Zombie Macs Launch DoS Attack

Cludge writes "ZDNet has a story (and several related articles) about how Symantec has discovered evidence of an all-Mac based botnet that is actively involved in a DOS attack. Apparently, security on the exploited Macs (call them iBots?) was compromised when unwary users bit-torrented pirated copies of iWork 09 and Photoshop CS4 that contained malware. From the article: 'They describe this as the "first real attempt to create a Mac botnet" and note that the zombie Macs are already being used for nefarious purposes.'"

Comments

Are you sure...

[tacarat]

... that somebody didn't do it the old fashion way and post that the website host said bad things about Steve Jobs?

Re:Are you sure...

[imamac]

The really funny part is that you could download the full version from Apple for free as the "demo" just needs a serial number.

Re:Are you sure...

[tacarat]

But getting it off a torrent makes you a l337 ninja haxor.

Re:Are you sure...

[kirillian]

In this case, I think it makes you l337 ninja hoxor-ed.

Re:Are you sure...

[Dreadneck]

1337 Ninja Haxor vs. Pwnzilla

Sigh

[Presto Vivace]

the end of innocence for Apple users.

Re:Sigh

[telchine]

I can almost hear the words of denial from the Mac Fanboys already. I can't hear the exact words, but I can sense the general whine.

Like any other UNIX OS, OSX is less vulnerable to such attacks than Windows, but it's far from immune. The truth is that a Mac is less likely to be targetted because it's a minority operating system.

If your intention is to create a large botnet, you are of course going to target the most popular operating system. Rightly, or wrongly, by most metrics, Windows is the most popular OS. That's why people rarely bother try to create a botnet from macs.

I suspect that this botnet has been created by a geek that is sick to death of uneducated Mac fanboyism, and in a small way, I have respect for that.

A small part of me wants OSX to become a majority OS, just so I can see Mac fanboys eat their own words!

OSX is a reasonable operating system whose reputation is ruined by technologically uneducated users :(

Re:Sigh

[l0ungeb0y]

What the hell are you talking about?

Malware ie: trojans have been around for ages. This has nothing to do with the overall security of the OS and everything with the security threat the user is to themselves.

Re:Sigh

[nysus]

Technologically uneducated users? Can you explain to me how, at the last developer's conference I attended for an open source CMS, Apple users outnumbered IBM clone users by probably 3 or 4 to 1?

People who speak in generalities and think only in generalities. Problem is, that's not how the world works.

Re:Sigh

[Anonymous Coward]

People who speak in generalities and think only in generalities. Problem is, that's not how the world works.

It does work that way, in general.

Re:Sigh

[Anonymous Coward]

the end of innocence for Apple users.

Young whippersnappers don't know their history. Back in the day (1980s/early 1990s), macs were FAR more vulnerable to viruses than PCs.

Why? The primary mode of transmission was infected floppy disks. On a PC, you could open the floppy drive and take out the floppy whenever YOU want - just push the (physical) eject button. On macs, the eject function was under software control, and you would get your floppy whenever your mac was willing to give it to you. Mac viruses would delay the eject until they had fully infected the floppy.

Re:Sigh

[coryking]

Like any other UNIX OS, OSX is less vulnerable to such attacks than Windows

This is simply unproven for all the reasons outlined in your post. Until you see *UNIX widely deployed as a "desktop" OS, all claims that UNIX is inherently more secure than Windows are nothing but untested theories.

Wake me up when *UNIX has 50% of the desktops and then we can debate which operating system is more secure.

Re:Sigh

[Chabil Ha']

If your intention is to create a large botnet, you are of course going to target the most popular operating system.

Not exactly. You're going to target the lowest hanging fruit. Which (no pun intended) is steadily becoming an Apple.

Re:Sigh

[Drakino]

Why only desktops? Unix servers have sat on the internet open to the world since well before Windows even had a TCP/IP stack built in. And there are still plenty of them out there sitting on very fat pipes just ripe for bot nets. So why is it that Windows has had far more security hardships then any Unix based OS?

It's not just market share that plays a factor. There have been plenty of exploits for IIS, MSSQL and Windows Server even though those products don't command a 50% market share.

Re:Sigh

[coryking]

Culture. Windows grew up on the desktop and moved into the server. Unix grew up on the server and is trying to make inroads on the desktop. "Normal users" will force unix systems to compromise some of their security to make life easier. Windows has had to compromise by removing the "everybody is an admin--free love for all" that existed all the way up to XP. By default, Vista users aren't running as root and the only way to become root is either a UAC dialog or a privilege escalation exploit.

That doesn't account for the server-end though. And why earlier versions of said products had so many holes I will attribute to culture.

Of course, Linux grew out of a culture that detested any kind of authority. Thus you find gems like this in early Linux documentation:

Why GNU su does not support the wheel group (by Richard Stallman)
Sometimes a few of the users try to hold total power over all the rest. For example, in 1984, a few users at the MIT AI lab decided to seize power by changing the operator password on the Twenex system and keep- ing it secret from everyone else. (I was able to thwart this coup and give power back to the users by patching the kernel, but I wouldn't know how to do that in Unix.)

However, occasionally the rulers do tell someone. Under the usual su mechanism, once someone learns the root password who sympathizes with the ordinary users, he can tell the rest. The "wheel group" feature would make this impossible, and thus cement the power of the rulers.

I'm on the side of the masses, not that of the rulers. If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first.

Re:Sigh

[Comatose51]

While what you say it's true, taken in the context of Slashdot, it's a double standard. Whenever a trojan hits Windows, people are talking about how poorly designed Windows security is and how the user usually always runs as "administrator". People bring up how on Ubuntu and OS X, you have to sudo or login to do administrative things. Apparently that only works to a certain extend. I use and love my Macbook Pro but let's have some fairness here (not specifically you but Slashdot in general).

Re:Sigh

[Ifni]

I'm just guessing, but I think when he said "Technologically Uneducated Users" he was talking about Mac users, not developers. You might have missed the last 25 years where Macs claim to be more user friendly and cater to a less technologically inclined user-base, lending significant support to his suggestion. In short, not all Mac users fit that profile, but the ones that do are contributing to the negative image that OSX and Macs in general enjoy among a significant portion of the populace. Think "AOL", except replace the service itself with something worthwhile, and decrease the percentage of "Technologically Uninclined/Uneducated" users in the user-base from >99% down to about 80% or less.

More importantly, however, I think that he was implying that the users that claim that Macs are completely impervious to malware and that therefore Mac users need not take any precautions against infection are making the Mac community, and by extension the Mac OS, a laughing stock of the computer technology community. In short, the OS is technologically impressive in many ways, but a vocal portion of the users frequently make claims about it that are factually impossible and socially irresponsible. Not that this is exclusive to Mac, just better advertised and frequently sanctioned by the manufacturer.

Re:Sigh

[DanMelks]

Well, the first Troy was established approximately 3000 BCE so one might expect that trojans have been around for 5000 years. Even then people knew not to eat bad apples.

Re:Sigh

[gringofrijolero]

Ever heard of Disinfectant?

Re:Sigh

[brackishboy]

I AM black, you insensitive pot!

Re:Sigh

[Fluffeh]

Until you see *UNIX widely deployed as a "desktop" OS, all claims that UNIX is inherently more secure than Windows are nothing but untested theories.

Dammit, I was going to utterly avoid these threads, but here goes anyhow.

Your statement is totally incorrect. Any OS may in fact be much safer than the others without being as widely distributed. It's not fair to claim that only xx,xxx PC's with xyxyxyxyx OS were infect this year as compared to xx,xxx,xxx,xxx with Windows. It is CERTAINLY valid to say that y% of PC's with xyxyxyxyx OS were infected compared to xx% with Windows.

Windows does make itself a bigger target by having a larger user base, and it's also likely a bigger target as many of the users of Windows are much less likely to know what to do to secure their OS compared to someone who chose to install a Unix based OS for example.

So either start using your head as was intended, to think and to use logic, or happily pop it back in the sand like a good ostrich.

Re:Sigh

[ianezz]

Whenever a trojan hits Windows, people are talking about how poorly designed Windows security is and how the user usually always runs as "administrator". People bring up how on Ubuntu and OS X, you have to sudo or login to do administrative things. Apparently that only works to a certain extend

Well, I'd say there is a difference between a software package that is a trojan from the very start and one that, by running with administrative privileges all the time, can also be exploited later at runtime into installing malware on your system.

There's a lot less software on Unix systems that requires to be run with admin privileges all the time. Call it bad practice on third-party Windows software developers (by often ignoring the principle of the least privilege), but it's not that the system really encourages developers in dropping privileges.

Re:Sigh

[fractoid]

By your argument, Vista is more secure because it's such a PITA installing things on it. ;) But yeah, social engineering is generally the easiest vector of attack these days, since humans are by far the weakest link in any secure system.

That's one reason I love the new Die Hard movie - other movies have the whiz kid "hack the network" using a subnotebook running Movie OS with a big "hack it NAOW" button. In this one he triggers the car's emergency phone and bullshits the lady who answers into remotely starting the car... a perfect example of how you WOULD do it.

Re:Sigh

[m.ducharme]

I think that "IBM clone" pretty much a meaningless term, these days, don't you? Especially since Macs have switched from PowerPC (actually made by IBM, as I'm sure you know) to Intel (whose chips no longer bear much resemblance to the IBM chips of the past). Hell, Macs don't even use BIOS's anymore. Hell, IBM doesn't even make desktop pc's anymore. Anyway, sorry, this is way too persnickety, but these mac/pc/secure/insecure flamewars get my hackles up.

Re:Sigh

[fractoid]

The same could be applied to Windows users. In general, by their purchase, they've proven that they're willing to spend small amounts of cash to make themselves feel like they're different or better than Linux users.

In my experience it tends to be the other way around; historically Linux users have spent more time to make themselves feel better or different than Mac *and* Windows users. This is changing fast, though - I run Linux at home simply because it's cheaper and easier than Windows.

The same can be said about OS X vs Windows. Whether that functionality matters to you is a different matter -- like I said, I use Gimp -- but to pretend that Windows (or even Linux) is always just as good as OS X is just as ignorant as claiming that Gimp is always just as good as Photoshop.

Agreed. By the same token, though, you can't claim that OS X is 'always just as good' as either Linux or Windows. Different tools for different jobs. And more to the point - most Apple users (and I use the term 'most' in the sense of 'all but one of the Apple users that I know') don't need Photoshop, or even MS Paint. They buy Macs purely because they're so desperate to differentiate themselves that they'll spend any amount (the more the better, making Macs an example of a Veblen good).

I suspect that's why you're at home coding, rather than at work coding.

Communication is at least as important, even as necessary, as "actually coding", for anything beyond a one-man project.

Actually, I'm at work trolling /., because it's more fun than the busywork I have left for this week. If real, useful communication that's what actually ends up taking place at these conferences (rather than just a lot of grant-money-funded boozing, as happened at the only one I attended) then that's awesome. But unless this was literally a 'team meeting' for all the contributors, I can't see it being quite that important. And I still maintain that people who spend more on their computers as a form of conspicuous consumption are more likely to spend more on attending conferences (and again this isn't all Apple users, just the annoying ones).

[...] Then I got into the real world.

HTML/CSS has a few messy implementations, but it's a fine technology in its own right. Javascript is an excellent language. And communication is as important as code -- indeed, I would cite communication skills above coding skills on my resume.

I went through a similar learning curve when I left university - it was a shock to realise that not only was my boss telling me that it doesn't MATTER how batfuck ugly the code is, if it does what the customer wants and the customer is happy, then that's fine... but that he was right. Aesthetics and clean implementation are for us, the engineers, not something that matters a jot for the end user as long as it fills their needs. The communication you're espousing is the only way to actually achieve that.

Now, frankly, you are just a troll, and probably not worth all that effort. But I see a bit of myself in you. Maybe you'll learn something today. Maybe someone else will.

Well, hopefully my reply justifies your effort somewhat. All my (admittedly somewhat trollish) post was aiming at was that people who buy Macs to try and make themselves feel special are the same kind of people that would go to a conference for the same reason, so their presence at a conference doesn't automatically imply tech savviness.

Re:Sigh

[userlame]

Yup. In fact, I was sure I had seen this before, right here on slashdot. I was right.

Re:Sigh

[bsDaemon]

You totally left out the best, most susinct part:

This program does not support a "wheel group" that restricts who can su to super-user accounts, because that can help fascist system administrators hold unwarranted power over other users.

... I bet RMS loves RATM. Seriously... what the hell kind of crap is that to put into system documentation, and then wonder why the rest of the world has a /very/ hard time taking you seriously?

A matter of time

[Fwipp]

I always wondered when those pirated copies of software would be become malware vectors. Maybe the quickest way to stop software piracy is through evil copies of legitimate software.

Re:A matter of time

[despisethesun]

Virus infected warez have been a fixture of the PC world for well over a decade now, if not longer, and it hasn't really made a dent in piracy.

Re:A matter of time

[aliquis]

Maybe the quickest way to stop software piracy is through evil copies of legitimate software.

Microsoft already tried this and now their OS run/gets copied on more machines when ever!

Re:A matter of time

[Savage-Rabbit]

In my experience, it's less common for them to pass a virus in an actual software installer; instead, they slip it into the corresponding keygen. By the time someone has spent an hour installing Photoshop, they usually don't think twice about double-clicking a little keygen.

Wait, did I say that out loud?

Which is why most smart TPB users run the keygens in a virtual Windows instance they keep around just for the occasion. I know viruses, trojans and other malware has been a feature of the Warez scene almost since the beginning but I find it strange if it is true that actually integrating malware into installation packages is something botnet constructors rarely. By the time you have been so clever as to take all that trouble to set up a VM to run you keygen do you think twice about the malware being integrated into the Photoshop installer? I'm sure some security expert can explain why this is a dumb way to spread your malware but at first glance it seems like a pretty obvious way of spreading malware to me.

it just...

[BloodyIron]

it just... BBRRRAAAIINNNNSSS

I'm on a Mac

[russlar]

I use Mac, and I love it! Macs never get vi

NO CARRIER

Re:I'm on a Mac

[Fwipp]

Hey, I happen to like vi, you insensitive clod!

But the iZombies have ....

[140Mandak262Jamuna]

But these iZombies have such cool eye-candy the Windoze and Linux could never catch up in the cool factor in a million years!

Hey, what a surprise

[Reality Master 201]

If a user is tricked into installing malware on a machine, the machine is infected with malware.

It's a shame people think Macs are somehow magically protected against viruses and other nasty computer stuff, merely by virtue of the manufacturer and operating system. It's probably more of a shame that Apple has, in the past at least, marketed Macs as being (more?) immune to viruses than PCs - something which somewhat true, but only for statistical reasons.

It's like STDs - if you're careless and go sticking your junk everywhere without taking precautions, you'll probably catch something cruel, eventually.

Re:Hey, what a surprise

[Anonymous Coward]

Correct me if I'm wrong, but a trojan doesn't qualify as a "security issue" on the part of the OS. If a trojan succeeds in compromising the system, it's the fault of the user, not the OS.

Re:Hey, what a surprise

[Zen Programmer]

It's like STDs - if you're careless and go sticking your junk everywhere without taking precautions, you'll probably catch something cruel, eventually.

That's why I run Linux. Running Linux pretty much rules out any possibility of having sex, and hence any chance of contracting an STD.

Re:Hey, what a surprise

[neoform]

I'd tend to agree that mac's are protected against viruses, provided they don't download pirated software that contains viruses.

Also, like all linux distros, in order to do any real damage on a mac, you need to enter an admin password.. simply opening a virus infected app wont do it.

Re:Hey, what a surprise

[Burdell]

Also, like all linux distros, in order to do any real damage on a mac, you need to enter an admin password

Please stop repeating this fallacy! First, on a single-user system (e.g. the vast majority of home computers), the end user has rights to all the interesting data files (songs, pictures, documents, etc.), so anything running as the user can do significant local damage. Sure, the OS and apps may be protected, but that isn't really what the end user cares about (since that's all easily replaced). However, since the goal of most viruses/worms/trojans is to control the computer for distributed and untraceable nefarious purposes (and not have the owner notice), they don't do that anymore. They cause the computer to join botnets, connect to master control servers, and wait for instructions. Sending spam, scanning other systems for vulnerabilities, hosting fast-flux phishing sites, etc. don't require elevated privilege.

Re:Hey, what a surprise

[shird]

Yes that's correct - by definition a trojan is malicious software disguised as legitimate software. But what's your point? Who said there was a "security issue" with Mac?

90% of the problems on Windows are attributed to users installing malicious software. This is what Mac users go about claiming they are immune to, which is ridiculous.

Claiming to be immune to trojans is like claiming your OS is incapable of running software that can send an e-mail, afterall, that is all some trojans do (ie spam bots).

Re:Hey, what a surprise

[Graff]

It doesn't imply that Macs are immune, it flat-out says that there aren't any viruses out for Macs and this is completely true. The ad truthfully states there are a ton of viruses for Windows and none for the Mac.

Is there malware out for the Mac? Sure there is, there's always been malware for the Mac in some form or another, but so far there is nothing that can be installed without the user's cooperation. User-installed malware is called a trojan horse, remote-installed malware is called a virus. If the ad claimed there is no malware for the Mac then I'd definitely agree that Apple is making false claims.

There are idiots on all platforms that will blindly install malware and you really can't point a finger at any operating system manufacturer. People have to be able to install software that does useful things like connect to the internet and that means that they will also be able to install malware. What's important is that the operating system provide as much protection from remote attacks and make it easy to recover from a malware infection.

Um

[Card]

So does this mean that Macs are finally Enterprise Ready?

Re:May I be the first to laugh

[jamie]

From what we know so far, apparently the botnet was created by a trojan and does not spread.

I'm a Mac user who doesn't run applications downloaded from completely untrustworthy sources like pirate p2p networks and you're correct -- I don't need a virus or malware checker.

Somebody cue up the Mac commercial...

[joocemann]

Mac: Hi, I'm a mac!
PC: Im a.. *cough* PC...
Mac: Oh, you must be sick? Well I can't get sick.
PC: really?
Mac: (whispers) "Nobody knows I got HIV"
PC: Ahhhh... I just got a cold
Mac: See! I don't even have a cold!

Linux.

[RichardJenkins]

The obvious solution is to switch to Linux, because everyone knows it has no viruses and never will.

I SAID NEVER WILL.

Re:Linux.

[LWATCDR]

Except this isn't a Virus. It is a Trojan.
Any OS can be infected with a Trojan even Linux.
I find it anoying that under Linux most software really expects to be installed as root.
Maybe there needs to be a new level called app for applications but then you have to problem of libraries.

Re:FUD

[Mashiki]

Sounds like someone has their panties in a twist. You might forget that strict permission levels don't imply security when the person behind the keyboard is an idiot.

Re:May I be the first to laugh

[Anonymous Coward]

Man, I run Vista and I don't have any of that (built-ins are disabled). I only have virus scanning done on a weekly basis, and somehow despite not having forty pieces of software dedicated to second-guessing me I still don't have any viruses or malware.

Simplest thing anyone can do is train the thing between the chair and the keyboard.

I've got your denial right here.

[earnest murderer]

Purposefully installing malicious software does not indicate a vulnerability. The user intentionally installed a piece of software that is doing exactly what it is designed to do.

There isn't an operating system on the planet that can protect you (or itself) from fraudulent user activity.

Re:I've got your denial right here.

[SpitfireSMS]

They didnt purposefully install the malicious software
That would be like saying IE is safe, and its the users fault for purposefully clicking the "Install ActiveX" button that happened to install malware.

If the operating system was as safe as the crazy fanboys claim, it wouldnt have been able to install malware in the first place.

Not that im claiming that *any* OS is safer than any other, im justing saying OSX did NOT protect the user.

Re:I've got your denial right here.

[shentino]

Unless you consider TPM to be an operating system implemented in hardware...

But...

"anyone who trades X for security deserves neither, and shall lose both".

Education is the only way to resolve this, really. But find me a user who is patient enough not to veto such an education with his wallet.

The company that caters to the user's whims the best wins, and to hell with wisdom with a slow but steady ROI.

Re:I've got your denial right here.

[__aarzwb9394]

i have a mac and i think this is embarassing denialism...... people did not purposefully install malware. No one says, "I know! I'll install some malware to make my computer a zombie." They installed a downloaded copy of an application and it had malware hidden in it. That malware was able to run on their computer without their knowledge. This is not a very different vector from most windows malware. Telchine is right; macs are not invulnerable, they are less vulnerable than windows.

Re:I've got your denial right here.

[xav_jones]

Mod parent up. No OS can protect you from deliberately installing malware. Getting your software from an untrusted source and then giving that software install and admin rights on your machine is not a sign of a defective OS. Just a defective user.

Re:I've got your denial right here.

[Anonymous Coward]

Which is exactly how most Windows users get infected with malware, as well.

Re:I've got your denial right here.

[HTH NE1]

Does your operating system phone home to the maker of every installer (independently of where the untrusted installer says to phone home) to check that it is indeed what it purports to be?

If so, then that's not a computer, that's a videogame console whose manufacturer has a stranglehold over what software you're permitted to run on it.

Re:I've got your denial right here.

[HTH NE1]

To summarize: PEBKAC (Problem Exists Between Keyboard And Chair).

Though I'm sure some would rather update that to be PEBMAC (...Mouse And Chair).

Re:I've got your denial right here.

[earnest murderer]

They totally intentionally installed the software. You can't make a machine Malware proof without also making it software proof.

The whole notion of "Malicious Software" is a marketing creation for the sole purpose of making money off people who would rather spend money on software to watch their back than learn (bother) to help themselves.

Anyone who tells you different is confusing the issue. OS X has plenty of problems, this isn't one of them.

Re:I've got your denial right here.

[donny77]

Not really fair. ActiveX got it's bad reputation from 8 years ago when the user DIDN'T hit install. Or did you forget your Windows experience pre XP SP2. ActiveX was most definitely a vulnerability.

Re:I've got your denial right here.

[filthpickle]

I always heard that as PICNIC (Problem In Chair Not In Computer).

Re:I've got your denial right here.

[Sancho]

That post also included:

If the operating system was as safe as the crazy fanboys claim, it wouldnt have been able to install malware in the first place.

Which is disingenuous.

Furthermore, the activex part is true only if the user did, in fact, allow them. IE has had many, many vulnerabilities which allowed a malicious site to install ActiveX controls without user intervention (just like Safari has had remote execution flaws which allowed it to be compromised.)

Re:I've got your denial right here.

[scdeimos]

Regardless of what operating system you're on, there's this little feature called code signing.

If Apple actually signed everything they make, including the Setup/Installer packages, and drummed just that one little piece of security into their users then this type of malware-embedded-in-Apple-software attack just wouldn't be possible.

Re:I've got your denial right here.

[timmarhy]

no, that's what antivirus does, but because mac users are such nobs they believe they are virus proof they don't all run antivirus. checkmate.

Re:I've got your denial right here.

[fractoid]

"anyone who trades X for security deserves neither, and shall lose both".

You're talking about the X Window System here, right?

Re:I've got your denial right here.

[Anonymous Coward]

Your reasoning is very flawed. The user downloaded the software and when the malware asked them for a password they gave it and boom.

No OS can protect you from that except not to give the owner "admin" rights at all. I don't see that happening, at all.

Re:I've got your denial right here.

[RiotingPacifist]

what about one that warns you when "photoshop" starts accessing the internet or schedules itself to start regularly, the tech is already there in UAC,apparmour,SELINUX,etc. Sure when many programs insist on updating themselves it gets more complicated, but surely pirates aren't going to want thier photoshop phoning home anyway.

Re:I've got your denial right here.

[BitZtream]

So wait, let me get this straight ... You think that if a user installs an ActiveX, and clicks through the three or four warnings and clicks it takes to get it installed, that the OS is the problem? Please tell me thats not the case, cause if it is, you are an idiot.

The are only two choices here:
1) Let people install software from wherever they want, just like most OSes do it.

2) Only let users install apps approved by the OS vendor, like the iPhone.

So in case 1, the OS is the problem because the user did something stupid even after several warnings.

And in 2, the vender is a complete and total prick who you hate because you can't install any random shitty app that creates the situation in #1.

You know, either way, you're still an idiot.

What OS do you know of that the user can't install malware in? Linux? Nope, can install malware there too.

Get a clue.

Re:I've got your denial right here.

[Kjella]

They didnt purposefully install the malicious software. That would be like saying IE is safe, and its the users fault for purposefully clicking the "Install ActiveX" button that happened to install malware. If the operating system was as safe as the crazy fanboys claim, it wouldnt have been able to install malware in the first place.

No, because in most cases that means the ActiveX applet exceeded the security permissions it was given through some exploit. Whether it's an ActiveX sandbox, Java applet, a privilege escalation exploit, circumventing file system/SELinux permissions and so on isn't really relevant, that's not the user's fault. If they run without permission by playing a video/music file, opening a document with macros, looking at the mail in Outlook and so on, that's not the user's fault. But imagine the two following situations:

a) I recieve a malware script/executable that'll trash my documents
b) I write a script/executable to manipulate my documents
c) I send the script/executable in b) to myself ona different machine

By what logic would you like the operating system to work? "I can't let you do that, Dave. It might destroy your documents"? They're both the same as far as the computer knows. They run with the permission I give them and manipulate only files they're allowed to. Where I got them doesn't really matter, as long as I command them to run. Take a gun analogy - if the gun backfired and hurt you or if it started shooting without pulling the trigger, you could blame the gun. But if you point the gun at your own foot and pull the trigger, don't blame the gun for hitting you.

Re:I've got your denial right here.

[Achromatic1978]

Wanna know the ultimate irony?

My UA: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.0.8) Gecko/2009032608 Firefox/3.0.8

And yet I'll still get called a hater...

Re:I've got your denial right here.

[roman_mir]

the moderators are so out for lunch on the parent post... The software that was installed by the users on Macs here didn't even have a 'virus'. Virus is something that will propagate itself from file to file, will inject itself into memory, into executable files, what we have here is a one off modification to the downloaded software, which did 2 things: broke the user protection to prevent get full features out of demo versions of the software AND it was changed to become part of the DoS attack. So in this case the only way to make sure that the software is not affected is not an 'antivirus' program, because if an antivirus simply compared the original hash or even the entire byte signature of the installed software to the official release, it would have marked the file as corrupt (possibly infected). But this is the point - the file is corrupt and the user knows it. The file is corrupt to brake usage protection of the demo.

Antivirus would be of no use to these particular Mac users, they already know they have something illegitimate on their machines, they just didn't know it had a few more 'features'.

Re:May I be the first to laugh

[Whiney Mac Fanboy]

I'm a user who doesn't run applications downloaded from completely untrustworthy sources like pirate p2p networks and you're correct -- I don't need a virus or malware checker.

Fixed that for you.

Re:FUD

[tacarat]

Essentially, this makes it impervious to viruses. Even trojans are thwarted because smart users (Mac users) don't execute programs they don't know the origin of.

No computer system can withstand prolonged exposure to idiot owners. Macs are no exception. Your statement only confirms that :D

iZombies

[mc1138]

A botnet that just works.

Re:iZombies

[WiseWeasel]

Attack Different.

Re:May I be the first to laugh

[MadUndergrad]

Sorry, how does conficker spread again?

Re:May I be the first to laugh

[coryking]

How would they even know what to learn in the first place?

often act as if they can't be bothered to learn

And rightfully so. If the damn thing needs that much care and feeding, it is defective and should be returned!

in other news bullet placed in gun actually fires

[ScaredOfTheMan]

Seriously? A download, installed, and password prompting program is a vulnerability?

That must mean that apple's Remote Desktop is a huge vulnerability. Giving the attacker complete control of the victims system, and the ability to execute remote code! Oh the horror! Oh the humanity!

Time to Celabrate!

[get_your_guns]

MAC users should be rejoicing around the world! What this actually means is that hackers are noticing MACs are gaining in population and and they see profit in targeting them. What's going to fall next, Rome?

Re:B-b-b-but...

[aliquis]

No exploits necessary when the user download and willingly installs the application.

Re:unlikely

[chill]

What do you expect? It had to find a black turtleneck, offer some snide, unasked for criticism of your iTunes playlist, and order a double-whip, half-caf, non-fat latte before deciding which port was cool enough to grace with its packets. It may not be very effective, but it looks FABULOOOOOOOOOOOOUS!

Instant Karma...

[shmlco]

No, the funny part is that the users who torrented and installed pirated copies of iWork 09 and Photoshop CS4 got exactly what they deserved. Instant karma.

Re:Instant Karma...

[93 Escort Wagon]

No, the funny part is that the users who torrented and installed pirated copies of iWork 09 and Photoshop CS4 got exactly what they deserved. Instant karma.

Instant karma's gonna get you - gonna knock you right on the head.

Re:Instant Karma...

[Anonymous Coward]

"They" got what they deserved? More like we, the internet public at large that has to suffer through botnet DoS attacks, got what we didn't deserve.

Re:Instant Karma...

[roman_mir]

I believe you are wrong in this case though, it's not a Mac that caught a virus, it may or may not be a virus, but it was installed onto the computer by the participating user on purpose. Except the user got a bit more functionality than he 'paid' for.

Re:Instant Karma...

[wumingzi]

Anyone who says Macs are virus-proof doesn't have a clue as to what they're talking about.

Macs ARE harder to inject viruses into because the limited privilege escalation system used by Macs (and Linux) reduces the opportunities to run processes as root.

On pre-Vista Windows boxes, most people ran their default account with godlike administrator privileges. It's either that or:

Run a restricted account
Any time you want to install software
DO:
    log out of your restricted account
    log into the admin account
    install the software
    then go back to your restricted account.
REPEAT

After doing this about 5 or six times, you get frustrated and switch the "Administrator" flag on your restricted account and thus leave yourself open to attack any time you download something (or navigate to a malware page if you're running IE).

The vector for infection for this botnet was escalating privileges to install CS 3. It only happens once, and only happens briefly, but once is all you need!

Re:Instant Karma...

[MightyYar]

This ain't a virus. This is a program, just like any other that you download and run.

Not to say that Macs are "virus-proof" - they aren't. But short of downloading pirated software and running it, there haven't been any attacks so your friends here on Slashdot are still giving you good advice.

Re:Instant Karma...

[AHuxley]

More a Trojan like device they opened (entered pw) for.
vs something that floats around the internet for any 'innocent' networked Mac to catch.

Re:Instant Karma...

[Trogre]

Fine so it's a Trojan.

Re:Instant Karma...

[couchslug]

"No, the funny part is that the users who torrented and installed pirated copies of iWork 09 and Photoshop CS4 got exactly what they deserved. Instant karma."

So if I steal (OK, "bit-for-bit copy") a car and it steers into a pedestrian through a deliberate alteration in the vehicle that I copied, that's Instant Karma.

Re:Instant Karma...

[Thantik]

You make a good point except for the fact that if I just hide malware in the installation file, neither of your tactics are secure. The user is the weakest link in most attacks.

Re:Instant Karma...

[obeythefist]

That's the same story for most Windows malware.

Re:Instant Karma...

[Anonymous Coward]

Mod this up. The strongest attack vector is the social engineering vector.

Re:Instant Karma...

[Thaelon]

Except they probably don't even realize it.

And everyone else gets to suffer for it.

Re:Instant Karma...

[arogier]

It would seem the user is especially disadvantaged if they operate under the believe they have a malware proof machine. Why operate and antivirus or download with some discretion if you have a malware proof win machine?

Re:Instant Karma...

[99BottlesOfBeerInMyF]

You make a good point except for the fact that if I just hide malware in the installation file, neither of your tactics are secure. The user is the weakest link in most attacks.

The users is a weak link in many security chains, but a hard one to exploit on a large scale. OS X and Linux do better on security partly because of market share, but largely because most malware is spread by automated worms and the fewer and more hardened services running by default on OS X and Linux machines provide a much harder target.

For trojans such as we're discussing, no OS has a good solution in place, excepting maybe SELinux or the like which is fairly limited and hard to use because it really isn't in high demand so developers don't target it.

Re:Instant Karma...

[trum4n]

Proving that mac users are just as stupid as windows users. No computer is perfect, as long as you have us Americans in front of it! We can break anything!

Re:Instant Karma...

[pyrrhonist]

Any time you want to install software
DO:
log out of your restricted account
log into the admin account
install the software
then go back to your restricted account.

There's no need to log out. You can use the "runas" command to run the installer with the proper credentials from your restricted account.

Re:Instant Karma...

[jcr]

But I thought Macs were supposed to be virus-proof?

It's not a virus, it's a trojan, and no computer is stupid-user-proof.

-jcr

Re:Instant Karma...

[TrancePhreak]

Same with the Mac, did you not pay attention to that hacking contest?

Re:Instant Karma...

[bipbop]

Macs ARE harder to inject viruses into because the limited privilege escalation system used by Macs (and Linux) reduces the opportunities to run processes as root.

You have a point, but most malware doesn't need to run as root to do its job, so really getting access at all is "game over". Protecting root doesn't mean much when root isn't the target . . .

Re:Instant Karma...

[cbiltcliffe]

The solution? Log in as admin and fix it.

Nope.

runas /user:administrator cmd

cacls <filename> /E /G Everyone:W

Re:Instant Karma...

[Voyager529]

"No, the funny part is that the users who torrented and installed pirated copies of iWork 09 and Photoshop CS4 got exactly what they deserved. Instant karma."

So if I steal (OK, "bit-for-bit copy") a car and it steers into a pedestrian through a deliberate alteration in the vehicle that I copied, that's Instant Karma.

No, if you bit-for-bit-copy a car, and that car had some kind of mechanical defect that caused you to run into a building, THAT would be instant karma.

Re:Instant Karma...

[cbiltcliffe]

It's not a virus, it's a trojan, and no computer is stupid-user-proof.

Oh yeah? I've got a busted 486 with no hard drive that won't turn on. Try getting any idiot user to infect that one!

Re:Instant Karma...

[nicolas.kassis]

You can get infected by about anything available on torrents these days. PDF, Pictures, Video, ...

Re:Instant Karma...

[LurkerXXX]

On pre-Vista Windows boxes, most people ran their default account with godlike administrator privileges. It's either that or:

Run a restricted account
Any time you want to install software
DO:
        log out of your restricted account
        log into the admin account
        install the software
        then go back to your restricted account.
REPEAT

You forgot the other option.

Any time you want to install software
DO:
        right-click
        select RUN AS administrator
        install the software

Not really much harder than typing 'sudo' before installing things.

Re:Instant Karma...

[atraintocry]

Certainly for a lot of it, but I wouldn't say most. Just from my own experience cleaning up people's PCs, a lot of it is IE-targeting drive-by malware. Obviously the number of Mac trojans like this one in the wild is much smaller than the number of similar Windows ones. That's a practical difference, not any kind of baked-in protection. You can call it security by obscurity if you want. But that situation isn't going to change for a long time, if ever.

As to whether MacOS is *theoretically* safer than Vista with UAC turned on and Firefox as default browser, I don't know. Probably not. I do enjoy not having to put up with two or three dialogs and a screen dimming every time I delete a shortcut from the start menu. If you can handle running an XP box and keeping it clean, there's your Windows solution. For people who can't be trusted to do so, as well as people who can't stand constantly being interrupted when doing mundane things like enabling Wi-Fi, there's OS X.

Re:Instant Karma...

[Mista2]

The easiest system to hack is the meatware at the desk. Want a password for a company, call their helpdesk and say you just locked yourself out. Many wont try and verify who you are. Want to steel a credit card number, ask for the number to prove you are over 18 before signing up for a "free" service or download.
(Bye bye, Mobile Me, you're not getting me with that porn website trick 8))
Most hacks in a company will eventually come from employees or someone who has legitimate access to the systems they are supposed to maintain.
We have just gone through and moved all of our servers into a firewall DMZ, and the clients can only talk to the servers they need. Multiple VLANs and subnets segregate client traffic, and most of the client VLANs won't route to each other. If you have to share it, it will be on a server 8).
I use torrents a lot, but vever for anything that would requre admin rights to install. If they've stolen someones software, why do you think they wont try and steel your computer too?

Re:Instant Karma...

[tacarat]

Not exactly. You can do no more than visit a website and have malware load and run on a PC with no intervention.

Really? So all of those multiplatform vulnerabilities for flash and adobe didn't affect Mac? You know, when it's the application rather than the OS leading to your demise?

Interesting thought, though. How well does WINE run malware?

Re:Instant Karma...

[TheLink]

Oh yeah? All they have to do is sneeze on it...

And voila, a virus laden PC ready to infect the unsuspecting.

Re:Instant Karma...

[dakameleon]

... and no-one said Macs were trojan-proof, nor even virus-proof - just that there's a lot less attack vectors than Windows, and a lot less attackers.

Any system is going to be vulnerable to maliciously crafted & targeted code that is willingly (if unwittingly) run by the user.

Re:Instant Karma...

[rmav]

The solution? Log in as admin and fix it.

Nope.

runas /user:administrator cmd

cacls <filename> /E /G Everyone:W

Now you see why the average windows user just runs as administrator.

Under OS X, you just type username and password of an administrator upon installation (and that only of SOME applications - you can install most of them just locally) and there is no file permission problem as you are running the application as a non-admin user.

Roberto

Re:Instant Karma...

[Corporate Troll]

You haven't tried hard enough. I've been running XP Pro for years using a Limited User account and rarely logging into Admin.

The trick is to do torough testing after installing applications. If something goes wrong, give RW access on the folder of the application. Fixes 98% of all applications. If that isn't enough, give it RW to its registry subtree. That fixes 1% of the other applications. You could really be unlucky and fall into one of the remaining 1% of applications, but up until now I only found one and it was a computer game. It does, however, work with RunAs.

Re:Instant Karma...

[shvytejimas]

http://www.linux.com/feature/42031
Old, but still funny. Though I'd guess the compatibility must have improved a lot since then. It'd be interesting to do a run with some modern ones.

Re:Instant Karma...

[jargon82]

Try this: http://blogs.msdn.com/aaron_margosis/archive/2004/07/24/193721.aspx This rather excellent script promotes the currently running user to admin but in a VERY interesting way. The user is given a command prompt that has admin rights. It's colored red to show the difference. Anything run from this command prompt has admin rights, but anything run anywhere else as the user does not. Any installs done from the command prompt will be run as the original user but with administrative privileges, thus preventing in 99% of cases the sort of problems you speak of.

Re:Instant Karma...

[borizz]

I don't know how many times my university's email system has been slayed because some dumb secretary put everyone in the TO field. Last time it happened, she just had a baby and a national radio station had a cutest-baby contest. She registered and emailed everyone at the university to vote for her. A lot of people pressed reply-all, bickering about the bullshit. People got pissed that they got a lot of very huge (about 2 megs of addresses alone) emails, and in turn pressed reply-all to tell people to stop pushing reply-all. Other people then went on to suggest that those people are hypocrites and thought it'd be best to use reply-all. The university ended up pulling the plug on the email system for a few hours...

Re:Instant Karma...

[Xabraxas]

... and no-one said Macs were trojan-proof, nor even virus-proof - just that there's a lot less attack vectors than Windows, and a lot less attackers.

Not according to the guy who won the Pwn2own contest.

Why Safari? Why didn't you go after IE or Safari?

It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows.

It's more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn't have anti-exploit stuff built into it.

Re:Instant Karma...

[Mendoksou]

I loved that article. My entire family is made up fo mac minions, and keep tellign me this kind of thing, despite the fact that I have never had a virus, never had to reformat except when I rebuilt the whole computer, get way more performance and paid one third as much as they did.

Here's the article, btw.

http://blogs.zdnet.com/security/?p=2941

Re:Instant Karma...

[intheshelter]

When I say Macs are better I am talking about the overall experience, and I would say that is what most users (technical and non-technical) mean when they say that. I am a technical user, but I had to waste time when I used Windows machines on administering the machine (anti-virus subscriptions or install, anti-spyware, clogged registry over time, etc.). I don't spend time on that any more. I just use the machine to do work, play, create movies, etc. and it's so well thought out, integrated, and easy to use that you just have to focus on the vision of your work, not on figuring out how to make it happen. That's a bit of an oversimplification, but that's the gist of it.

I guess my experience has been that most Mac detractors that focus simply on price or technical specs, etc. are not "getting it". I used to be that way when I used Windows for 15 years. Then, on good advice from some knowledgeable relatives, I got a Mac in '04 for a video production company I was starting, and within 2 weeks I was hooked. If someone has never used a Mac as their main machine for any time then I don't expect them to "get it" because I'm not sure I can even describe in measurable detail what is better. All I know is I enjoy my Mac more than any Windows machine I've ever bought, built, etc. and it has turned me into a blathering pro-Mac advocate (as you can obviously see). I can't remember the last time I bought any product I was so pleased with, and THAT is why Mac users are so vocal, happy about their purchase, and claim they are better.

Re:Instant Karma...

[steve_bryan]

Do you know what OS the creator of that attack uses himself? He runs OSX on a MacBook Pro. It puts a rather interesting spin on the conclusion you want to draw.

Re:Instant Karma...

[molarmass192]

Umm ... no ... it is not security through obscurity. If you want to be obscure, you don't post your source code on the internet like this:

http://developer.apple.com/opensource/index.html

When you post your sources, you practice security through peer review. The ones who do security through obscurity are the guys up in Redmond.

Also, don't kid yourself, IE8 fell on it's first attempt too. It just so happens that Miller got the first try in the contest and who could blame him for wanting the Mac hardware over the PC hardware.

Re:May I be the first to laugh

[guyminuslife]

Witchcraft, demons, and bad karma.

Quality of posts

[Anonymous Coward]

It's a shame that the level of intelligence and knowledge of the posters to Slashdot seems to still be in decline.

I would think that anyone who wants to use this "revelation" as some kind of troll against OSX would at least be able to differentiate between a virus and a trojan.

There's a decent chance there will be some kind of unpatched OSX vuln that will be exploited ala what you see on a Windows machine, but until then you should just stew in silence and wait for your opportunity to post your "See OSX is no better than Windows" messages and then you wont look like such ignorant fools.

If you can install software on a computer, you can install software that is malware as well. I doubt anyone can fault Apple for allowing end users to install software that they choose to install.

Are they any different?

[NicknamesAreStupid]

"Two things are infinite: the universe and human stupidity; and I'm not sure about the universe." Albert Einstein. "You make your choices and you take your chances," P.T. Barnum.

Re:May I be the first to laugh

[MobileTatsu-NJG]

May I be the first to laugh...

Not if you're a Linux user.

... and laugh and laugh... Oh, we're Mac users - we don't need stuff like virus and malware checkers! Now, let the explanations begin about how this is a wonderful intuitive "feature" and not a flaw.

Mac users aren't the only ones living in glass houses, here. There's something to be learned for everybody here. If Mac user humility here is your highest concern with this article then you are turning into what you despise.

...uneducated Mac fanboyism...

[Savage-Rabbit]

I suspect that this botnet has been created by a geek that is sick to death of uneducated Mac fanboyism, and in a small way, I have respect for that.

No, it wasn't. This botnet was created by a computer criminal who saw an opportunity to capitalize on people who install pirated software either because they are to clueless to know the risks or because they have deluded them selves into thinking it is riskless act. The lesson we can all learn from this is the following:

"If you download pirated software off the internet and install it on your computer you run the risk of installing along with it carefully crafted malware that your security software or whatever other precautions you are taking may not be able to protect you against."

Note that this basic lesson is true on all incarnations of Mac OS X, Windows, Linux or any other network enabled operating system you can download pirated software for.

Now please crawl back under your rock and learn to write better trolls...

It should be noted

[Orion Blastar]

that a lot of "pirated" Bit Torrent software contains malware. Not just the Windows versions, but the Mac and Linux and BSD Unix versions as well.

When you download pirated software you take a risk that it contains a trojan.

I've even seen PDF files that had HTML exploits in it that got detected by antivirus. Read the comments on most Bit Torrent web sites the users will complain that it contains a virus. You don't have to download it to test it, the people who already downloaded it will give feedback that it contains a trojan or malware.

When you download pirated software you are taking a big chance, it isn't worth it when a majority of things are infected. That is why I look towards Free and Open Source Software as alternatives to commercial products.

Re:It should be noted

[Erikderzweite]

That is very true, Free and Open Source from signed repositories is the safest way of getting software.
Besides, you must behave different if you are going to install some weird binary from the Internet (which is not the case with Windows or Mac). That will scare off the newbies and more advanced users will know of dangers anyway. So the impact from similar malware in Linux will be limited, not to mention various distributions, DE's and suchlike.

Re:It should be noted

[AnalPerfume]

This is very true, and the software itself is a double edged sword for Linux. Applications like Photoshop and Dreamweaver are not natively available for Linux although they do work for the most part with WINE. This does turn some off from making the switch to Linux, as they've gotten addicted to some of the features or the workflow in these applications. With the prices of these applications, most users on Windows and Macs WILL install pirated versions, so they are always taking the chance to get a clean, cracked version. Companies like Adobe know most of their user base is pirated versions, but they also know that professionals have no choice but to pay BIG on licenses of face HEAVY consequences. When you are the professional tool of choice, you become the most sought after, even if the user can't afford it.

Linux does have very good alternatives which work great for most people, which tend to be free in both cost and freedom. If an application is free of cost it rules out the desire to risk downloading it from anywhere other than your distro's repos or the official site of the application; after all the whole point of finding and installing cracked versions is to get something which should be paid for.....for free.

Many say they want popular applications like Photoshop and Dreamweaver ported officially to Linux, I'd rather they weren't in their current (closed and expensive) form. If they are, some Linux users will be tempted by the same goodies as Windows and Mac users. I'd much rather see the FOSS alternatives mature to a state where they rival those applications fully in features, and stay open source in the process.

iBot, same malware at an outrageous price

[Anonymous Coward]

iBot, same malware at an outrageous price

Here is the download for the fix

[fishthegeek]

Antivirus Protection

Botnet is a botnet

[Randall311]

Guys guys guys... you're missing the point. It doesn't matter if the attack was social or security based. The fact is it is a Mac based botnet. That's it. No double standard here, just reporting that a Macintosh based botnet is up to no good. The bottom line is that security is up to the user. I could go %sudo ALL=NOPASSWD: ALL in my /etc/sudoers and security goes right out the window. It's all in control of the user. People are (as a collective) just not that smart. There can never be a secure system as long as there are users of the system.

Comment removed

[account_deleted]

Comment removed based on user account deletion

re: Macs and claims of "no viruses"

[King_TJ]

As a long-time Mac (and PC) user myself, I've been known to give someone a "simplified version" of the truth, telling them "you won't have any virus or spyware problems on a Mac".

It's not that I'm some clueless user who doesn't know better. It's that I have a pretty good idea of what the individual does with and expects from their computer. Judging by that, and knowing they're not a very "technical" user to begin with, I know that practically speaking, they really aren't going to need to worry about infections on their Mac.

(So far, just about all of the trojan horses and viruses people mentioned for OS X involved downloading files of unknown origins, or running something you received in an unsolicited email. When you have a user who is already scared to open any email at all from people he/she doesn't know, they're hopefully in good shape there. They're certainly not savvy enough to fire up bittorrent and start seeking out pirated software, either.)

That won't help in this case

[baileydau]

Regardless of what operating system you're on, there's this little feature called code signing.

If Apple actually signed everything they make, including the Setup/Installer packages, and drummed just that one little piece of security into their users then this type of malware-embedded-in-Apple-software attack just wouldn't be possible.

But these people were downloading a cracked version of the software (just not entirely in the way they expected). So they would expect that this would fail a validity test.

Obviously code signing would help in the user expected that whatever they were installing was totally genuine.

Social Engineering

[MacColossus]

There is no patch for human stupidity. Just goes to show that if you do illegal file sharing you need good antivirus regardless of platform.

You're ALL missing the point

[Sir Holo]

Symantec is just trying to drum up more sales.

The more people fear their computers might be "infected," the more antivirus software they sell.

LOL zombie macs

[Hojima]

Zombie Mac: Braaaaiiiinnnssss
Mac fanboy: Joke's on you, I have none

(I'm going to mod point hell for this one)

An Ounce of Prevention

[Lord Flipper]

Why guys insist on downloading questionable things without some preventive measures in place, first, is beyond the scope of my tired head. But dumping Apple's default 5-minute "grace period" on sudo (or admin passwords, in other words) will kill third-party attempts to piggyback on any password that is being used by the legit user for privilege escalation.

In a console (Terminal):

sudo visudo

[hit return, enter password]

scroll to: #Defaults specification, hit the letter 'o' to get a new line, and type:

Defaults:ALL timestamp_timeout=0

then hit [Escape] to end the editing session, then ':w' plus [Enter] to write the file to disk, and finally ':q' plus [Enter] to quit visudo.

Done. I get tired of vi, of course, and will usually use BBEdit to open /private/etc/sudoers and enter the admin password once to 'unlock' sudoers, then scroll down and add the new default line, and save the file. Done, quicker.

A nefarious app or script can poll the system asking if there's escalation until kingdom come and it will never get an affirmative. End of story; end of file

Easy of use

[wicka]

Does the Mac botnet have a more simple and intuitive UI than comparable Windows-based botnets? My grandma is a script kiddie, this sounds like the perfect system for her.