of potential malware problems , although then the antivirus solution should be inside that environment, I think. Also those antivirus programs open up a whole other can of worms, because those antivirus companies are splendid examples of honesty and efficient programming, as we all well know :)

Re:A good sign for Apple

[Yvanhoe]

Stop this myth. It has more to do with ease of attack than market shares. There used to be (I don't know the numbers these days) more than 50% of servers on various unix. Still close to no virus there (and, I believe, none active).

1% of the market share would still make a valuable bot-net. Even 10% of this 1%. It translates into cash money. If it were easy, some people would have done it.

Re:Oh Shit

[Aphoxema]

You have strange ideas of trustworthy sources for 'facts'.

If you listen carefully...

[scubamage]

...you can hear the heads of a million fanboys going poof!

Re:Herd Immunity

[maztuhblastah]

The only reason macs have been able to get away with claiming such great security records (statistically) is herd immunity.

Indeed. Just look at Linux. It had a great security record up until the start of this decade. Then, once it gained a lot of popularity on servers, we started to see millions of infected Linux servers, linked together in botn...

Oh. Well damn. It seems that despite being the near ideal target for virus-writers (always on, very fast links, powerful hardware), the most popular server platform on earth doesn't have a major virus problem. Huh. Maybe an OSs security record isn't directly linked to its popularity...

Um huh? Apple has always recommended protection

[falcon5768]

Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.

Re:Um huh? Apple has always recommended protection

[Golias]

Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.

Very true.

And I've been ignoring the recommendation for years now. Guess which AV app I'm going to install today.

That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

Re:A good sign for Apple

[elrous0]

Very few virus writers target servers, Unix or otherwise, because they're generally not admined by some grandma in Albany who will open an exe file sent to her by a stranger with the subject heading "I love you."

Re:Admin user

[SuiteSisterMary]

Well, that's the issue. You've been able to write software for Windows that allows for non-admin since 1999. My Documents, no user files in Program Files, non-admin logins, the whole nine yards.

But, of course, developers are lazy. They don't want to write proper software.

Can Microsoft force it? Of course. They tried it with Vista and UAC; pop up a little 'fuck you' every time a program does something the Windows 95 paradigm. And they got raked over the coals for it.

Windows security model

[alexhmit01]

The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

No, the Windows problem was that to migrate from DOS + Windows shell to Windows NT, was a slow, painful 10 year process with LOTS of growing pains. Windows 4.x series (Win95, Win98, WinME) were supposed to be a singular OS before the transition to NT, and was created because the uptick to NT 3.51 was low because of the RAM requirements. The original plan was 3.1 for home users, NT 3.1 for "Workstations," and Win32s was released to let people target both OSes.

As we moved through Win 3.11 w/ Win32s -> Win95 -> Win98 -> WinME, the NT systems grew in popularity. Lack of advanced DirectX support prevented NT 4.0's being the transition, Win2K was close but price kept it out, and WinXP finally merged the OSes. By that point, it'd been 8 years or so since the first 32-bit programs came out. The ones targeted mass market, originally Win32s, and later Win95/NT4 libraries, were generally assuming the consumer version. On the consumer Windows, there WAS NO SECURITY model, so it was common for applications to assume lots of access. This meant that while NT 4.0/Win2K gained market share and had the security model from the NT system, the security wasn't used and users had full access to the drive, because the alternative was broken software.

To not break applications from 1995 - 1998, in the early 2000s we were still shipping OSes with most of the system being world writable.

So while Windows possessed a security model that could work, in practice, it was never implemented, because it required locking down the system on each system, so instead of protecting OS directories, we used the "bolt on" security like Group Policies, etc., to prevent users from doing things. I worked with a bunch of Citrix systems in the late 90s, and we were able to lock down those machines, because you were only talking about locking down a single machine or two, and the defaults were more reasonable. There was PLENTY of software that wouldn't run under Winframe 1.x/2.x gold (2.0 never shipped, Microsoft pulled the license, then bought it to ship Terminal Server and Citrix moved the addons into Metaframe), not because it required the NT 4/Win95 libraries (we could always confirm that using 2.0 Gold that was NT 4 based), but because it made assumptions about access that was reasonable for Win 3.11/Win95, but not NT based OSes. Citrix, targeting big budget Enterprises could get away with that, Microsoft reaching the entire market could not.

I assume that this has been fixed in Vista, but I haven't used it, I switched to Mac OS X in the mean time.

I've got to call cough! *bullshit* cough!

[gordguide]

Apple has NEVER not recommended users install AntiVirus software. One of the first benefits of subscribing to Apple's DotMac web service, a service that is roughly as old as the first Gold Master release of OSX itself, was a complimentary copy of AntiVirus software (McAfee Virex 7.0, released September 2001).

The offer only applies to v7x; which no longer compatible with the latest OSX version, which probably goes a much longer way to explain why Apple is now recommending users install their own choice of a competitive application.

The most recent ad campaign, which does mention vulnerabilities to various malware on Windows machines, comes after more than two decades of people clamoring for Apple to do just that in it's marketing and sales literature. Rather than all of a sudden "quietly" recommending AV software, Apple has always (quietly) recommended it.

The (very lightweight) BBC article comes across as written by someone who only recently started paying attention to Apple, perhaps after her dad bought her an iPod in Journalism school.