Mac OS Update Detects, Kills MacDefender Scareware

CWmike writes "Apple released an update for Snow Leopard on Tuesday that warns users that they've downloaded fake Mac security software and scrubs already-infected machines. Chet Wisniewski, a security researcher with Sophos, confirmed that the update alerts users when they try to download any of the bogus MacDefender antivirus software. Wisniewski had not yet tested the malware cleaning functionality of the update, but was confident that it would work. 'It's reasonably trivial to remove MacDefender,' said Wisniewski. 'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.' The update, labeled 2011-003, adds a new definition to the rudimentary antivirus detection engine embedded in Mac OS X 10.6, aka Snow Leopard, and also increases the frequency with which the operating system checks for new definitions to daily."

Comments

ahhh...

[CSFFlame]

The Nuclear Option

So Mac Users should expect this?

[Flyerman]

So every virus for Macs will get killed in the next update? Very nice work for Apple if it happens that way.

'It's reasonably trivial to remove MacDefender,' said Wisniewski. 'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.'

Pity it won't always be that way, survival of the fittest applies to viruses too.

Re:So Mac Users should expect this?

[Dynedain]

So every virus for Macs will get killed in the next update? Very nice work for Apple if it happens that way.

Not really any different than Microsoft's monthly "Malicious Software Removal" update that's pushed for Windows.

Re:So Mac Users should expect this?

[Anonymous Coward]

More reason to use winodws - you get a more sophisticated malware for your money.

Re:So Mac Users should expect this?

[Nerdfest]

Not really any different than Microsoft's monthly "Malicious Software Removal" update that's pushed for Windows.

Exactly. Sad to say, but exactly.

Re:So Mac Users should expect this?

[Ixokai]

Its basically the same, yeah. Unless you happen to get stupid the day after the last update on Windows, you may not notice you've been infected for ~29 days, as opposed to like, ~1.

~1 is a lot better then ~29, isn't it?

Re:So Mac Users should expect this?

[DJRumpy]

The Mac scanner only scans for Trojans at this point (3 of them including MacDefender), not viruses. Apple has typically left virus scanning up to 3rd parties, while taking a more active role in alerting users about phishing and malware up front.

Re:So Mac Users should expect this?

[at_slashdot]

That reminds me of people who were commenting here on slashdot about the fact that it doesn't matter that the malware installs without using root access, see, it does matter.

Re:So Mac Users should expect this?

[DarkXale]

Then you missed the point. It is important for ensuring that the malware remains securely fastened to the OS, but nobody (sane) argued otherwise. But it doesn't matter if you just want the piece of malware to do its job: e.g. key-log and scan for personal information, in addition to keeping a self-updater that may eventually pull an update that does allow for the use of an escalation exploit.

Re:So Mac Users should expect this?

[ninetyninebottles]

The Mac scanner only scans for Trojans at this point (3 of them including MacDefender), not viruses. Apple has typically left virus scanning up to 3rd parties, while taking a more active role in alerting users about phishing and malware up front.

Ummm, what viruses would it be looking for? There aren't any real, in the wild Mac viruses unless you count Mac Guard, which barely qualifies and is only delivered via trojan that happens to spawn a separate app at run time.

Re:So Mac Users should expect this?

[Deathlizard]

The only thing root access gives malware authors is rootkit installation and removal hardening. They can still read and write user files, which could lead to either ID theft, or ransomware by proprietary file encryption.

Re:So Mac Users should expect this?

[TubeSteak]

That reminds me of people who were commenting here on slashdot about the fact that it doesn't matter that the malware installs without using root access, see, it does matter.

I'm not sure you understand the people who say "root doesn't matter".
Malware doesn't have to stick around very long to be profitable, it only has to spread widely.

So while, yes, root matters for the cleanup...
No, it doesn't matter when it comes to logging your keystrokes and obtaining your credit card numbers/banking info/passwords.

Either way, you've gotten screwed and the malware distributors have made some money.

Re:So Mac Users should expect this?

[Stupendoussteve]

It WASN'T that different, except now it is updating definitions. Before it was updated only through the Software Update system, just like the Malicious Software Removal Tool. Now it is more like Security Essentials, except without the behavioral detection.

Re:So Mac Users should expect this?

[ninetyninebottles]

There have been some actual viruses in the wild for Mac, but the vulnerabilities are quickly patched, effectively preventing the viruses from spreading on any up-to-date system. http://www.scmagazineus.com/second-mac-virus-in-the-wild/article/32987/ [scmagazineus.com]

Despite the misleading claims in the article you cite, according to F-Secure, "Inqtana.A has not been met in the wild and has internal counter that prevents it's operation after 24. February 2006. So it is unlikely that this variant would be a threat to Mac Users." It was an academic proof of concept, not an in the wild spreading virus and I've seen no reports of it in the wild. Sadly, people writing articles parrot terms like "in the wild" "zero day" and "virus" without understanding what the terminology actually means.

Re:So Mac Users should expect this?

[DJRumpy]

No, that was just an example (of which 4 variants of Inqtana were found). Go farther back and you'll also find reports for Mac OS Classic (ranging anywhere from 4 to 60 some odd viruses depending on your source). Contrast that to the 100,000+ that have been found for a Windows based PC over the years and the comparison takes on new meaning but it does not mean that OS X will always be invulnerable. It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

Even knowing this I still don't use a virus scanner at present as I simply don't see a need. That said I am not foolish enough to believe that it will remain Virus free indefinitely.

Re:So Mac Users should expect this?

[dgatwood]

It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

To be fair, at most of those contests, more people are trying to win the Mac than the Windows box, thus making the amount of time to breach a largely uninteresting metric when it comes to determining how secure the OS is.

A more interesting metric is how long known security bugs go unpatched. Unfortunately, accurately obtaining such metrics without a colossal leak would be impossible.

Also, there's the problem that probably at least 99% of security bugs aren't reported as security bugs, and thus tend to get buried in bug tracking systems as "app crashes in obscure use case" for years on end. My rule when writing code is simple: if it crashes, always assume it's a security bug. Not everybody is that strict, though, unfortunately, hence the reason anybody still ships Flash preinstalled....

Re:So Mac Users should expect this?

[dgatwood]

No, it doesn't matter when it comes to logging your keystrokes and obtaining your credit card numbers/banking info/passwords.

Actually, on Mac OS X, it does matter.

• If the app is written properly and uses EnableSecureEventInput while the user is entering passwords (as recommended in TN2150), then event taps won't get you passwords.
• Only processes running as root can seize keyboards as of 10.5, preventing password capture down at the device access level as well.
• Only processes running as root can load kernel extensions, preventing it at the driver level.

Thus, to my knowledge, unless you exploit a bug in the OS, it should not be possible to sniff passwords in Mac OS X unless an app is running as root.

That's not to say that it can't steal passwords in other ways—spoofing password dialogs, stealing your Safari cookie files, reading your Safari bookmarks and pretending to be Safari while it displays your bank's website, etc.—but it should not be able to capture passwords that you enter in other applications. Thus, root matters. A lot.

Re:So Mac Users should expect this?

[FiloEleven]

Pity it won't always be that way, survival of the fittest applies to viruses too.

True. Also worth noting is that some environments are more hospitable to them than others. If OS X continues to grow in market share it becomes a more alluring target for virus creators, but if the system itself is very secure then you still won't see more than a trickle. Look at the difference between Apache on Linux and IIS on Windows for example. Relative security levels play a huge role.

Re:So Mac Users should expect this?

[node 3]

So every virus for Macs will get killed in the next update? Very nice work for Apple if it happens that way.

'It's reasonably trivial to remove MacDefender,' said Wisniewski. 'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.'

Pity it won't always be that way, survival of the fittest applies to viruses too.

Actually, the way Mac OS X works, it's very difficult to construct a program that "buries" itself in the system. It's even somewhat more difficult to do than it is in Linux. On Mac OS X, every single program can be found by dropping to a bash shell. The places that get called on startup are few and easily managed.

That's not to say it's impossible or anything, but these sort of pithy responses that amount to "well, on Windows it does this, so it's only a matter of time until this happens on OS X, too" generally end up being empty claims many years later.

Re:So Mac Users should expect this?

[node 3]

First off (and I only make this point because you seem to be trying to make this distinction), there are absolutely NO viruses for Mac OS X. None.

Second, there were plenty of viruses for classic Mac OS. This, however, has absolutely nothing to do with whether Mac OS X has viruses (for the rest of this post, I'm using a more broad term for virus, to include trojans and worms, and the like).

Third, there is a small handful of malware for the Mac, including (almost exclusively) trojans. No one is claiming otherwise, not even the people you are replying to.

Fourth, in White Hat conventions, *ALL* the systems fall. They tend to fall after certain restrictions have been removed. Macs often fall first (by mere seconds) because people want to win the Mac more than they want to win the PC.

Even knowing this I still don't use a virus scanner at present as I simply don't see a need. That said I am not foolish enough to believe that it will remain Virus free indefinitely.

Who is this imaginary person you think is saying that Macs will remain "virus free indefinitely"? This last line pretty much describes every single Mac user, from those that worry the Virus Armageddon is pending, and those that think they have nothing to worry about. No one claims this is a permanent state of things, just that it's how it is now, and tomorrow is another day.

Re:So Mac Users should expect this?

[BasilBrush]

There have been some actual viruses in the wild for Mac, but the vulnerabilities are quickly patched, effectively preventing the viruses from spreading on any up-to-date system.

http://www.scmagazineus.com/second-mac-virus-in-the-wild/article/32987/

According to your link, the vulnerability was patched the year before the virus was unveiled by Sophos. And it wasn't "in the wild". That's a lot more than "quickly patched". That's Sophos creating an exploit based on a vulnerability they've only discovered because Apple fixed it.

Chance of you catching it: 0%, even at the time of that article. Chance of Sophos selling antivirus based on scare-mongering: only slightly higher.

Re:So Mac Users should expect this?

[Bert64]

Malware almost always comes out the day after the update, that way you have a one month window before anything is likely to be done about it.

Re:So Mac Users should expect this?

[Bert64]

Time to breach is even less relevant because the order of people attempting is randomised...

On the other hand, if someone finds a bug in OSX there is really only one target for the exploit, whereas with windows there are many different versions which may require modified exploit code (wildly different hardware/drivers, home/pro/ultimate/etc, different language versions)... And Linux actually takes this even further.

Re:So Mac Users should expect this?

[BasilBrush]

Go farther back and you'll also find reports for Mac OS Classic

What's that got to do with the vulnerability or invulnerability of OS X? It's a completely different OS.

It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

Spurious. For many reasons as pointed out under those /. stories. For example with the last one, OSX was declared as first to fall on day 1. Linux hadn't even been available for exploiting yet. It was timetabled to be available on day 2.

There only seems to have been two instances of malware that got into the wild. The one that was included in the torrented pirate copies of iWork 09. And last months "Mac Defender". Both trojans. Not exploiting any technical vulnerability of OSX at all. Just ordinary applications that the user has chosen to install, which have hidden malicious intent.

I don't use a virus scanner either. And actually I do think it's unlikely there will be a real virus for OS X. More trojans, of course, there's no preemptive stopping of those. But given Apple is scanning for those as standard, I still can't see the need for third party malware-scanners.

Re:So Mac Users should expect this?

[mwvdlee]

...As long as you bought the very latest version of OSX. Atleast that's what TFS claims.

Re:So Mac Users should expect this?

[macs4all]

No, that was just an example (of which 4 variants of Inqtana were found). Go farther back and you'll also find reports for Mac OS Classic

Um, MacOS ("classic") has about as much in common with OS X as OS X has in common with DOS. Therefore, any comparison of virus counts is utterly irrelevant.

Re:So Mac Users should expect this?

[macs4all]

Time to breach is even less relevant because the order of people attempting is randomised...

On the other hand, if someone finds a bug in OSX there is really only one target for the exploit, whereas with windows there are many different versions which may require modified exploit code (wildly different hardware/drivers, home/pro/ultimate/etc, different language versions)... And Linux actually takes this even further.

So, that's why there are something like 863 examples of Linux malware, (yes, I was frankly shocked, too!) to OS X's THREE?

Re:So Mac Users should expect this?

[PitaBred]

Being that it's not installed with root permissions means it's easy to remove. When it can keep you from seeing it when you're looking for it (aka, root permissions), you're hosed. It's the difference between fully installing the system again along with all your programs and such and then restoring from backup, and just possibly restoring from backup if something gets hosed. You do back up, right?

Re:So Mac Users should expect this?

[beelsebob]

If by "installs" you mean "copies to a directory you have permissions for"... Just like on linux, such software could put itself in ~/bin quite happily.

Re:So Mac Users should expect this?

[maxwell demon]

I'm just waiting for the first virus that warns when downloading the official update that it were fake and you shouldn't install it ...

Re:So Mac Users should expect this?

[beelsebob]

You're right, every single thing you download on linux doesn't have +x set already... oh wait no... it's entirely possible to ship a tar.gz with +xed things inside... You never wondered why typing ./configure didn't need you to +x it first?

Re:So Mac Users should expect this?

[CmdrPorno]

I'm just waiting for Apple to come out with Apple Security Essentials.

Re:So Mac Users should expect this?

[walternate]

Fourth, in White Hat conventions, *ALL* the systems fall. They tend to fall after certain restrictions have been removed. Macs often fall first (by mere seconds) because people want to win the Mac more than they want to win the PC.

I actually thought people meant it only as a joke when they said that, but in the context here it doesn't seem like it, so I'll bite. The winner of pwn2own takes home a 15.000 USD cash price. It makes no sense to risk that by not going after the easiest target first. (And btw. in pwn2own 2011 the Mac fell without any restrictions being removed, just from visiting a website - drive-by install with no user interaction)

Re:So Mac Users should expect this?

[riboch]

Due to copyright '*Security Essentials' will not be available, instead it will be the "Apple Security Software Store" or the ASS Store for short.

Re:So Mac Users should expect this?

[riboch]

Sorry trademark, not copyright.

Re:So Mac Users should expect this?

[dwightk]

to be fair (although it may have been different then) Sophos' scanner software on OSX is free:
http://www.sophos.com/en-us/products/free-tools.aspx

They have a premium product that includes "Antivirus, firewall, (NAC), encryption, app and device control" and they offer their virus scanner for "small businesses" but they don't try to scare individuals into upgrading to this. They don't even sell a "personal premium" edition.
http://www.sophos.com/en-us/products/free-trials.aspx

Re:So Mac Users should expect this?

[ninetyninebottles]

No, that was just an example (of which 4 variants of Inqtana were found).

Yes, it was an example, but it was an example that did not match the criteria of an "in the wild" virus for OS X. Nor do Mac Classic viruses. Seriously, what virus definition would be of any use for Apple to include? Everyone always hand waves and says there are a few, but they always turn out to be proof of concept experiments with no payload and not in the wild, or simple trojans. There is certainly some small amount of malware out there, just not really viruses, which makes it odd that someone would complain that Apple doesn't include any signatures for viruses.

...it does not mean that OS X will always be invulnerable. It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

Who claimed OS X will always be invulnerable? Just you, just now, in a strawman argument. As for OS X in hacking competitions, there don't seem to be too many of them, and while OS X has not stood up at PWN2OWN particularly well, surely even with a little knowledge of security you recognize that direct attacks by security professionals and attacks that make their way into automated malware are very, very different things.

Re:So Mac Users should expect this?

[BasilBrush]

The free home edition came out in Nov 2010. Lets face it home users were not buying. And as Apple had started including anti-malware as a feature of Snow-Leopard even less were going to.

Even free, I doubt many people are using it.

In business though they can sell, because Windows IT dept write operating standards that say that all computers must have anti-virus. Even though for OS X it's not worth the CPU cycles.

Re:So Mac Users should expect this?

[BasilBrush]

pwn2own doesn't even have Linux as a target. Safari and IE fell the same day, both to the first team given access to the computers. And in both cases, the actual attack had been developed before the event, over a period of weeks.

Given all of that saying OS X fell first means nothing. Especially in comparison to Linux which isn't even part of the competition.

Re:So Mac Users should expect this?

[macs4all]

The list includes Bliss. ./bliss --disinfect-files-please

If you count toys, you can get high numbers for anything. Like, the number of cars I had before even getting a drivers license. Sure, they were match box cars, but those are just as real as malware on a list which includes things like Bliss.

Doesn't matter. By your definition (that we don't count "toys", of which you only name one for the Linux platform, BTW), then the number for OS X is (drumroll) ONE.

One stinking serious phishing TROJAN (and zero viruses and worms) in eleven years!

I'm sorry, but by any measure whatsoever, there are less examples of in-the-wild malware on OS X than any other platform, including Linux.

But, please feel free to pull down that Linux number to even get anywhere close to the THREE (even including the OS X "toys") on OS X. I'll be here, waiting...

Re:So Mac Users should expect this?

[revscat]

MacDefender is not a virus. There are no known in-the-wild viruses for OS X.

Re:So Mac Users should expect this?

[RichM]

Ummm, what viruses would it be looking for? There aren't any real, in the wild Mac viruses unless you count Mac Guard, which barely qualifies and is only delivered via trojan that happens to spawn a separate app at run time.

Windows malware.
Say your colleague gives you .zip archive full of files that he's worked with on a Windows machine and wants you to review some of the data for whatever reason (imagine they are some kind of self-extracting Powerpoint .exe files along with the source .ppt files).
One of the files is infected, but you would have no idea until you email your company CEO the archive and infect his machine...
Most machines in workplaces will share SMB drives between Mac and Windows machines - this is a good example of why you need an AV program for every computer no matter the OS.

Re:So Mac Users should expect this?

[RichM]

Root does matter, but if I were writing Mac malware I would grab their Safari passwords then try a "sudo -i" with each one on the system.
You can bet most users will use the same password for websites as they do for their computer login.

Also, I'm not sure how feasible it would be - but it would be theoretically possible to flag a binary setuid by modifying the underlying filesystem or exploit another binary which is already set to +s.
And then, boom - root access.

Re:So Mac Users should expect this?

[scot4875]

To be fair, at most of those contests, more people are trying to win the Mac than the Windows box, thus making the amount of time to breach a largely uninteresting metric when it comes to determining how secure the OS is.

People keep saying this, despite the fact that:

- Each platform is opened up for attack one at a time, and the "time to pwn" is measured from the time it is opened up to attack.

- There is a large cash prize ($15k IIRC) on top of that Macbook. If someone were really interested in the prizes, they'd go for the easiest target in an attempt to get the cash. In this case, even if the contest *were* set up as a big "attack whatever you want" free-for-all, they *still* go after the Mac first, which would imply that it is the easiest target.

Anyway, your ignorance is showing.

--Jeremy

Re:So Mac Users should expect this?

[dwightk]

I have friends who are technophobic and are always convinced that they have "a virus". As they have no need for the extra cycles, this can be a useful security blanket for that type of user.

Re:So Mac Users should expect this?

[walternate]

Given all of that saying OS X fell first means nothing. Especially in comparison to Linux which isn't even part of the competition.

Why are then so many claiming that it was because the hackers wanted the Mac the most? (as the OP I replied too) I'm not saying you are wrong, but then the argument that they wanted the Mac the most becomes nonsensical.

Re:So Mac Users should expect this?

[BasilBrush]

Because the details of how the pwn2own competition is run is never spelt out when they run the story on slashdot. The submitters are so keen to score points against Apple they only point out that OS X fell first without specifying why. So everyone comes up with their own theories based on a void of details of what happened. In particular the fact that Linux is not even used as a target is NEVER pointed out in slashdot stories. One is just left to assume that it didn't get pwned because it is so secure.

Re:So Mac Users should expect this?

[node 3]

And actually, as it turns out, we're both wrong. I looked into pwn2own's rules for 2011. You sign up for 30 minute time slots, and you win the prize for a successful hacking, not for which order the systems go down in.

I've been going on second-hand information before, and it always made sense (I assumed it was a set of boxen all set up and whichever got hacked first one first place, and so on, which in hindsight does seem more Hollywood than reality).

Anyway, full details direct from the source: TippingPoint - Pwn2Own 2011

Re:So Mac Users should expect this?

[dgatwood]

It's the target that gets them the most press, so more people do their homework by looking for holes ahead of time.

Re:So Mac Users should expect this?

[dgatwood]

As far as I know, assuming a website creates their pages correctly, identifying the fields correctly as being password fields, Safari stores those passwords in the keychain, which means that without access to the user's keychain or login password, you can't get to website passwords unless you compromise the running browser itself.

As for modifying the underlying filesystem, you'd need to be root to do that. There are only three ways for a process to realistically become root without explicit authorization by an admin user: exploit a setuid binary (of which Mac OS X has relatively few—I count only 39 in Snow Leopard, the vast majority of which are BSD tools that have been scrutinized by the Open Source community for decades), exploit a daemon that is running as root, or exploit a kernel bug. Given the size and nature of the code in question, those last two are much more likely than the first.

Re:So Mac Users should expect this?

[CheerfulMacFanboy]

I actually thought people meant it only as a joke when they said that, but in the context here it doesn't seem like it, so I'll bite. The winner of pwn2own takes home a 15.000 USD cash price. It makes no sense to risk that by not going after the easiest target first. (And btw. in pwn2own 2011 the Mac fell without any restrictions being removed, just from visiting a website - drive-by install with no user interaction)

Yeah, you are right. Pretty much the only reason why almost always Macs fall first in pwn2own is (drumroll): you need a 0-day to win. Think about it. You can not win pwn2own unless nobody else has found the vulnerability you are planning to use, let alone have it used in a in-the-wild exploit.

Re:So Mac Users should expect this?

[ninetyninebottles]

No where did I claim that anyone said it was invulnerable. I said that "I" was not foolish enough to believe it will remain Virus free.

Agreed, but attacking an idea no one else has proffered is what a strawman argument is. You attacked the idea that Macs are invulnerable, thus implying that someone else had made such a claim and thus bolstering your own credibility. This is pure rhetoric, and a logical fallacy to boot.

...you seem to think I'm claiming that Mac's are a virus sponge...

You're doing it again. Where did I say or even imply that? You really need to stop assuming what other people think, when they've written no such thing.

I also stated that there have been viruses for 'Mac', not for 'OS X', although the link I posted was OS X specific (albeit a proof of concept).

While your statement is true, it is also misleading. You were specifically talking about the "Mac scanner" which is a feature only of OS X, and speaking about its lack of viruses definitions. Since there would be little to no point in including Mac classic virus definitions in the OS X scanner, you can't really claim that the existence of Mac classic viruses is particularly relevant. Speaking of which, you still haven't answered the most basic question I've posed twice now. For the third time, what virus definition do you think Apple should include instead of, "left virus scanning up to 3rd parties"?

Re:So Mac Users should expect this?

[ninetyninebottles]

Windows malware.

Isn't that what Network AV is for? Apple supplied AV is targeting home users.

Say your colleague gives you .zip archive full of files that he's worked with on a Windows machine and wants you to review some of the data for whatever reason (imagine they are some kind of self-extracting Powerpoint .exe files along with the source .ppt files).

Umm, okay, how does the Mac open the self extracting .exe files? Once the .ppt files are processed through the Mac version of Powerpoint or OO or Numbers, they don't have macro issues, so there is no problem.

So you think Apple should be scanning thousands of virus sigs ever time a file is opened, thus slowing down operations on the off chance that user will open, not change, and then pass on a file that has an executable virus in it?

Most machines in workplaces will share SMB drives between Mac and Windows machines - this is a good example of why you need an AV program for every computer no matter the OS.

Not a very good argument. If you have a shared SMB drive, your file server should be scanning it and your ID server should be monitoring the network for activation. If you don't have a SMB server (like 90%+ of Mac users) why waste the time and processing power looking for Windows viruses at the OS level. For those rare use cases you can install third party AV.

Re:So Mac Users should expect this?

[DJRumpy]

I don't think they should include any virus definitions. As I already stated, it only scans for trojans, not viruses.

Also, how can a statement be true and misleading at the same time? When referring to viruses, I specifically referred to mac, not the malware scanner in OS X. If you look at your post directly after mine, you were the one who asked why a Mac would scan for Viruses. I never stated it should.

My post:

Apple has typically left virus scanning up to 3rd parties, while taking a more active role in alerting users about phishing and malware up front.

Your post immediately following:

Ummm, what viruses would it be looking for? There aren't any real, in the wild Mac viruses unless you count Mac Guard, which barely qualifies and is only delivered via trojan that happens to spawn a separate app at run time.

You then implied I stated Mac OS X was invulnerable:

Who claimed OS X will always be invulnerable? Just you, just now, in a strawman argument.

From the get go you seem to have misunderstood my posts, or implied some meaning which I never stated. Your most recent post:

While your statement is true, it is also misleading. You were specifically talking about the "Mac scanner" which is a feature only of OS X, and speaking about its lack of viruses definitions.

I never said the Mac scanner should scan for viruses, or implied that it did. Quite the contrary in my first post where I said it only scans for 3 types of Trojans and that Apple leaves Virus scanning up to 3rd parties.

Do you see why I think you've over reacted a bit? Granted the 'virus' I posted turns out to be a POC and that was my fault for not researching further, but other than that, you are the one who seems to be implying I've said things I haven't.

Re:So Mac Users should expect this?

[ninetyninebottles]

You stated that Apple left virus scanning to third parties and scanned for trojans. This is true on OS X, not on Mac classic, thus narrowing the conversation. While it is true Apple does not scan for viruses, your comment that they leave it to third parties is misleading in that it implies they have an actual choice. It implies there are real viruses that could infect a Mac and Apple has chosen not to include those signatures.

It is like stating, "the governor has not allowed any executions of murderers in her state since taking office" in a situation where there haven't been any murder convictions in her state since taking office. True and misleading.

You then implied I stated Mac OS X was invulnerable:

Who claimed OS X will always be invulnerable? Just you, just now, in a strawman argument.

Your reading comprehension is failing. That is not at all what I implied. Rather I said you attacked that idea, even though no one else had stated it. This is a rhetorical device called a strawman argument with which you should be familiar. It is a logical fallacy.

Do you see why I think you've over reacted a bit?

Pointing out incorrect statements and logical failures in your post isn't an overreaction. It's a civil discussion under the assumption that the conversation is working towards the goal of defining the truth and furthering understanding, rather than trying to score points. I took issue with your implication that Apple has made a decision to not include virus signatures, which I think is incorrect. I strongly suspect if there is a real virus threat Apple will add it to the list. I don't know this to be true, but I think it is important to point out that there is no evidence that Apple has chosen to do otherwise so that people are not misled. A clear and correct statement would be that Apple has not included any virus definitions in their blacklist, although there do not seem to be any known, relevant viruses to include as yet.

Re:So Mac Users should expect this?

[Bobfrankly1]

And actually, as it turns out, we're both wrong.

Not the first time you've been wrong:

Notice the "absurd notion" being repeated.

If Apple can’t take over for more traditional AV vendors and security researchers, though, iOS and the Mac App Store may provide clues to how Apple may deal with the malware problem in future versions of Mac OS X. iOS is essentially a closed ecosystem, where software can only be installed via the App Store. Applications must be digitally signed by the developer, and iOS will refuse to install or run software that is modified in any way. Apple further randomly checks applications submitted to the App Store to make sure they don’t gather user data or perform other nefarious tricks.

Re:So Mac Users should expect this?

[node 3]

Are you an actual moron, or is it just an act?

Apple is not turning Mac OS X into iOS. They are not going to force their users to use the Mac App Store. The very idea is ABSOLUTELY ABSURD, and anyone who thinks this is even remotely likely is mad. Mad enough, it would seem, to save up some sort of nonsensical response and toss it in where it is entirely off topic.

Apple will never, EVER, lock down Mac OS X like iOS. NEVER. It makes no sense, no matter what your paranoid delusion leads you to believe.

What are we detecting?

[damn_registrars]

The summary mentions:

the rudimentary antivirus detection engine

Wouldn't we be better off detecting the viruses, not the antivirus?

Re:What are we detecting?

[OzPeter]

The summary mentions:

the rudimentary antivirus detection engine

Wouldn't we be better off detecting the viruses, not the antivirus?

No .. its customary to look for signs of an infection even if you can't see the infection itself. So that by detecting anti-virii (and spelling nazis be damned) you prove that the system has come into contact in the past with a genuine virus. Unfortunately as time goes on you find the that more and more systems develop anti-virii until the entire population has developed them, thus leading you to posit that the original virus was very very wide spread. However by now, due to the universality of the anti-virii, all systems are now safe from the original virus. Which is all well and good until something to do with an unclean telephone occurs. Hmm does that make Apple one of the telephone santizers????

Re:What are we detecting?

[Paradise Pete]

Wouldn't we be better off detecting the viruses, not the antivirus?

Normally yes, but I keep my Mac near the hot water heater, so that cancels it out.

Re:What are we detecting?

[at_slashdot]

So you use an incorrect form and you know it and you are proud of that? I'm pretty sure that stupidity is worse than ignorance.

Re:What are we detecting?

[Jeremi]

Wouldn't we be better off detecting the viruses, not the antivirus?

The distinction between those two categories grows hazier every year...

Re:What are we detecting?

[bill_mcgonigle]

The distinction between those two categories grows hazier every year...

This is easy - the one that screws up all your network connections is the ... ah, hell.

Re:What are we detecting?

[node 3]

The summary mentions:

the rudimentary antivirus detection engine

Wouldn't we be better off detecting the viruses, not the antivirus?

Well, if Norton on the Mac is anything like on Windows, removing it would probably provide a greater overall benefit than detecting and removing actual malware.

Re:What are we detecting?

[dwightk]

bon mot

Or for more comprehensive scanning

[Sycraft-fu]

Microsoft Security Essentials. It is not included in Windows, due to anti-trust restrictions (so that may change with Windows 8 since those restrictions are going away) but it is a free download. Updates itself automatically like all AV scanners, will also update via Windows Update if there's a problem.

Re:Or for more comprehensive scanning

[gman003]

Microsoft isn't the one responsible for that. Symantec and McAfee both spend a lot of money paying computer manufacturers to pre-load trial versions their software. The average (translation: stupid) user will assume that, since it came with the computer, it is somehow an actual necessary part of the computer, and pay for the full service. Both companies end up with more money.

Also, Microsoft includes an extra set of license checks with MSE - it's supposedly quite difficult to get it working on pirated copies of Windows. So it serves as an incentive for people to buy their OS (rather than pirate). Thus how MS sees it as a profit-making product.

Re:Or for more comprehensive scanning

[flimflammer]

...what?

Re:Or for more comprehensive scanning

[PyroMosh]

If I am reading what you said correctly you believe that Microsoft insists all computers sold with a Windows pre-install also come with a MacAfee pre-install?

If I parsed that correctly, you're mistaken. Microsoft insists no such thing. Where did you get that idea? Or am I misunderstanding what you're trying to say?

Re:Or for more comprehensive scanning

[weicco]

Microsoft isn't the one responsible for that. Symantec and McAfee both spend a lot of money paying computer manufacturers to pre-load trial versions their software.

It also lowers the price of the computer. That's why computers with Windows can be cheaper than computers with Linux. It could be win-win-win-win (MS, manufacturer, AV-vendor, user) situation if only those Symantec and McAfee products would actually work and work good.

Re:Or for more comprehensive scanning

[hairyfeet]

Frankly if you are gonna give someone a free AV I'd recommend Avast over MSE any day of the week. MSE is great for someone who is ONLY going to relatively safe sites and preferably has ABP to keep malicious JavaScript at bay, because frankly I have seen XSS attacks get through MSE, such as a nasty one going around the Youporn sites that will spam everyone in the person's Yahoo address book .

Avast sandboxes the browser and scans the page BEFORE it loads and seems to kill that and other JavaScript bugs dead, it also has the optional messenger shield and P2P shield if they use those programs and it seems (at least in my experience) to use less RAM and CPU overall than MSE.

So while I would personally not mind if MSFT gave some sort of AV as a pack in just to help cut down on the bugs, actually seeing it in action I just don't think very highly of it compared to Avast or Comodo. As for TFA allow me to say...Welcome to the club Apple users! Meetings are on Tuesdays and Thursdays, coffee and donuts are in the back.

Seriously now that there is blood in the water the sharks will come, and it will only get worse. they saw they were able to get some good numbers with MacDefender and now MacGuard, and thanks to Hackentosh they don't even need to buy an Apple to test their code on! The first Windows bugs were pretty primitive and easy to kill too. I remember when a simple booting into safe mode and tossing the files would kill a great number of bugs. Mark my words this is just the beginning, within 6 months I predict we'll be seeing our first really nasty deep buried Apple malware. Who knows, we may even see an Apple Code Red style mass infection!

Either way it will be quite interesting to see how Apple handles it. Their "don't say the M word" attitude at the beginning doesn't fill me with confidence, Apple seems to care about its image too much when weighed against helping their customers. How long did it take them to cook up a tool for this "simple to remove' bug? How are they gonna handle getting a real deep Windows style nasty? Should be quite interesting to watch and see.

Re:Or for more comprehensive scanning

[gman003]

Pretty sure the bonus for including Norton isn't nearly enough to offset the price of Windows.

Re:Or for more comprehensive scanning

[BasilBrush]

The first Windows bugs were pretty primitive and easy to kill too. I remember when a simple booting into safe mode and tossing the files would kill a great number of bugs.

You don't even know the difference between malware and bugs.

Re:Or for more comprehensive scanning

[macs4all]

Seriously now that there is blood in the water the sharks will come, and it will only get worse. they saw they were able to get some good numbers with MacDefender and now MacGuard, and thanks to Hackentosh they don't even need to buy an Apple to test their code on! The first Windows bugs were pretty primitive and easy to kill too. I remember when a simple booting into safe mode and tossing the files would kill a great number of bugs. Mark my words this is just the beginning, within 6 months I predict we'll be seeing our first really nasty deep buried Apple malware. Who knows, we may even see an Apple Code Red style mass infection!

Yeah, their "Pretty Good Numbers" were measured in maybe a few hundred Macs, worldwide. Yeah, that's some epidemic. And the ONLY reason it got as far as it did, was because of all the lame-ass website admins. who got infected by the fake banner ad, and then the genius move of then poisoning several Search Engines' Page Rank systems, so those sites came up high in search results. So, the REAL SUCCESSFUL "attack" was on those websites. And I would bet my bottom dollar that the vast majority of infections were of gullible Windows-Switchers, who cannot fathom a computer platform that DOESN'T regularly need "Virus Scans". The veteran Mac users KNOW better! (Yes, I'm being smug).

Oh, and one of the reasons this will NEVER get to the level of a Windows problem is simple: Macs don't have a "Registry", in the sense that Windows does. Without that idiotic, centralized database of thousands of system and application settings, it is literally impossible to create malware that can survive simple file-replacement techniques. The problem is that there is literally NO reliable mechanism to "rebuild" a seriously damaged Registry. Microsoft can't do it, Third Parties can't do it, and users DAMN sure can't do it!

This is why SO many problems with Windows end with the tried-and-true mantra of "Wipe and Reload" (a/k/a the "back off and nuke it from orbit" method). Because, quite literally, it is often the ONLY way to be sure.

But, since Apple uses .plist files, and since the rule is that they can be REBUILT if deleted, it's gonna be pretty damned hard for something to really scrog an OS X system. At least in a way that cannot be relatively easily "rebuilt".

And that tune you've been singing has been sung for over ELEVEN years now, and what? Heck, even Linux has much, much more "malware" that OS X. In fact, over 250 times as much.

Re:Or for more comprehensive scanning

[liquidweaver]

I'm no MS apologist ( I run slack on my laptop and Ubuntu server at work, eucalyptus cloud), but there is a whole lot of inaccuracies here. Any kernel level malware invalidates your "literally impossible" file replacement argument. The original execution of the registry was poor, but the concept of a fast and reliable btree key-value store for all your program settings isn't that idiotic (think dbus, gnomeconf, etc). The modern windows registry has plenty of permissions built in the important areas, although it is admittedly a mess of disorganization still. There are plenty mechanisms to restore a registry; in fact it can be rebuilt in parts if need be. You can walk the structure and recreate the index. UBCD has an excellent one, for example. If you want to get on a soapbox against MS, there are plenty of arguments why the OS sucks, from a bone-headed approach to library version control, to ugly API's like the MFC, inconsistent handling of kernel mechanisms/calls, a still evolving/broken application install system, extension based file types, a complete lack of usable logs and diagnostic tools built into the OS, the command line is a joke... I could go on and on. But please, don't give the windows guys a swiss cheese argument... there are some smart ones out there, if we want to point and laugh we need to go at them with facts :)

Re:Or for more comprehensive scanning

[jimicus]

Complete balderdash.

You can't trust a machine that's running malware to tell the truth when it tells you that it is now clean - because for all you know, the malware has hooked into the very API routines your anti-malware product depends upon. Anyone who's spent any serious length of time trying to clean up a heavily infested Windows PC will attest to that.

There's booting from a CD - which is much more sensible but only 100% workable if you have a whacking great database of checksums for every valid executable, every DLL, everything that may contain runnable code on the planet and you can somehow use the CD to patch all known vulnerabilities on a system - including local exploits that may take advantage of something the user's already downloaded.

A heuristic algorithm is never going to be 100% reliable because you're essentially only one step away from trying to solve the halting problem - the only real difference is instead of saying "Will the computer halt?" you're saying "Will the computer do something undesirable?". The best you can hope for is to say it probably won't.

Re:Or for more comprehensive scanning

[AmiMoJo]

You are comparing apples and oranges. Security Essentials is an anti-virus product, Avast includes "internet security" or whatever buzzwords they call it. Security Essentials only protects the local machine from infection, preventing XSS attacks is up to the website and the browser to handle. The extra stuff that Avast does is supposed to be built in to Internet Explorer, which IMHO is where it belongs.

I will also point out that if a browser on Windows is vulnerable to XSS and other exploits then it will usually also be vulnerable on Linux and MacOS. Therefore if you expect AV software to cover that eventuality you need its bloatware for every OS.

Re:Or for more comprehensive scanning

[js_sebastian]

...And the ONLY reason it got as far as it did, was because of all the lame-ass website admins. who got infected by the fake banner ad, and then the genius move of then poisoning several Search Engines' Page Rank systems, so those sites came up high in search results. So, the REAL SUCCESSFUL "attack" was on those websites.

Clearly, you are not very informed about modern cybercrime. Mass website compromises are probably the main way malware is distributed nowadays (on any platform), either through drive-by downloads or by tricking the users (trojans). Macs are no different, now that they are big enough to be a target.

Re:Or for more comprehensive scanning

[AmiMoJo]

You, sir, have absolutely no fucking idea what you are talking about.

The registry is not a huge security vulnerability because it uses permissions in the same way that the Linux filesystem does. Can you overwrite /bin/sudo with your own virus? How about alter protected config files? Or replace the bootloader? Of course not, unless you somehow already have root access. Ditto with the registry - critical settings are protected by an ACL.

There are two ways Windows systems get infected, and both apply equally to MacOS and Linux. Firstly you have user stupidity, and as Mac Defender shows this is not limited to Microsoft products. People blindly click through warning messages and type their password on demand.

Secondly you have true vulnerabilities that allow code to elevate to admin level access. These types of attack are becoming less common now because not only are there fewer vulnerabilities in Windows but also because of sandboxing and running everything at the lowest possible privilege level. You may be shocked to hear this but Windows Vista and 7 do not run as root the whole time. Again, Linux and MacOS are just as likely to have these kinds of vulnerabilities, as demonstrated every single year at pwn2own. Windows is just targeted more because it is by far the dominant platform.

Re:Or for more comprehensive scanning

[hairyfeet]

This is the same "but it only infects the user files" argument and frankly it stinks. Protip: Users DO NOT CARE if it is XSS, trojan, worm, viruses, etc, all that matters to them is can they trust their data on this machine and if can't your AV is frankly pointless.

And as far as "bloatware" I already pointed out that Avast uses less resources than MSE and from what I've seen by often quite a lot. On average I've seen Avast with a fully loaded default config take between 60-80Mb of RAM and anywhere from 4-45% CPU when scanning, of course depending on the chip. I have rarely seen MSE drop below 100Mb and have seen MSE slam a CPU to 100% and leave it there for over 20 minutes, and this was on a 2.8GHz quad.

Now is it because like many MSFT products it wasn't developed in house for the OS, in this case they just bought Giant Antispyware and rebranded? Who knows, but my point still stands. If the price is the same an AV that only protects you from offline infection when the VAST majority of infections come from the net? kinda pointless. I personally have witnessed a box infected with a Security tool variant that still had MSE happily running in the background, didn't stop shit in that case.

So far knock on wood I have yet to see that with either Comodo or Avast and with their default sandboxing it makes it so no matter where the nasty is coming from it stops it dead. The only reason ATM I recommend Avast over Comodo (both seem to use the same amount of resources and have the same features) is that Avast seems less "fiddly" when it comes to asking questions or bugging the user. Combined with Comodo Dragon using low rights mode it makes for a really solid machine without the hassles or risks.

Or maybe YOU would like to explain to the users why nobody will accept emails from them anymore and they are constantly being told by Yahoo to reset their passwords, all because they wanted to see some boobies? Didn't think so. I have even set up a spam Yahoo address on a newly imaged machine and clicked on every link on every Youporn style site and saw absolutely nothing. Avast killed any nasties running on site and Dragon blocked any funny domains before Avast even got a chance to act. If the price is free for both, why would you want the worse protection?

Re:Or for more comprehensive scanning

[orange47]

there are not so many executables to whitelist. at least we should have such md5sum database of all windows versions and service packs. drivers might be problem, but manufacturers could include the hashes. other than that, nothing else would load on startup (preferably) so at least you get clean boot and do rest of cleaning from hdd. another option is to make that database yourself after the fresh install. but I guess it won't do for same reasons as making a (ghost) image. even .arj archiver had an option of making a hollow archive many many years ago (and checking if files have changed), but it seems common people haven't used it (much) in that way.

Re:Or for more comprehensive scanning

[dhavleak]

Man.. what kind of fact-free rant is that.. do you actually believe some of that nonsense?

I just don't have the patience to get into one of those "my platform is better than your platform" garbage discussions (and I really don't intend to diss your platform) so let me just ask you a couple of questions:

1. Where did you get the number (few hundreds) from?

2. Regarding the "only reason" -- you don't think an unsafe default setting (to run 'safe' files) combined with a murky definition of 'safe' files are contributing factors?

3. Why do you need to bring Windows into the conversation? I fail to see how its relevant to this topic. (not to mention that your comparison of registry vs. p-list is pure garbage!)

4. What's with using so much capitalization? I can see you're trying to be forceful about making your point, but don't you think you should know what you're talking about before you yell?

Re:Or for more comprehensive scanning

[orange47]

oh, by the way, virustotal.com has started offering whitelists (they call it "goodware information") but unfortunately only in 'private API' and I presume that means not for free.

Re:Or for more comprehensive scanning

[jimicus]

High time too. The only amazing thing about that is it took the better part of 30 years for anyone to latch onto it as an idea. Carry on at this rate the IT industry will be able to provide systems that work without requiring a four-leafed clover, a rabbit's foot and a black cat regularly crossing your path some time around the twenty-fourth century.

Re:Or for more comprehensive scanning

[macs4all]

I'm no MS apologist ( I run slack on my laptop and Ubuntu server at work, eucalyptus cloud), but there is a whole lot of inaccuracies here. Any kernel level malware invalidates your "literally impossible" file replacement argument.

And yet, you fail to explain how. And yes, the rest of your comment firmly labels you as a Windows (or at least Windows Registry) apologist.

The original execution of the registry was poor, but the concept of a fast and reliable btree key-value store for all your program settings isn't that idiotic (think dbus, gnomeconf, etc).

ANY centralized database of critical configuration information is inherently fragile. Period. And doubly so with the Windows registry, because it is such a mess.

The modern windows registry has plenty of permissions built in the important areas, although it is admittedly a mess of disorganization still.

Permissions are only good until the filesystem is tricked into ignoring them with a privilege escalation. And since most Windows users still run as Administrator, that isn't even necessary.

There are plenty mechanisms to restore a registry; in fact it can be rebuilt in parts if need be. You can walk the structure and recreate the index. UBCD has an excellent one, for example.

That assumes you both know which of the hundreds or thousands of keys have been affected, and then, what you need to set those keys' values to.

If you want to get on a soapbox against MS, there are plenty of arguments why the OS sucks, from a bone-headed approach to library version control, to ugly API's like the MFC, inconsistent handling of kernel mechanisms/calls, a still evolving/broken application install system, extension based file types, a complete lack of usable logs and diagnostic tools built into the OS, the command line is a joke... I could go on and on.

Please! Don't let me stop you...

But please, don't give the windows guys a swiss cheese argument... there are some smart ones out there, if we want to point and laugh we need to go at them with facts :)

I personally don't think that pointing out the Registry as a big, steaming pile of Windows vulnerability is anything like "swiss cheese", and neither do these people.

Re:Or for more comprehensive scanning

[macs4all]

Complete balderdash.

You can't trust a machine that's running malware to tell the truth when it tells you that it is now clean - because for all you know, the malware has hooked into the very API routines your anti-malware product depends upon. Anyone who's spent any serious length of time trying to clean up a heavily infested Windows PC will attest to that.

Then how do Windows A/V apps do such a bangup job of reporting? It seems that if there is a "signature" available for a particular infection, then, even if it cannot be eradicated (such as things that infect "whitelisted" files like svchost.exe), it can still be detected.

So no, not complete balderdash.

There's booting from a CD - which is much more sensible but only 100% workable if you have a whacking great database of checksums for every valid executable, every DLL, everything that may contain runnable code on the planet and you can somehow use the CD to patch all known vulnerabilities on a system - including local exploits that may take advantage of something the user's already downloaded.

A heuristic algorithm is never going to be 100% reliable because you're essentially only one step away from trying to solve the halting problem - the only real difference is instead of saying "Will the computer halt?" you're saying "Will the computer do something undesirable?". The best you can hope for is to say it probably won't.

Or, you can simply have a system design that repels attacks. Nothing can stop social engineered attacks, of course; but drive-by attacks can be stopped dead by good system design. OS X is gradually growing those good practices, and so far, at least, it seems like they are significantly ahead of the curve.

Re:Or for more comprehensive scanning

[macs4all]

...And the ONLY reason it got as far as it did, was because of all the lame-ass website admins. who got infected by the fake banner ad, and then the genius move of then poisoning several Search Engines' Page Rank systems, so those sites came up high in search results. So, the REAL SUCCESSFUL "attack" was on those websites.

Clearly, you are not very informed about modern cybercrime. Mass website compromises are probably the main way malware is distributed nowadays (on any platform), either through drive-by downloads or by tricking the users (trojans). Macs are no different, now that they are big enough to be a target.

So, what you're saying is that my comment was correct. The fact that "it happens all the time, to everybody" should not be seen as an inevitability; but rather a rallying cry to tighten up webservers and website design.

There is absolutely no reason why an outside attacker should be able to inject anything in the web-content delivery process, other than the possibility of having a lazy admin serve up a malicious banner ad. And that can be taken care of by the admins themselves, banning that lazy ad service from their site. Eventually, that works up the chain, and the people actually responsible for accepting the malicious ad will learn to be more careful.

Re:Or for more comprehensive scanning

[SydShamino]

You can't trust a machine that's running malware to tell the truth when it tells you that it is now clean - because for all you know, the malware has hooked into the very API routines your anti-malware product depends upon.

Not when that malware failed to attain root access.

Re:Or for more comprehensive scanning

[macs4all]

You, sir, have absolutely no fucking idea what you are talking about.

The registry is not a huge security vulnerability because it uses permissions in the same way that the Linux filesystem does. Can you overwrite /bin/sudo with your own virus? How about alter protected config files? Or replace the bootloader? Of course not, unless you somehow already have root access. Ditto with the registry - critical settings are protected by an ACL.

Which would all be fine and dandy, I assume, if it weren't for the fact that (on XP at least) 95% (probably being conservative) of the users still run as an Admin. And as such, have absolutely unfettered access to modify an-y-thing in the system, including (but certainly not llimited to) the Registry. Now, you were saying something about "permissions"?

And oh, even if you are not running as an Admin, there have been puh-lenty of "privilege escalation" exploits on the Windows platform.

BTW, your stupid statement is belied by the thousands upon thousands of examples of malware that plays games in the Registry. To claim the opposite is to engage in willful blindness.

There are two ways Windows systems get infected, and both apply equally to MacOS and Linux. Firstly you have user stupidity, and as Mac Defender shows this is not limited to Microsoft products. People blindly click through warning messages and type their password on demand.

While I will agree about user stupidity, I would bet my bottom-dollar that the vast majority (I would even go to say "almost all") of the people who fell for the MacDefender trojan were ex-Windows users. Why? Not because they are any more stupid (afterall, they switched to the Mac!); but rather, because they cannot imagine living in a world where they don't regularly have infection problems. So, when some "helpful" thing pops up and says they have been infected, they are already conditioned by Windows (and its constant infections) to believe it.

Secondly you have true vulnerabilities that allow code to elevate to admin level access. These types of attack are becoming less common now because not only are there fewer vulnerabilities in Windows but also because of sandboxing and running everything at the lowest possible privilege level. You may be shocked to hear this but Windows Vista and 7 do not run as root the whole time.

Actually, I am not shocked. I use and vastly prefer Macs; but I am fully aware of Windows trends and have even setup a couple of Vista (ewww!) and Win 7 systems, and regularly maintain a few that are still on XP.

And, BTW, OS X has been gaining those ASLR and Sandboxing features as well. And I don't know if you know this; but on OS X, no one runs as "root", specifically. The root account is disabled. You can sudo, of course (which is what the "enter your password" dialog is; but as far as "root" goes, not unless the user has specifically enabled it.

Again, Linux and MacOS are just as likely to have these kinds of vulnerabilities, as demonstrated every single year at pwn2own. Windows is just targeted more because it is by far the dominant platform.

Actually, pwn2own is anything but a "real-world" test. And the number of Linux vulnerabilities (863), as opposed to OS X (3, maybe) would handily belie your "marketshare" argument.

Re:Or for more comprehensive scanning

[macs4all]

Man.. what kind of fact-free rant is that.. do you actually believe some of that nonsense?

I dunno. Where are your facts?

I just don't have the patience to get into one of those "my platform is better than your platform" garbage discussions

I see. And yet, you have the time to compose your multi-question reply. But, do go on...

(and I really don't intend to diss your platform) so let me just ask you a couple of questions:

1. Where did you get the number (few hundreds) from?

Same place you got your number to rebut my number. But, ignoring that, I actually couldn't find a "non-inflammatory" source for a solid number; so I will admit it was a (probably a little low) SWAG. But, as soon as you can find a hard number to replace that with, I'd really be interested to see it, seriously.

2. Regarding the "only reason" -- you don't think an unsafe default setting (to run 'safe' files) combined with a murky definition of 'safe' files are contributing factors?

I will wholeheartedly give you that one! On every OS X system that I set up, either for myself, or for others, I always de-select the "Open Safe Files..." option. It was definitely a "usabiltiy over security" decision that I think will now (FINALLY!) be changed. But even the first few iterations of MacDefender didn't catch onto that gaping security hole. As I said, I'll give you that one.

3. Why do you need to bring Windows into the conversation? I fail to see how its relevant to this topic. (not to mention that your comparison of registry vs. p-list is pure garbage!)

Sorry, when the topic of bad security design comes up, Windows is never far behind!

And no, my comparison of the insane vulnerability caused by the Windows Registry, relative to decentralized plist files is any but "Academic". And anyone who says differently is, IMHO, either delusional, or a Windows apologist.

4. What's with using so much capitalization? I can see you're trying to be forceful about making your point, but don't you think you should know what you're talking about before you yell?

Just lazy on my part. I hate having to derail my train of thought with stupid HTML tags. If slashdot would grow one of those dumbass "tag inserter toolbars" on the comment edit window (but that wouldn;t bee l33t enough, of course), then I would use styled text. Would you rather I use _this_ form, or *this* form? I guess I can do that, too. But the capitalization is just a bad habit on my part, and is pretty deeply embedded in my typing routines...

Re:Or for more comprehensive scanning

[macs4all]

"A few hundred macs, worldwide"?

This is utter bullshit. Everything reported suggests it's significantly more than that. But then given your username, you were bound to be a fanboy.

And yet, you offer no other number to rebut my statement.

Kinda telling, isn't it?

Re:Or for more comprehensive scanning

[cavreader]

Don't the social engineered attacks act as the gateway for launching deeper attacks? Once your foot is in the door all kinds of possibilites present themselves. How is OS X ahead of the curve when according to you they are just growing good practices now. They have a solid security model in place but that doesn't mean it does not have any potential vulnerabilities. Shouldn't they have already been growing good practices all along or did they actually believe OSX invulnerable and decided not to bother? They have not handled the current malware attack very well. Thier customer support center started playing down the threat and would not give any advice on how to remove an infection and often tried to mislead those calling into thinking it was some other application causing the problem. Someone from corporate even published a copy of the instructions communicated to the support reps on how to handle the problem without ever admitting the problem actually existed. Now a couple of weeks later they come up with a patch and that is considered as staying ahead of the curve?

Re:Or for more comprehensive scanning

[AmiMoJo]

Which would all be fine and dandy, I assume, if it weren't for the fact that (on XP at least) 95% (probably being conservative) of the users still run as an Admin.

1) XP is 10 years old. Why compare a 10 year old OS with the latest version of MacOS X? Most computers And oh, even if you are not running as an Admin, there have been puh-lenty of "privilege escalation" exploits on the Windows platform.

Ditto MacOS. Actually MacOS is worse because it doesn't sandbox Safari (or if it does then not very well), e.g. the carpet bombing exploit of a year or two back. If you 0wn Safari you can fuck up MacOS pretty badly without even needing privilege escalation.

I would bet my bottom-dollar that the vast majority (I would even go to say "almost all") of the people who fell for the MacDefender trojan were ex-Windows users.

You really do have your head up Job's arse, don't you? Sure, people who buy into the sleek white Apple universe are somehow more intelligent. Feeble minded submission to advertising has nothing to do with it. Having to enter the admin password when installing anything on MacOS in no way trains them to do it, unlike clicking through UAC warnings and then entering the admin password on Windows.

pwn2own is anything but a "real-world" test

Hackers looking for vulnerabilities to exploit for monetary gain is not "real-world"?

Re:Or for more comprehensive scanning

[doggo]

"XP is 10 years old. Why compare a 10 year old OS with the latest version of MacOS X?"

Why? Because vast swaths of Windows users haven't upgraded because:

a) Vista was a fucking train wreck, and most users down-graded back to XP if they could find a way to.

b) Users are wary of Windows 7 because of Vista and continue to use XP because it works well enough on their current hardware, which was probably "Designed for Windows Vista".

c) Did I mention Vista?

d) Vista.

Re:Or for more comprehensive scanning

[macs4all]

Which would all be fine and dandy, I assume, if it weren't for the fact that (on XP at least) 95% (probably being conservative) of the users still run as an Admin.

1) XP is 10 years old. Why compare a 10 year old OS with the latest version of MacOS X?

Because this is what Windows usage looks like as of March, 2011, that's why. And because that same article says that, conversely, all of the reporting mechanisms show that the current version of OS X, 10.6 "Snow Leopard" is the most widely used. Next!

Most computers And oh, even if you are not running as an Admin, there have been puh-lenty of "privilege escalation" exploits on the Windows platform.

Ditto MacOS. Actually MacOS is worse because it doesn't sandbox Safari (or if it does then not very well), e.g. the carpet bombing exploit of a year or two back. If you 0wn Safari you can fuck up MacOS pretty badly without even needing privilege escalation.

But the carpet bombing attack couldn't make anything execute, and so was utterly useless as an actual "pwn" attack. That's why it really never went anywhere. And it was, BTW, a Safari vulnerability; not an OS X vulnerability; because it could happen on the Windows version of Safari as well.

I would bet my bottom-dollar that the vast majority (I would even go to say "almost all") of the people who fell for the MacDefender trojan were ex-Windows users.

You really do have your head up Job's arse, don't you? Sure, people who buy into the sleek white Apple universe are somehow more intelligent. Feeble minded submission to advertising has nothing to do with it. Having to enter the admin password when installing anything on MacOS in no way trains them to do it, unlike clicking through UAC warnings and then entering the admin password on Windows.

I made no such claim that Mac users were more intelligent than Windows users. What I claimed was that Windows users have become conditioned by years of A/V alerts, and thus, more likely to just click on them without putting much thought into the fact that Macs have enjoyed a virus-free (and therefore A/V alert-free!) existence. After awhile, even Captain Picard believed there were Four Lights. Didn't make him stupid; just benumbed.

I have experienced UAC a number of times. It is in no way an equivalent deterrent in the way that the "sudo" dialog on OS X is. Why? Two reasons: 1) Windows is an alert-happy OS. It seems that either an application or the OS itself almost constantly "wants something". This numbs the user into not thinking. OS X, on the other hand, is (unless you are a heavy "Growl" user, which I am not) a pretty "quiet" OS. So, when something pops up, it tends to make you take notice. 2) Every incarnation of UAC that I have personally experienced merely made you click a button to "Allow" the action to happen. This, coupled with the "Alert-Happy" nature of Windows in general, makes it that the less likely that the user will pay attention to a UAC dialog, rather than just dismissing it as (yet another) damned annoyance. OS X's "sudo" dialog actually forces you to stop and enter your password (or, if you aren't on an admin account) enter both an admin user and pass. Even when I expect it, this extra step (of having to enter at least a password) is "disruptive enough" that it always makes me stop and think "Why do I need to do this?" And that is exactly the extra thought that stops a much larger portion of users from simply giving permission out-of-hand.

pwn2own is anything but a "real-world" test

Hackers looking for vulnerabilities to exploit for monetary gain is not "real-world"?

The conditions in pwn2own are not "real-world". Quit being deliberately obtuse.

Re:Or for more comprehensive scanning

[macs4all]

Don't the social engineered attacks act as the gateway for launching deeper attacks?

If this were Windows XP, definitely. But on OS X 10.6 and above, not so much. At least not so far... And recent moves like this are a clear sign that Apple is taking security very seriously in 10.7 (Lion).

Once your foot is in the door all kinds of possibilites present themselves. How is OS X ahead of the curve when according to you they are just growing good practices now. They have a solid security model in place but that doesn't mean it does not have any potential vulnerabilities. Shouldn't they have already been growing good practices all along or did they actually believe OSX invulnerable and decided not to bother?

Your statements above are self-canceling, you realize that, don't you? First you jump on my poorly-worded statement, implying that Apple is just starting to add security features to OS X. Then you say that they have a solid security model in place. So, which is it?

Nevermind; I'll answer for you: OS X 10.6, Snow Leopard, already has several security features; but 10.7, Lion (which is almost ready to release) will have decidedly more. Got it?

They have not handled the current malware attack very well. Thier customer support center started playing down the threat and would not give any advice on how to remove an infection and often tried to mislead those calling into thinking it was some other application causing the problem. Someone from corporate even published a copy of the instructions communicated to the support reps on how to handle the problem without ever admitting the problem actually existed. Now a couple of weeks later they come up with a patch and that is considered as staying ahead of the curve?

Apple was already "ahead of the curve" regarding more serious infections due to the features already implemented in the current version of OS X (see above). As been said on these pages many, many times, nothing can completely insulate an OS (any OS) from the most serious security problem (the one sitting in front of the keyboard).

Although I was not thrilled with the initial response on MacDefender, either; Apple's early decision to tell their support people to "not help people" eradicate MacDefender is actually grounded in sound business policy; which is, when a company like Apple has their "agents" say "This will work", Apple is essentially "owning" that fix, and there could be an "implied warranty" issue if the procedure doesn't work on a particular customer's machine. I know that sounds weasel-y; but that's what happens when Tech Support conflicts with the Legal Department in a big corporation.

But, as soon as Apple was able to figure out and test a solution, they released it. They did not wait for "Patch Tuesday", (I know they have no such thing, thank FSM; but you get my point). They rolled it out fairly promptly. By Microsoft standards, the "denial" period was vanishingly short, and the patch was issued with relative alacrity and candor.

Re:Or for more comprehensive scanning

[scot4875]

Oh, and one of the reasons this will NEVER get to the level of a Windows problem is simple: Macs don't have a "Registry", in the sense that Windows does.

Yeah, because we all know that malware didn't exist until Microsoft invented the system registry. /rolls eyes

The rest of your post is similarly "informative."

--Jeremy

Re:Or for more comprehensive scanning

[scot4875]

Yes, it's telling: there's no point in wasting time with you. You aren't actually interested in a real discussion.

--Jeremy

Re:Or for more comprehensive scanning

[macs4all]

there is a "registry", actually there are a few of them.

Open terminal, type "defaults read | less"....behold! The Registry of Apple Macintosh! Then there is /System/Library/LaunchDaemons & xml files. Launchd *will* restart your kill -9'd process for you!

Are mpkgs signed yet? If not, or if getting them signed is expensive, good luck!!

Are you just trying to be stupid, or do you not actually understand what the "defaults" command does?

In case you are not understanding, the "defaults" command allows the editing of the multitudinous, but
separate "plist" XML files for USER settings for applications. There is no, repeat no centralized database in OS X like the Windows Registry, period, even though the defaults command makes it sort of seem like there is. Yes, there is an "NSGlobalDomain" "key" (Domain); but even that has pretty innocuous settings, at least as far as I can tell. Unless I'm wrong, I simply don't see anything that would change boot behavior.

As far as the LaunchDaemons folder, so what? First you have to modify the contents of that folder. And that, my friend, requires root privileges (or a sudo). Not likely to happen without the user knowing.

So, you can use the "defaults" command to mess with certain Preferences (mostly Application Prefs) for a USER, w00t. That's a far, far cry from the damage you can do via the Windows Registry. And all that a user has to do to re-create a Pref. file is trash it, or simply move it from its usual location, and the app. will re-create it on next launch. Again, w00t.

As far as the signed mpkgs, I do not know. I'm not an OS X dev.

Re:Or for more comprehensive scanning

[macs4all]

Oh, and one of the reasons this will NEVER get to the level of a Windows problem is simple: Macs don't have a "Registry", in the sense that Windows does.

Yeah, because we all know that malware didn't exist until Microsoft invented the system registry. /rolls eyes

The rest of your post is similarly "informative."

--Jeremy

Did I say that? I'm pretty sure I didn't.

What I said (or actually "implied"), is that the Windows Registry is one big vulnerability that simply doesn't exist in OS X. And the problem that is unique to the Registry is that, as I have recently encountered with an XP system I "disinfected", long after that last "infected" file has been replaced, the damage can linger on in the form of modified, and/or inserted, and/or deleted Windows Registry keys. And the locating and repair of these Registry changes is something that is painstaking at best.

In the case of the infection I am speaking of, it has modified some startup of Services such that the Windows Firewall doesn't start, nor do several other Services that are used to access "Mapped Drives"; such as the "Workstation" and "Computer Browser" Service (and of course, their depdencies). Changing their "Startup" settings does nothing. They are all set to "Automatic", but they refuse to start. You can start them from the Services "control panel", and they will start and run normally, until the next reboot. No errors, no log entries. Nothing. They simply refuse to start. I have Googled and MS Knowledgebased the problem to death; but cannot find anything that is much help. And it is the insane complexity of the Registry, coupled with the total lack of reasonable documentation regarding same, that contribute to the "throw up your hands" feeling when dealing with complex Registry issues like this one.

THAT is the problem that cannot occur with OS X's "decentralized" plist files. And thus, why I said what I said.

Got it?

Re:Or for more comprehensive scanning

[cavreader]

It seems like everyone is going out their way to rationalize Apple's behavior in this matter. Your solid business policy excuse is right on the money though. Heaven forbid they admit they might have a problem. The actual steps to eradicate or at least prevent future infections were pretty straight forward for this minor problem but next time things could be more serious. I also know another company that has violated their "Patch Tuesday" policy on occasion when a serious problem occurs. I just can't help feel that had this been a MS problem people on this site would be calling for Congressional Hearings and recommending UN sanctions be put in place to punish someone for this monumental and egregious attack on the worlds innocent computer users. Oh the children!!

Re:Or for more comprehensive scanning

[macs4all]

It seems like everyone is going out their way to rationalize Apple's behavior in this matter. Your solid business policy excuse is right on the money though. Heaven forbid they admit they might have a problem. The actual steps to eradicate or at least prevent future infections were pretty straight forward for this minor problem but next time things could be more serious. I also know another company that has violated their "Patch Tuesday" policy on occasion when a serious problem occurs. I just can't help feel that had this been a MS problem people on this site would be calling for Congressional Hearings and recommending UN sanctions be put in place to punish someone for this monumental and egregious attack on the worlds innocent computer users. Oh the children!!

You claim to understand my rational explanation, and then you turn right around and demonstrate that you do not.

Apple does not "have a problem", at least not one that everyone who creates an OS that allows users to install software can solve. Every single person on Slashdot agrees that the biggest security threat to any OS is the user; Apple (and by extension, OS X) is no different. There is only one solution to that problem: Never run as an Admin. Even that isn't 100% effective; because, even if you have to log out, then log back in as an Administrative user, there is absolutely no guarantee that you won't eventually be duped into installing some nefarious, or infected, application. A good example is the latter, where people downloaded bootleg copies of iWork '09, which had been infected. As anyone who installs pirated software knows, sometimes bad things happen to good software... Yes, you can have "signed binaries" and such; but, not only does that become a gigantic pain for the maker of the OS; but then people start crying "Software wants to be freeeeeeeee!" Anyone who has been a member of slashdot for more than three months will attest to the fact that that is exactly what all RMS' virtual chillen' would immediately start screaming.

So, there you have it (and you very well know it).

The only difference is, with Apple, ONE lonely Trojan is NEWSWORTHY; in the case of MS (or, it seems, even Linux), it's just another day in paradise. And, although MS has indeed broken their "Patch Tuesday" rules; if you were being HONEST, instead of intentionally obtuse, something like MacDefender wouldn't even get onto their RADAR, let alone sound the alarm bells.

PER DAY.

Yeah, Apple sure has a problem.

Re:Or for more comprehensive scanning

[cavreader]

I did not question anyone's technical competence when it comes to building and releasing bug fixes or imply this particular exploit was particularly damaging or earth shattering. I was just commenting because I was amused at how this problem was being addressed when compared to similar problems on some of the other OS's. It is amazing that the patches can be released as fast as they are. The amount of work needed to study, fix, re-test, and distribute is the daunting to say the least. This can include re-testing the OS as well as any applications that might be effected by the patch. Things are particularly nasty if the fix touches upon 3rd party drivers. MS has run into situation over the years. (As a matter of fact it was usually 3rd party drivers causing the BOD's) With all that said I would not be surprised at all to see more advanced exploits targeting OS X as well as Android in the future.

Re:Or for more comprehensive scanning

[dupeisdead]

The registry used to be a complete festering pile of trash. However you may have noticed those websites refer to PREVIOUS versions of windows, several years out of date. Software changes. Get off your high horse, accept that maybe things have changed. 'You can still think windows sucks if you want, but atleast have current information. I mean, i could rip on all the annoying things about my apple ][e did back in the day and that would be as current as your info.

Nothing can possibly go wrong

[nigelo]

'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.'

at least, we hope not (yet).

Re:Nothing can possibly go wrong

[MobileTatsu-NJG]

at least, we hope not (yet).

Wouldn't it be pretty trivial to do a byte-by-byte comparison of a machine that's infected and one that isn't?

Re:Nothing can possibly go wrong

[PopeRatzo]

'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.'

That's what's known as "whistling past the graveyard."

"I've got some little cold sores, but it's nothing like herpes or anything..."

Re:Nothing can possibly go wrong

[Barny]

Yup, this is the beginning of the arms race for malware on Mac, just as windows has its own fighting the malware toolkits. Wait and see how long it takes for an updated toolkit that not only bypasses this fix but also disables future fixes.

Re:From no malware on Mac

[je ne sais quoi]

Does the concept of "false equivalence" mean anything to you? Yes, macs have had trojans for awhile on pirated copies of software. Yes, this is an evolution of the malware on OS X since it attempts to trick the user into installing the software. Yes, it'll probably get more complicated than this, but come on -- are you really telling me that since OS X has gotten two instances of malware, after being in use for over a decade, is the same as what has happened with windows? Really?!?

Honest question about security of unix systems

[blahbooboo]

For years I have understood that Unix systems were less prone to security threats posed by malware/viruses/hackers due to the basic security model of unix. When naysayers said Mac was less prone because of marketshare, the argument against this is the large number of Linux servers which have never been successfully targeted by any major security threat. While this malware attack is a trojan (and more social engineering), are the naysayers actually correct that Mac is not been successfully attacked because of marketshare? If so, are unix systems not inherently more secure due to their design than other OSes?

Thanks!

Re:Honest question about security of unix systems

[catmistake]

Depends on who you ask. If you ask a security expert that, due to the fact that they are a security expert, they of course spent most of their time buried in Windows fixing the broken, they will tell you all computer operating systems are equally susceptible. However, if you ask a long toothed grey beard UNIX systems administrator, he will tell you all computer operating systems are equally susceptible, but he's never seen a virus because he has spent most of his time buried in UNIX.

Re:Honest question about security of unix systems

[catmistake]

There is no operating system that can protect against user stupidity.

Sadly, most users are stupid.

Correct. Though most Windows shops mitigate the stupidity by eliminating the users, and making everyone an administrator.

Re:Honest question about security of unix systems

[betterunixthanunix]

A few things:

• The simple Unix security model is better than the (largely historic) Windows model because users do not have the ability to make systemwide changes. This ensures that even if malware infects a user's machine, it is always possible for the root user -- what Windows refers to as an "Administrator" -- to remove the infection, and the worst case is that the user's files are all gone.
• A Windows system can be set up to have the same security model as a Unix system, and this has been recommended by Microsoft for years. However, so many legacy applications expect "administrator" privileges in Windows that this is not the easiest thing to do.
• Modern security requires a lot more than just separating user accounts. For a home user, losing all the files in their home directory or having their account compromised can be a worst case -- it can mean a raided bank account, lost family albums, etc. I am of the opinion that the answer lies with mandatory access control: an unverified program that you download from the Internet should not be able to access files in your home directory even if it is running under your username, unless you specifically authorize it to do so. This is possible to set up in Windows, GNU/Linux (using SELinux; you can also simplify things and run your web browser in the SELinux sandbox, which confines downloaded programs to the same sandbox, and by default deletes those programs when the sandbox is closed), FreeBSD (with TrustedBSD), TrustedSolaris (if anyone still cares about Solaris), AIX, etc...but I am not sure that this is something that is officially supported in Mac OS X. That being said, Mac OS X does have mandatory access control built into its kernel, and as far as I know that is what is used to implement "parental controls."

As a final note, Mac OS X is routinely the first system to be defeated at pwn2own; some say this is because it is less secure, others say it is because the participants want Mac OS X systems more than Windows systems.

Re:Honest question about security of unix systems

[mario_grgic]

To this date there have not been any viruses (i.e. self propagating code that infects machines without user intervention) for Mac OS X and I'm pretty sure Linux as well.

The malware that relies on social engineering techniques (like the one mentioned in this discussion) is very hard to protect against. Basically, user with some kind of system privileges to install software is lured to download the software, attempt to install it, provide their password when asked by the OS/installer. If you have a user willing to do all that, all bets are off.

But if you have a literate UNIX user, then tricking them is usually harder (most won't install anything for the first time from untrusted source on anything but virtual machine, test the software, inspect its behavior, what it does, what files it modifies, does it connect online, where does it connect etc. and if all goes well, add it to the trusted list, then install on production machine). Most ordinary users are not knowledgeable enough to do this though.

The difference is that every UNIX comes with tools that allow you to do all this out of the box.

Re:Honest question about security of unix systems

[ninetyninebottles]

This is possible to set up in Windows, GNU/Linux (using SELinux; you can also simplify things and run your web browser in the SELinux sandbox, which confines downloaded programs to the same sandbox, and by default deletes those programs when the sandbox is closed), FreeBSD (with TrustedBSD), TrustedSolaris (if anyone still cares about Solaris), AIX, etc...but I am not sure that this is something that is officially supported in Mac OS X. That being said, Mac OS X does have mandatory access control built into its kernel, and as far as I know that is what is used to implement "parental controls."

OS X's Mandatory Access Controls are a port of TrustedBSD. They are used to sandbox selected services in OS X to improve security, but not widely deployed yet for userspace software. You can configure them yourself using the CLI or using a third party application like "Sandbox".

Re:Honest question about security of unix systems

[betterunixthanunix]

That is good to hear; when I last looked into it, I was given the impression that manually fiddling with the mandatory access controls was not officially sanctioned/supported by Apple.

Re:Honest question about security of unix systems

[Billly Gates]

Windows was more insecure because Microsoft designed it to be be scriptable with com/dcom objects that apps can use to integrate into one another for app embedding. ActiveX are just objects that are designed from the ground up to be mix win32 applets inside IE. The whole object model is based upon using proprietary win32 code and api's so the programmers do not have to code as much. This was designed for lock in and accessibility everywhere with no security in mind.. Unfortunately, this meant I can write some VB 6 app to call win32 functions to wipe your hard drive and I can just copy the dll over as an activeX object in IE. If you have IE 5 or earlier all you would have to do is visit my webpage and it would run automatically on your computer and it would be trash. The iloveyou worm that hit it big in Outlook was a simple VBA script that copied the string and did a simply call to the user's address book. Most of the win32 api was designed for Windows95 built on Dos which had no concept of user rights. Only the security API for Windows NT had that modern concept. These api's were ported over to WindowsXP.

Buffer overflows are something else and poor memory management of Windows causes GP faults which everyone and their brother received back in the Win 9x days. Microsoft had trouble enforcing this because Dos and Windows 3.1 apps just took random memory addresses mostly and one would just take an address of something else and bluescreen and take down your system. So if you are a hacker and know when a ram address ends with a certain DLL (thanks to a debugger) you can put some code in that adress and WHAM instant execution. Windows also has no concept of data for execution vs data for storage. This is a flaw of x86 actually but you could put executable code in just a cookie or a temp file and it would not be hard to trick Windows when it is done executing a DLL to go to your program and it will totally bypass security. You can do this in Unix as well but this is very uncommon today as you need to be root and was a hack of the early 80s when coders wrote in assembly to gain performance tricks. This is frowned upon in the Unix world as there are excellent libraries that can obtain speeds close to assembly. Not to mention users do not want to log in as root. This same assembly calls stayed in Windows due to backwards compatibility as WindowsXP has the default user as an administrator. Doh

Anyway, this was why Windows was less secure and why MS wants you to switch to .NET. Less to do with marketshare but more to do with poor design decisions and the requirements to be backwards compatible. I am so sick of those saying Windows is great and it is marketshare or something else stupid.

Re:Honest question about security of unix systems

[betterunixthanunix]

To this date there have not been any viruses (i.e. self propagating code that infects machines without user intervention) for Mac OS X and I'm pretty sure Linux as well.

You should at least try using a search engine before making a remark like that:

https://help.ubuntu.com/community/Linuxvirus

I say this as someone who has used nothing except GNU/Linux for many years now: there are viruses out there that will infect a vulnerable GNU/Linux system. Do not be fooled, these things are out there. As an exercise, you can try to write a very basic virus that targets the vi text editor and inserts itself into any C program a user creates (if you want bonus points, have the virus remove itself from the program whenever the user opens it with vi). This is not a hard thing to do if you are a halfway decent programmer.

But if you have a literate UNIX user, then tricking them is usually harder

I can say the same about Windows users. Literate Windows users generally avoid malware: they know what not to do with their computers. What is your point? That uninformed/easy to manipulate users will be the targets of malware infections?

Re:Honest question about security of unix systems

[toadlife]

For years I have understood that Unix systems were less prone to security threats posed by malware/viruses/hackers due to the basic security model of unix.

For years you have been assuming something that isn't true. The basic Unix security model is nothing special.

the argument against this is the large number of Linux servers which have never been successfully targeted by any major security threat.

The two main reasons for this are the lack of homogeneity among various Unix-type operation systems and the differing average competence level of Windows vs Unix admins.

Besides, major worm outbreaks have hit UNix sytems in the past. Google the IIS/Sadmind (it was quite impressive) worm. I was getting several hundred hits per day from infected Solaris servers while that thing was active.

Re:Honest question about security of unix systems

[Kitkoan]

As a final note, Mac OS X is routinely the first system to be defeated at pwn2own; some say this is because it is less secure, others say it is because the participants want Mac OS X systems more than Windows systems.

OSX is the first system to be defeated at pwn2own because its less secure, not because the OSX system is a more wanted prize. Charles Miller (the man who takes down OSX at pwn2own) has answered this before in a interview.

Many pundits have made a lot of the fact that the Mac was the first to be exploited in the Pwn2Own contest. Was the choice of the Mac as the first target because the hardware/operating system combo was more desirable as a prize than the commodity Windows laptops of the other competitors? Or was it just because Macintosh exploits occur with much less frequency than Windows exploits and would therefore be more newsworthy?

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)

Re:Honest question about security of unix systems

[mario_grgic]

The point is that people who opt to use some kind of UNIX as their primary machine are usually not technically clueless. The second point is that most UNIX distros (including OS X) come with hundreds of tools to monitor the system, inspect binaries etc. Also, good chunk of software is downloaded as source and compiled and the localhost. This also gives you a chance to look at code directly.

Re:Honest question about security of unix systems

[radish]

ActiveX in IE 5 was a mess. Luckily it was EOL 10 years ago, try running 10 year old versions of Mac or Linux OSs and see how secure they are. Current versions of IE are better, and of course, if you don't run IE at all you're immune from ActiveX attacks as no other major browsers support it (and the other occasional vector, Outlook, is crazy paranoid these days).

The full user account ACL/permissions stuff has been in mainstream Windows since XP (again - many years ago).

Windows also has no concept of data for execution vs data for storage

Complete rubbish.

You can do this in Unix as well but this is very uncommon today as you need to be root and was a hack of the early 80s when coders wrote in assembly to gain performance tricks. This is frowned upon in the Unix world as there are excellent libraries that can obtain speeds close to assembly.

Now you've lost me. People don't code in assembly in unix because of "libraries"? Coding in assembler has something to do with data/code seperation? You have to be root to run assembler-coded apps in unix? Do you have any idea what you're talking about?

Anyway, this was why Windows was less secure and why MS wants you to switch to .NET

What the...?? What has .NET got to do with anything? You can write native c++ in a .NET application, therefore use of .NET is not inherently more secure than anything else.

Re:Honest question about security of unix systems

[betterunixthanunix]

point is that people who opt to use some kind of UNIX as their primary machine are usually not technically clueless

That has not been my observation; the majority of Mac OS X users I know of do not know a lot about their computers, nor are they interested in learning. They purchased a system with Mac OS X because they heard that it was easy to use and would give them fewer headaches than a Windows system.

The second point is that most UNIX distros (including OS X) come with hundreds of tools to monitor the system, inspect binaries etc.

Tools which only the most experienced users can use to detect malware; even technically literate people may not be able to spot suspicious behavior.

Also, good chunk of software is downloaded as source and compiled and the localhost. This also gives you a chance to look at code directly.

Allow me to introduce you to my favorite programming contest:

http://underhanded.xcott.com/

Re:Honest question about security of unix systems

[TrancePhreak]

The guy who won said it was because Apple does not secure as well as MS. http://threatpost.com/en_us/blogs/transcript-charlie-miller-mac-os-x-pwn2own-and-writing-exploits-031810

Re:Honest question about security of unix systems

[VortexCortex]

A Windows system can be set up to have the same security model as a Unix system, and this has been recommended by Microsoft for years. However, so many legacy applications expect "administrator" privileges in Windows that this is not the easiest thing to do.

OS X's Mandatory Access Controls are a port of TrustedBSD. They are used to sandbox selected services in OS X to improve security, but not widely deployed yet for userspace software. You can configure them yourself using the CLI or using a third party application like "Sandbox".

MS can not be secured to the same degree -- a simple .reg file can disable UAC without warning, disable 64bit driver signing, and install a root Certificate Authority. This Java Applet exploit (A variant of which I've found on US machines attacking US bank accounts) shows windows security for what it is -- an after thought, easily disabled.

Both OSX and Linux security are far superior IMO than Windows, but I do have working "root" level proof of concept exploits for all 3 -- reported, and unpatched (except Linux, it was patched less than 3 weeks after I notified the devs...)

Sometimes security is about diligence, not just forethought.

Re:Honest question about security of unix systems

[spongman]

Only the security API for Windows NT had that modern concept. These api's were ported over to WindowsXP

no NT APIs were 'ported' to XP. XP was NT (version 5.1 build 2600 to be precise)

Re:Honest question about security of unix systems

[http]

I care about Solaris. I hates its forever.

Re:Honest question about security of unix systems

[Sancho]

For years you have been assuming something that isn't true. The basic Unix security model is nothing special.

I agree. But people spout this all the time on Slashdot.

The two main reasons for this are the lack of homogeneity among various Unix-type operation systems and the differing average competence level of Windows vs Unix admins.

Don't forget the differing purposes. When people start talking about "all the Linux servers out there" they're usually comparing it to all the Windows clients out there. If you're comparing a client to a server, there are a whole class of attacks that won't hit the server (probably) because you aren't browsing, reading e-mail on it, etc.

That said, I've seen plenty of Unix machines get compromised in various ways, from defaced websites to guessed login passwords. Trojans are fairly rare, though, and they seem to be the most common malware in the Windows world these days. Windows is vastly more secure today than it was 8 years ago, but you can't fix stupid without removing most of the user's ability to manage the machine (see iOS.)

Re:Honest question about security of unix systems

[Colonel Korn]

For years I have understood that Unix systems were less prone to security threats posed by malware/viruses/hackers due to the basic security model of unix. When naysayers said Mac was less prone because of marketshare, the argument against this is the large number of Linux servers which have never been successfully targeted by any major security threat. While this malware attack is a trojan (and more social engineering), are the naysayers actually correct that Mac is not been successfully attacked because of marketshare? If so, are unix systems not inherently more secure due to their design than other OSes?

Thanks!

When given equal incentives ($10k and/or a free laptop) to compromise an OS, OSX has always gone down first and most easily in the annual pwn2own contest. That's been a pretty clear indication that security by obscurity is Apple's main defense. "Unix systems" can be incredibly secure, but OSX is a rather flimsy incarnation of one.

Re:Honest question about security of unix systems

[devent]

Here is a very good article on security of Microsoft IIS vs. Apache on a Linux system:
http://www.theregister.co.uk/2004/10/22/security_report_windows_vs_linux/
Have fun reading.

Re:Honest question about security of unix systems

[bloodhawk]

certainly did, whats your point? The OP was posting that linux servers are not successfully attacked even though they are the most common internet server, The evidence clearly does not support that assertion.

Re:Honest question about security of unix systems

[RyuuzakiTetsuya]

errr...?

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, so its no longer trivial to exploit. In fact, I have lots of bugs in Safari that I easily could have exploited on Leopard but will be very difficult on Snow Leopard. So it used to be that that it was much worse, but now its mostly comparable (although still slightly behind)

bold mine.

Also.

Another question from the Twittersphere: What OS/browser pairing to you use? Do you do anything special (beyond default settings) to secure yourself while browsing?

You're not trying to pwn me are you??? Have you ever heard the saying about the cobbler's kids not having shoes? That's me, I'm afraid. I use Safari on OSX with no special settings. This isn't the most secure combination, by any stretch of the imagination, but I like it. It's designed by Apple engineers to be easy to use and 'just work' and it does. The risk of malware is low, and hey, I'm a security expert right :) The risk of a targeted attack is real, except I don't think I'm important enough to be targeted! So I rely on security by obscurity, I guess

That same guy also says he feels perfectly safe browsing on Safari ontop of OSX.

So?

Re:Honest question about security of unix systems

[benjymouse]

Windows was more insecure because Microsoft designed it to be be scriptable with com/dcom objects that apps can use to integrate into one another for app embedding. ActiveX are just objects that are designed from the ground up to be mix win32 applets inside IE.

COM/DCOM is a binary object model for creating object oriented API. A COM API is just an API following some specific conventions. The convention describes how an "object" must point to a type which must have a jump table. Nothing is more or less secure about it.

It is correct that ActiveX is a COM model for extending the browser (and other types of applications). As such you can compare it to extension APIs such as NSAPI in other browsers. Nothing inherently more secure or insecure about that. Now, MS *also* billed ActiveX for websites to extend the user experience because they needed a good response to Suns Java applets. In other words they encouraged websites to embed ActiveX controls into the sites and they made IE accept those controls.

The area to which ActiveX was applied was wholly unsuitable for binary components. It would be the equivalent of letting websites calling the Linux kernel API directly from the website after aking the user if that would be ok. COM or ActiveX as technologies were never the problem, indeed very few bugs have ever been found in the COM infrastructure. COM exists to this day and still forms a critical part of Windows infrastructure. But as it is just an API it doesn't make it more or less secure for that.

The whole object model is based upon using proprietary win32 code and api's so the programmers do not have to code as much. This was designed for lock in and accessibility everywhere with no security in mind..

With no security in mind? It is just an API. The methods being called are supposed to handle access control. If you implement an API an expose it as a plain old C API or as a COM API, you *still* has to consider security and access control. If anything, COM allows you to *better* secure your system because you can do so more fine-grained.

Unfortunately, this meant I can write some VB 6 app to call win32 functions to wipe your hard drive

As you can with a C API. It is just an API model. Nothing more or less secure about that.

and I can just copy the dll over as an activeX object in IE. If you have IE 5 or earlier all you would have to do is visit my webpage and it would run automatically on your computer and it would be trash.

No it would *not* run automatically on my computer. It never did that. You *always* had to accept a new control. Was it still a stupid model for extending websites? Yes. But stop lying about how it worked.

The iloveyou worm that hit it big in Outlook was a simple VBA script that copied the string and did a simply call to the user's address book.

Yes, a script which could call an API. The script should never have executed. That was a failure of Outlook, not a failure of Windows or COM. If another mail client allowed a mail message to execute scripts (e.g. bash) you would still be toast. You seems to be confused about what exactly are OS, API and applications.

Most of the win32 api was designed for Windows95 built on Dos which had no concept of user rights. Only the security API for Windows NT had that modern concept. These api's were ported over to WindowsXP.

So many things are wrong with these statements that I don't even know where to begin. But ok: Win32 API was built around the concept of handles and "objects". This is a model which quite easily supports securing the objects very fine-grained and has served Windows well. While Win9x didn't have much in the security department, the model is much more potent than a plain pointer API like in *nix.

When you want to call a method on an Win32 object you go through the handle. The handle internally p

Re:Honest question about security of unix systems

[benjymouse]

From that ancient (2004) article:

This reasoning backfires when one considers that Apache is by far the most popular web server software on the Internet. According to the September 2004 Netcraft web site survey, [1] 68% of web sites run the Apache web server. Only 21% of web sites run Microsoft IIS. If security problems boil down to the simple fact that malicious hackers target the largest installed base, it follows that we should see more worms, viruses, and other malware targeting Apache and the underlying operating systems for Apache than for Windows and IIS.

Ugh. Which operating system are the most compromised (2010): http://www.zone-h.org/news/id/4737

Linux 1.126.987
Windows 2003 197.822
FreeBSD 46.992
Win 2008 15.083
F5 Big-IP* 14.000
Unknown 7.840
Win 2000 6.097

Which servers?

Apache 1.095.982
IIS/6.0 195.154
nginx 40.640
LiteSpeed 37.795
Zeus 14.111

Seems reality caught up with that conjecture.

Re:Honest question about security of unix systems

[cbope]

Agree and I would add that one of the single biggest security issues in Windows is the fact that so many apps assume (require?) administrator privileges in order to work correctly. Running many apps as non-admin breaks them so that they are non-functional. This has improved somewhat in the last few years following Vista, which was the first Windows version to encourage you not to use the admin account for everything. In XP, practically everyone logs in as admin except in corp locked down environments, and this is where it's trivially easy to spread malware by drive-by downloads, etc.

Re:Honest question about security of unix systems

[devent]

Yes the article is quite old. But for the rest of your comment:
http://www.theregister.co.uk/2004/10/22/security_report_windows_vs_linux/#myth3
"One popular claim is that, “there are more security alerts for Linux than for Windows, and therefore Linux is less secure than Windows”."

The Zone-H have put down the bugs per system and server but not what type of security bug per system and server. It would be advantageous to see how many, for example, File Inclusion there was for each system/server and how long the File Inclusion bug was open for each system/server.

Plus, Zone-H talks about all the system, not only the httpd server and the kernel, but also for example, about CMS systems, like OsCommerce CMS. You don't want to say that some remote upload flaw in some CMS system have something do to with Linux or Apache?

On top of it, there was never a security breach like the CodeRed Worm (2001, 359,000 hosts), for Linux/Apache, or the other worms and trojans, you can look up at http://en.wikipedia.org/wiki/Notable_computer_viruses_and_worms
Almost all since 1995 are for Windows.

So, in conclusion, no one have reality caught up with Windows by any scale.

Re:Honest question about security of unix systems

[ogdenk]

apache != unix

And to beat the old drum, most of the exploits aren't root level, especially on hardened servers running something like OpenBSD.

And to speak like a Windows weenie, UNIX and UNIX-like servers have been the dominant platform of choice for internet-facing services (web and otherwise) since the early-mid 80's across a dozen CPU architectures. Of course they'll be the most widely exploited. At least you can usually plug a UNIX box into a network unpatched without it becoming infected in minutes.

UNIX systems are much less prone to easily deployed malware that requires no user assistance. You can't code around stupid.

Re:Honest question about security of unix systems

[ogdenk]

I don't think running "vi" is officially sanctioned or supported by Apple. Or setting a different login shell..... or even opening Terminal.app without a Level 2 support rep explicitly telling you to do so with Steve Jobs on the other line.

Re:Honest question about security of unix systems

[Guy Harris]

I really don't know where you get this. Are you just making it up? DEP (Data Execution Protection) is supported by x86

Well, to be fair, page-level "you can't execute code from here" is only supported by newer x86 processors - although "newer" isn't all that much newer, these days - but if you can shrink the size of the code segment so it excludes as much of the writable region of the address space as possible....

But, yeah, the stuff you're responding to is largely "Windows is just a thin wrapper around DOS" nonsense that's at least 10 years out of date.

Yes, in Windows XP the first user created was unfortunately an administrator by default. But what does that have to do with "assembly calls"? The stupidity of having the user run as admin by default is not something which is defined by the API.

I assume he's referring to some Windows applications that allegedly require admin privileges - but it's not as if the entire Win32 API requires admin privileges (and, as you indicate, that has nothing whatsoever to do with "assembly calls"). And Windows XP isn't the only OS that gives the first account created admin privileges - another one that does so has its name in the title of this article....

I am so sick of morons pretending to know about OS design, OS security, Unix and Windows. You are clueless, and slashdot has you modded as 5 - insightful. Doesn't bode well for the "nerds" site.

You must be new here. :-)

Re:Honest question about security of unix systems

[makomk]

You should at least try using a search engine before making a remark like that:

https://help.ubuntu.com/community/Linuxvirus [ubuntu.com]

Funny story: I have actually come across a Linux ELF virus in the wild. It was so ancient and badly-written that it caused most of the programs it infected to crash, which kinda blew its cover. Pretty much all of the Linux viruses out there are ancient, proofs-of-concept or both - several of them you even have to compile from source yourself!

(Interestingly, that page's description of the BadBunny virus seems to be a bit off... it's actually a cross-platform OpenOffice macro virus what runs on Windows, OS X and Linux.)

Re:Honest question about security of unix systems

[TyIzaeL]

worst case is that the user's files are all gone.

This is just as bad (if not worse) than losing the operating system for most users today.

Re:Honest question about security of unix systems

[benjymouse]

Ok, people spout it all the time because it *IS* seriously superior to Windows.
To put it another way, the Unix model isn't special, but the Windows model is especially bad.

Still just hand-waiving. Empty claims. What *is* it that is so superior?

I'll tell you what, take a fresh Windows machine, and connect it directly to the internet, and see how long it runs without getting infexted.

Since XP SP1 Windows TCP stack has been protected by default by the built-in firewall. You are a decade late. I can take any Vista or Windows 7 and hook it up - it will not get infected even though it has not been patched at all.

Even when you compare Windows 7 with a recent version of Mac OS or Linux, the result is similar, though not as drastic.

Citation needed

On the server side, there is Trusted BSD, SE Linux, and Mac OS has a similar sandbox system. windows? Nothing officially supported, last I checked.

When did you last check? 2002? Windows Service Hardening (see for instance http://technet.microsoft.com/en-us/magazine/2007.01.securitywatch.aspx) has been standard for services since Server 2003. Windows always (the NT line) had proper fine-grained tokens per process - unlike the bit-security in *nix and Linux which had to have SELinux or comparable solutions bolted on afterwards (you do realize that *nix security model is *still* centered around merely securing the file system, right?)

Service hardening uses the fact that each process has a full token and created a security identifier (SID) per service. The resulting privilege list is the union between the actual account the service executes under *and* the service account. Which means that hardened services by default are sandboxed - they can only use resources for which they are explicitly granted access - regardless of whether they run under the Local System account (root). All access to resources - even in-memory objects through handles - already checked the security token. This is just one example of the opposite of your claims: Windows security model was (and still is) more advanced and capable than *nix.

What you need apparmor and loadable security modules for was always possible in Windows.

On top of that, because you can *grant* privileges in Windows (unlike in *nix where you have to *be* root to access certain parts of the OS/kernel), more services can actually run with lower-privileges users. The accounts Local Service and Network Service which runs most services are actually "local users" in terms of privileges.

Re:Honest question about security of unix systems

[mario_grgic]

I'll give you that OS X users are a polarized bunch, either completely technically clueless or alpha geeks and very little in between.

On the other hand it's not really that hard to monitor your system from either the system itself or from outside. If nothing else OS X comes with GUI tools to record and inspect packets, DTrace probes, and of course the standard UNIX command line utils. And if that's not enough you can always record stuff at your router level. But I think we are getting seriously off topic here.

My answer to the OP is still the same. You are much less likely to get infected without falling pray to social engineering using some kind of UNIX (it doesn't have to be obscure either, even the most popular desktop UNIX like OS X) than Windows.

By the way it's easy to write bad C code, and the code solutions on that site are not innocuous looking to me. You don't really need to go into that much detail. If you download say a utility to sample colors on your screen and that utility ends up doing heavy access to your file system, then something is not right. That's all you need to know initially to get suspicious. Same if it started accessing some .ru web site and uploading packets there....

Re:Honest question about security of unix systems

[blahbooboo]

Thanks everyone for a very interesting and informative discussion :)

Re:Honest question about security of unix systems

[drinkypoo]

Actually if you ask any security expert they'll tell you that they've never seen a virus because most people have NEVER seen an actual "Virus".

Viruses are pathetically common in the PC Warez scene. Unfortunately this bites actual purchasers of software occasionally when we go looking for a No-CD check. If you can't find it on gamecopyworld you might then go looking with google. If you're lucky you'll find it on some other game-specific site. If not you might go look at cracks.am or cracks.ws, if you have noscript. If you still can't find it you might just go to astalavista and who knows where you might end up to get that game patch? And the patch may well work, but it might also be carrying an actual virus.

The first thing I wanted to say was "I've seen tons of actual viruses on MacOS 6 and on AmigaDOS" but of course that doesn't contradict your point in any way.

Re:Honest question about security of unix systems

[drinkypoo]

Windows was more insecure because Microsoft designed it to be be scriptable with com/dcom objects that apps can use to integrate into one another for app embedding.

Oddly, MacOS since 7 has had scripting, and Unix systems have always had scripting. And if you follow the Unix Way(tm) then your programs are designed to produce output that can be snarfed into another program, and they are scriptable. While there's plenty of tools on Unix systems which express functionality only through a GUI, there is a preponderance of processor-frontend combos that lends itself to the same sort of behavior. However, this is generally orthogonal to the problem of security because of the Unix filesystem permission model, which generally discourages users from writing outside of their home directory, and indeed which is set up to not require it. It doesn't particularly matter if you are able to run processes which you're not supposed to be running on Unix systems because everything is a file. This tradition persists even in modern analogues of Windows functionality (yes, I said it) such as gconf, or in other systems which could have had a baroque configuration database such as PAM.

Windows NT, on the other hand, has to bear the penalty of following Windows for DOS, which in turn carries the weight of DOS itself. Consequently we have ended up with a system which still makes decisions based on file extensions, but more relevantly to this conversation, we have a system which expects users to be writing into odd directories. This problem has more or less wrung itself out over time, though, so it's unclear what Microsoft's excuse is today.

Re:Honest question about security of unix systems

[toadlife]

MS can not be secured to the same degree -- a simple .reg file can disable UAC without warning,

Bullshit. The process that invokes that reg file still must have the necessary permissions needed to disable UAC.

Re:Honest question about security of unix systems

[catmistake]

Of course my post was tongue in cheek. All systems have security susceptibilities. But in Windows, we have the entire gamut. In UNIX, its mostly brute force login attacks (I'd say this is 90+% of the vulnerability, at least), trojans, and root kits. Saying these systems are equally susceptible is being intellectually dishonest. If there are 300,000 ways to skin a dog, and more than one way skin a cat, which is more susceptible to skinning? All systems are susceptible... but in truth, not all systems are equally susceptible.

Re:Honest question about security of unix systems

[CheerfulMacFanboy]

So until this year, applications on Apple were way easier to exploit than Windows. This is because Apple had weak ASLR and no DEP while Windows had full ASLR and DEP. This year, Snow Leopard has DEP, s

Of course this year, Windows' full ASLR and DEP have been proven useless by a Flash vulnerability (and so has Chrome's sandboxing).

Also from the same article:

What OS/browser pairing to you use? Do you do anything special (beyond default settings) to secure yourself while browsing?

You're not trying to pwn me are you??? Have you ever heard the saying about the cobbler's kids not having shoes? That's me, I'm afraid. I use Safari on OSX with no special settings. This isn't the most secure combination, by any stretch of the imagination, but I like it. It's designed by Apple engineers to be easy to use and 'just work' and it does. The risk of malware is low, and hey, I'm a security expert right :)

Re:Honest question about security of unix systems

[Kitkoan]

About the "also from the same article" part of your comment. The article is from 2009, so its a bit out of date (I referenced it since it was his 3rd/4th time winning and he addressed the question about the prize). Thing is, in the 2 years, Apple has yet to address this security problem and has also seen a rise in Apple malware. So while his comment about Apples security still stands (its an OS issue that Apple isn't addressing), the malware comment is no longer valid.

Re:Honest question about security of unix systems

[CheerfulMacFanboy]

About the "also from the same article" part of your comment. The article is from 2009, so its a bit out of date (I referenced it since it was his 3rd/4th time winning and he addressed the question about the prize). Thing is, in the 2 years, Apple has yet to address this security problem and has also seen a rise in Apple malware. So while his comment about Apples security still stands (its an OS issue that Apple isn't addressing), the malware comment is no longer valid.

That article is from 2010, Windows full ASLR and DEP have still been proven useless, you can't even tell what " this security problem" is supposed to be (because he clearly says it has been fixed), and you are still far more likely to come across Windows malware. You are the definition of a sore Windows loser - which is of course an oxymoron.

Re:Honest question about security of unix systems

[Kitkoan]

Awww... did I hurt your feelings? lol. Sorry, but to start with, I'm a linux user, if only you had tried reading some of my other posts, but with comments like "You are the definition of a sore Windows loser" it tells me your less interested in facts and more interested in just putting other people down to make yourself feel better. Its quick, knee-jerk insults like that shows me you lack maturity and are really just a blind fanatic but I'll play ball with you anyways since I'm not that fast to turn up my nose to others whom don't blindly agree with anything I think/feel. (Granted my money is now your answer will have a knee-jerk insult to me using Linux, but hey, I've heard worse then you can think to say.)

As for the security problem, if you had noticed in the article, he mentions that OSX has DEP. Thing is, its not full DEP and he never mentions about ASLR because its a half-hearted attempt on Apples part. As for full ASLR and DEP being proven useless on Windows, your mistaken. Windows has proven to be more secure because of this, it is why it still take much more then 30 seconds to break into it (unlike OSX). It is due to things like the ASLR putting things like passwords in random location that makes it that much more harder.

I admit, I forgot it was a 2010 article, but still OSX isn't as secure as Windows regardless of what you wish to believe.

Re:Honest question about security of unix systems

[CheerfulMacFanboy]

Awww... did I hurt your feelings? lol. Sorry, but to start with, I'm a linux user,

Nope, why should your lack of clue hurt my feelings? So you are one of the losers who think that they are safe from malware because he runs Linux, ey? Just you wait...

Re:And so it begins...

[Guy Harris]

The slow, but inevitable slide to Mac OS X being locked down in the exact same way that iOS is.

First they block apps in the name of protecting users from themselves... Then they just slowly increase the definition of "harmful apps."

If by "first they block apps..." you mean "first they warn you that an app might be harmful, suggesting that you drag it to the trash, and providing a one-click option to do that from the warning dialog...", yeah.

Re:And so it begins...

[MobileTatsu-NJG]

The slow, but inevitable slide to Mac OS X being locked down in the exact same way that iOS is.

Wake me when they actually make it so you cannot execute scripts in OSX. Bonus points if you can explain how you're gonna make Flash movies or do any sort of programming on a Mac with iOS-like restrictions.

Chet

[kervin]

I haven't heard that name since I stopped reading "Hardy Boys" as a kid.

Re:From no malware on Mac

[linumax]

are you really telling me that since OS X has gotten two instances of malware, after being in use for over a decade, is the same as what has happened with windows? Really?!?

No I'm not. That is not what I said at all. Did you reply to the right comment?!

There really isn't a cure for this kind of thing.

[bmo]

Userspace malware is nothing different than Purple Gorilla Bonzi-Buddy shit.

There is no OS or kernel patch that protects against stupid.

I can install the SELinux scripts, and there is nothing preventing me from utterly hosing the system as administrator or my own account with my own permissions. You would have to make a read-only system, maintained by someone not-me. This is what corporate IT does.

I see a market for itinerant bonded neighborhood sysadmins should people get over themselves and admit that joe-user can't handle his own computer at home.

--
BMO

Re:And so it begins...

[betterunixthanunix]

explain how you're gonna make Flash movies or do any sort of programming on a Mac with iOS-like restrictions.

That is something that only professionals who are willing to pay a premium for their computers need. All those home users can just get by with applications from the App Store.

The Apple concept of computing is that home users should treat their computers like appliances: plug it in, and never worry about technical details. Sure, professional and "power" users demand more, but they represent a very small fraction of Apple's target market at this point, and Apple can get away with charging them more (they are likely to have paid for a higher end system to begin with). The consumers who just "want a system that works," which is obviously not a "PC" but is a "Mac" (which is not a personal computer and which obviously does not run Windows) will get a locked down system, and Apple is betting (perhaps wisely) that most of them will never even notice the difference.

Keyloggers need root

[SuperKendall]

But it doesn't matter if you just want the piece of malware to do its job: e.g. key-log and scan for personal information

Scanning no, but to intercept keystrokes would require root access.

in addition to keeping a self-updater that may eventually pull an update that does allow for the use of an escalation exploit.

Pretty sure it would need root to install even as a start-up item, and it would be pretty visible if it did so.

Re:Keyloggers need root

[SchroedingersCat]

Scanning no, but to intercept keystrokes would require root access.

Common misconception. Local access present creative opportunities for phishing from code injection to creating facades to existing apps.

Re:Keyloggers need root

[SuperKendall]

Common misconception. Local access present creative opportunities for phishing from code injection to creating facades to existing apps.

That's a far cry from generic keylogging though, you have to tailor access per app.

Re:Keyloggers need root

[SuperKendall]

On Windows for example you'd inject a generic DLL which hooks (via jmp insertion) 1 WinAPI function. It would work against all apps not using raw input.

And on OS X the equivalent would not work without root access.

Re:Keyloggers need root

[TheLink]

in addition to keeping a self-updater that may eventually pull an update that does allow for the use of an escalation exploit.

Pretty sure it would need root to install even as a start-up item, and it would be pretty visible if it did so.

By default root access is not required to start a process in the background:
http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man5/launchd.plist.5.html
"~/Library/LaunchAgents Per-user agents provided by the user."
http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/crontab.1.html
http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/at.1.html
The above are the proper ways of doing it :).

Not sure but might also be able to use/abuse stuff like "~Library/Screen Savers"... But hey let the malware authors go figure out the rest for themselves.

I'm not a malware writer but it sure does not seem that hard to write malware that sends spam and does DDoS for OS X. For installing it, pick an exploitable bug (or two) in Safari for "drive by", or take advantage of gullible people ("Your system is infected. You need to run this antivirus scanner. Follow these steps.").
Could use perl or ruby (OSX includes stuff like OpenSSL::PKey::RSA which you can use to make it harder for others to take over your botnet)

It's definitely not harder than Windows. I bet many Slashdotters would actually find it easier to write stuff for OS X than Windows - things like perl, python, ruby, bash etc are all built-in. They could churn out a different version every other hour, or even write a program to write different versions...

Would be interesting to see if the security researchers and malware scanners can cope with polymorphic perl :).

Re:From no malware on Mac

[je ne sais quoi]

Sorry, I guess I read your comment as being more invective than it actually was. The point I was thinking of was that Apple ran the "Macs don't get viruses." add in 2006. That's five years ago, when there really was no widespread malware for OS X. If we're going from no viruses from 2000-2007, to a trojan on pirated software in 2008 and now a social engineering attack three years later in 2011... it's not a pace of development that I'm particularly worried about.

Re:And so it begins...

[Anonymous Coward]

Bonus points if you can explain how you're gonna make Flash movies or do any sort of programming on a Mac with iOS-like restrictions.

Same way you do programming on the iPhone: pay $100/year for a developer license.

And if you think they aren't going down that road already, remember how developer tools used to come with the Mac OS X DVD?

You can no longer download Xcode for free. It now costs $5 and is only available with an Apple account off the Mac OS X App Store. (Or free from the App Store if you already have a developer license, but you still need to get it through the App Store.)

Apple is already down the path to locking down Mac OS X. This is just another step.

Re:And so it begins...

[zippthorne]

And yet, Apple Desktops and Laptops come with a fairly complete BSD Unix toolset, including several scripting languages (perl, python, ruby, shell, probably some others I don't know about, applescript, automator, a gcc compiler...

How much of that stuff can you get on Windows' default install?

Now, it's apparently true that Xcode is no longer a free download (although I suspect it's still on Snow Leopard install disks...), but let's wait to see what the next version has to offer before we assume they're just taking it all away and locking everyone down to toy computers with no capability for hobbyists and tinkerers.

Re:And so it begins...

[breser]

Xcode is most certainly still a free download. Sure you have to register for the Mac Developer program but that's really not that big of a deal. You probably have an Apple ID already so signing up is just a matter of logging into your Apple account.

http://developer.apple.com/xcode/

"Download Xcode 4 for Free. Xcode 4 is a free download for all members of the iOS and Mac Developer Programs. Log in to your account to begin the download."

Now developing anything for iOS is a whole different ball of wax.

Re:There really isn't a cure for this kind of thin

[Ixokai]

There's no complete cure, no; but there's stuff that you can do to make it better. Apple updating the security mechanism to get its malware definitions on a daily basis, instead of as part of the normal Software Update cycle, is a very good move. It won't completely fix things, though, of course. You're absolutely right, you can't stop stupid.

But you can certainly make stupid _worse_: and Safari's "open safe files" feature (especially defaulting to yes), which includes dmgs (think, isos kinda for non-Mac folk) and archives is an especially stupid thing to do and makes the impact of stupid users, worse.

I was kinda hoping they'd at least flip that default when they addressed this issue. But I'll take the daily updates.

Re:And so it begins...

[betterunixthanunix]

Well, keeping in mind that Windows is not actually intended to be compatible with Unix (despite the "better Unix than Unix" remark from Gates), it does ship with at least two scripting languages: JScript and VBScript, and I would not be so quick to deride the power of JScript as a language. Also, to the best of my knowledge recent Windows versions include PowerShell, which I hear is pretty good although I have not tried it myself.

As for Mac OS X shipping with a BSD toolset, this was mainly to allow Apple to market it as a Unix OS and to placate "power users" who like being able to drop into a terminal and write scripts. Apple cannot really ignore power users if they want to compete in the market for expensive desktops and laptops. That being said, Apple's approach to personal computers is still based on those systems being appliances that the user never opens up, and the iPad/iPhone/* line exemplifies that. My prediction is that over the next few years, we are going to see the Mac OS X that retains power user appeal to be pushed into more expensive, high-end lines of computers, with the low and medium range of Apple's offerings being filled with iOS or some sort of iOS/OS X hybrid, and Apple's non-"pro" notebooks will not come with shells or scripting environments.

Re:And so it begins...

[The Dawn Of Time]

Slippery slope arguments are boring and stupid. Please work on your shtick.

Re:And so it begins...

[russotto]

Sure you have to register for the Mac Developer program but that's really not that big of a deal.

The Mac Developer program is now $99/year.

Re:And so it begins...

[PyroMosh]

I don't agree that Apple is on the way to locking down the Mac like iOS.

But your assertion that it's impossible somehow is just silly. How are apps developed for iOS? Special developer licenses. If Apple wanted to do it, they could. The only thing keeping them from doing it is momentum of public will. Users would revolt if they changed the system now. There was no entrenched freedom when Apple entered the mobile world. Well, except for users of mobile platforms that predate iOS like Windows Mobile, but they represent a VERY small number of people...

I hope Apple has learned a lesson from all of this

[antifoidulus]

I hope Apple takes this incident to heart and makes one minor, but very significant, change to how their OS(or more specifically, their OS setup process) works: namely that the default user should not have admin privileges! Currently an out of the box Mac will prompt the user to set up an account, and that account will have admin privileges. To actually set up another account the user has to know enough to go into sy

Hopefully in Lion they will, at the very least, explain to users that they should set up a non-admin account to do their everyday computing and only use the admin account when they need to do admin things.....

Re:And so it begins...

[breser]

Oops, that's right. It's XCode3 you can still download without paying anything. As others have pointed out they're still shipping XCode 3 on the install disks.

Burried at the bottom of that page is this "Looking for Xcode 3? Download Now" which directs you to log into a Apple Developer Connection account, which is free to get.

Re:And so it begins...

[ogdenk]

*cough* tcl/tk *cough*

Though I'm surprised, I'm glad OSX still ships with it. I like tcl personally.

Re:And so it begins...

[kozchris1]

Free download no but..... Xcode comes with every install of OSX. http://www.apple.com/macosx/developers/#xcode The App store deal is if you want to get the latest and greatest version of Xcode. I'm pretty sure that if you pay the App Store $5 for XCode that it includes lifetime updates. So you have a couple of choices to get XCode: stick with the Xcode version that came with your Mac OS install, join the dev program for $99, pay $5 bucks at the AppStore or update to the latest Mac OS every time it comes out.

Re:And so it begins...

[MobileTatsu-NJG]

How are apps developed for iOS?

They are written on machines that aren't locked down like iOS. You cannot, for example, create an iPhone app from the iPhone or any other iOS device. Nothing is created on iOS devices because Apple explicitly forbids running 'execeutable' types of data.

If Apple wanted to do it, they could. The only thing keeping them from doing it is momentum of public will.

That and the fact that OSX wasn't designed to run in such a restricted mode. The customers would not be able to run anything they have now!

Nobody has really thought through the ramifications of trying to actually maintain something like a desktop OS with iOS'ish restrictions. Can't be done. What can be done is to make a desktop or laptop version of iOS. When that day comes and people actually accept it, great. But what then, are Windows machines going to be the development machines of choice?

Re:From no malware on Mac

[VortexCortex]

Wait till it has the popularity / market share of Windows... Then we'll talk.

It's a well known fact that crackers only crack what crackers own. As a white-hat hacker/cracker I had never discovered any exploit vectors on Mac OS or iOS -- I also never owned an under-powered/over-priced piece of Apple hardware... (Yes, I just bought a machine that has higher specs than any notebook Apple sells, for less than half the price of their inferior model... Quality? Major components are the same brand Apple uses.)

Now that I have a cross platform application to support, I have a couple of Apple development machines with OSX on them -- I find just as many "oops OS/App crashed" bugs for OSX than for Linux or Windows simply due to the fact that both Linux & OSX have many tools/libs in common, so any bug I find when coding that affects the external Linux libs may exist in the OSX libs too... The number of Windows vs Linux bugs I discover is about the same, maybe a smidge higher on the MS side.

Only difference is that when I report a Linux bug, I can (and usually do) submit proof of concept exploit code (for testing) and a patch that prevents it (unlike Apple or Microsoft OS specific bugs -- I only occasionally create proof of concept exploits, but can not submit any patch without source code).

Without fail the lib will be patched in a month or less (typically 1-2 weeks -- days!) or the Linux kernel is patched in the very next release (for binary distros -- for the source based distro I use the fix is working IMMEDIATELY). With MS, the average is 6 months to a year or never for a patch.

Of the 31 bugs I've reported to MS in the course of 9 years, 18 are still exploitable (even though they "rewrote everything" when they made Vista/7). Of the 25 bugs I've discovered in Linux over the past 10 years (4 of which also affect libs on OSX), 23 have been patched (one no longer applies, and with 3.0 kernel, I suspect the last exploit will be avoided too). Of the 10 bugs I've reported to Apple in the past two years, 6 are still exploitable (4 of which were FLOSS libs that were patched w/o Apple's input -- that's right, Apple hasn't fixed a single bug).

Others are not as scrupulous as myself -- I've been offered thousands of dollars by black-hats/script-kiddies for just a few of my OSX exploits, only hundreds for the Windows exploits (high supply & demand), and none for the Linux exploits (they get patched too soon to be worth much -- Yes some of these do apply to servers where Linux has a large market share, so the "no one uses Linux" argument does not apply, esp in Sony's case).

Clearly there is demand for OSX exploits, and it is only a matter of time they approach MS like levels: Every OS is exploitable! -- Let's hope they adopt a good update policy (more like Linux than Windows), but at this point I wouldn't hold my breath...

Re:And so it begins...

[spongman]

How much of that stuff can you get on Windows' default install?

JScript/VBScript interpreters, C#/VB.NET/JScript.NET compilers, PowerShell, MSBuild.

Re:I hope Apple has learned a lesson from all of t

[digitallife]

Almost completely irrelevant.
When the 'admin' user attempts to do anything requiring root privileges, the system prompts for a password. If you are running as a non-admin user, you just have to fill in a different username in the password box that pops up (that of a admin account). If you don't know the admin account password, then you are obviously not managing your computer, and if you do... Then you have to type in an entire extra word to get root privileges! Wow!

Re:There really isn't a cure for this kind of thin

[Culture20]

Userspace malware is nothing different than Purple Gorilla Bonzi-Buddy shit.

Purple Gorilla Bonzi-Buddies that quietly wait in the background downloading exploit code for the privilege escalation du jour. Once there's userspace malware, user-intervention isn't required; sometimes not even a login since it can use the system's scheduling (cron/schtasks.exe) to download when the user is logged out, and schedule a new exploit attempt immediately after download.

Re:There really isn't a cure for this kind of thin

[VortexCortex]

My mom refuses to ditch Windows despite nearly everyone else in my family (including grandparents) using Linux...

She's the only one that still gets malware -- the answer was simple: Windows Steady State -- Restores the state of the machine each boot!

...but, MS discontinued it. So, now the answer is simple: Run it in a VM. When a virus/malware/spyware "event" occurs ("I don't know how it happened, I didn't install ANYTHING" -- Yes you did Mom...), I pull the data into a duplicate of a known clean VM image, update the system, scan data for viruses and it's good as new.

Other family members using Linux still have loads of "free" stuff installed that they don't need (from the repositories), but at least it's not malware.

Hint: People want free stuff -- Give them an OS that has it easily available.

Re:And so it begins...

[ogdenk]

Apple entered the mobile world in the early 90's with the Newton. By 1997 it actually didn't suck. With addons it could make phone calls, etc. Kind of a pity it was axed, the OS was neat. Handwriting recognition sucked horridly from the onset and the device's rep never recovered, even after they got it working fairly well on the StrongARM-based MP2000 and MP2100 after a couple updates. The SA110@162-220Mhz was no slouch for those days in a handheld. 2 PCMCIA slots ruled too. What they missed is most people who don't understand tech abuse it and making a sharp stick the implement for manipulating to UI for average Joe with no real touch support was silly. MS followed suit. So did Palm.

If you think $99 a year sucks for the iPhone, you should have seen what the Newton Toolkit developer environment cost. Free programming environments were unheard of outside of UNIX circles except for the BASIC interpreter your computer came with (ATARI BASIC WOOOO!!!!). Even most UNIX environments didn't come with FREE development environments. Like Solaris for a long time, except a few scripting languages. ESPECIALLY for mutant embedded operating systems. VxWorks, QNX, etc..

I'm sure you can find GCC binaries for OSX outside of XCode. And I'm sure it's easier than trying to get GCC 2 to compile with DEC C under Ultrix/VAX. Quit crying. Some things cost money. Don't like it, download GCC and write another IDE. Me, I'd rather spend $5.

But if I have to pay them for THEIR development environment.... last I checked, there could be no other competing development environments within the walled garden of the App Store on iOS. I would be incredibly pissed off to see this happen on OSX.

Better Yet

[Greyfox]

To get admin privs, you should have to call Apple support. They, upon sufficient justification, shall issue a one-time sudo password. If the deem it unnecessary for you to have admin privs at this time, you don't get them.

That would solve a lot of problems.

Re:From no malware on Mac

[ogdenk]

None of these are viruses.

Any douche can write a destructive trojan that will get by a scanner for a while. Seriously. Doesn't matter what platform your using.

Not a real virus. By ANY..... STRETCH......OF......THE......IMAGINATION.

I saw some real viruses under Classic MacOS in the System 6 and System 7 days. So far none for OSX.

No amount of tech can stop people from clicking on something destructive. Trojans do NOT count as viruses. No OS update or security software is going to make users smarter. Sorry.

Only cure is to remove access

[Sycraft-fu]

If Apple does get their future, where everything is part of the Apple walled garden and all apps, media, etc have to come from Apple then it would be possible to stop user infections. If the screening process was through enough, you could make sure nothing malicious ever made it through. Of course that is a big if, people could get creative to get around it. There's also the fact that many of us are not thrilled with the idea of one company being the gatekeeper of everything.

Short of that, nothing you can do. In fact, little you can do about system level malware. Most people don't pay attention to privilege escalation prompts. They just hand over their password or click ok when asked because they view it as another hoop to jump through.

When you exploit the user, there is little that can be done. That is one of the reasons I'm a big proponent of on access virus scanners. They are not perfect, but they can help protect users against themselves. Since they (in theory at least) only stop bad things you can train users "When this says it is bad, you need to get rid of it."

Re:I hope Apple has learned a lesson from all of t

[RyuuzakiTetsuya]

After playing around with Vista and it's UAE when it first launched, I was impressed by it's UI to make it seem very daunting and scary. I hoped it would train users to hit escape and find something better to do than shoot themselves in the foot.

Guess I was wrong...

Re:And so it begins...

[Guy Harris]

They're not when they're right.

And they are when they're wrong. (Hint: "suggesting that something is harmful, and that you remove it, and offering a button to remove it, along with a Cancel button for those who choose not to remove it" != "blocking something".)

Re:And so it begins...

[0ld_d0g]

If you want Microsoft to bundle more things maybe you should volunteer to pay for their anti-trust and anti-bundling lawsuits ;-)

But to the main point, I think what hes trying to get at is the scary walled garden future of controlling what applications get installed. They're trying to push that with the app store on the desktop OS. Remember this about mainstream users, geeks are a minority. Geeks usually will find a way to get around those restrictions. For e.g. if you had to sell your software and the first step to installing your software was jailbreaking your MacBook to install it, you ain't gonna make that many sales. The alternative is to stick it in the apple app store and pay a tax to apple for letting them list your app. Because they can collect a fee on every sale I'm sure they are going to market this store as THE way to install software on the Mac. Just like most users are used to going to app store to install apps on their iOS device they are going to be conditioned to using apples new store on the desktop. Personally its a tough choice between letting unsuspecting users download and install any software off of a random website and risking potential malware infection and the walled garden approach of only allowing "safe" apps.

Ofcource.. unless you're claiming that because osx ships with the compilers it is "librerating" users by allowing them to spend several man-years writing their own software in C :-P

Market share still applies

[thegarbz]

The problem is ultimately you're still ignoring the weakest link which is the human factor. While the general security you mention is very real the last few viruses that got into the house were the result of someone physically double clicking something and then answering yes to a security question. This type of malware has nothing to do with the security of the system and every system is susceptible to it. Sure the VB script on the mac may not have had access to %obscure_API% but the damage is just as bad if not worse if the result of it is to encrypt your user files and then hold your data for ransom.

Windows isn't great, but Mac OSX's lack of malware really IS due to marketshare. Why would anyone go to the effort of writing something when there's a very real risk that few people will get the chance to execute it. Look at the Android platform. Security on it is quite good, yet every week we see some story about malware all of which is installed by either the user de-activating the protections, or blindly allowing some offline app access to the phone dialer and SMS.

Re:I hope Apple has learned a lesson from all of t

[Ixokai]

Not exactly.

That user doesn't have admin privileges; that user is in effect, in the sudoers file. They can authorize admin privileged actions. The default user can't modify or tweak anything in /System. But they can be prompted to allow elevated access to allow things to write into important parts of the system.

And frankly, that SHOULD be the default. It doesn't make any sense at all to be more restrictive then that. Yes, you should not run as root, or administrator on windows, in your day to day stuff. But in your regular, day to day stuff, on your machine-- you will in the normal course of events need to authorize programs to install globally or tweak system prefs or whatever else on occasion.

No one will EVER learn the "lesson" you want them to be taught. In a secure environment, you may have your regular user, who can't even possibly access (even via sudo) admin power, and an entirely separate account you use to do the system configuration and application install tasks that need higher authority. That will NEVER happen on user-focused machines. Its a frankly absurd notion.

Yes, that means machines will always be susceptible to stupid people running crap that they don't mean to download or are tricked to downloading, and that means there is no /solution/ to the problem of malware. In truth, even with such a system, you wouldn't solve the stupid. You can't solve the stupid.

The default user that people operate on, and which programs they naturally, passively run under -- should not have admin access. Of course not. Even Microsoft gets that, though their implementation of the escalation process is less then ideal. But if you expect someone to sit down on their desktop machine and ever have more then a single account, you're -- out of touch. That account should not have direct system-level access, no: but no one but a tiny minority of power users will ever accept having to set up some entirely separate account that can escalate privileges.

Its not that people are stupid, or careless. Its that you're expectations are absurd. Security and ease-of-use are opposing concerns. Everyone with any sense knows this: in some situations the demands of security are such that we force the pain on usage, in others we try to find a balance which isn't as difficult.

There will never be a world where people will have two separate accounts on their home machine and that they need to decide to go from one account to another to make changes or operate said machine. People will simply use the tool given them, as they understand it is to be used.

Even on linux, more is rarely expected outside of highly secure environs. Sudo is the norm. Yeah, your account can't do much, but you can explicitly invoke its elevation with your own same password -- and that's fine. Home machines will never, ever, be bastions of secure practice.

Its just not worth the pain in the ass to regular people doing regular things. Is it as good as it can be, as secure as it can be? Not yet, but they are working on it. Windows has its UAV method of privilege escalation that is overly in your face so its too easy to hit 'yes' without thinking; linux has its explicit 'sudo' which is fine (and with GUI helpers in certain environments), and Mac has its own escalation prompt. Is this paradigm of the default user being a sudoer ideal? Maybe not. But its usable, and better then the situations where everything runs as root/administrator.

Usability frankly trumps security. You can not honestly expect users to give up much on their home systems, usability wise; or you're just out of touch with reality.

Re:I hope Apple has learned a lesson from all of t

[maxwell demon]

After playing around with Vista and it's UAE when it first launched, I was impressed by it's UI to make it seem very daunting and scary.

Did they include a death's head symbol?

Re:And so it begins...

[makomk]

I'm sure you can find GCC binaries for OSX outside of XCode.

Requires Apple's special forked version of GCC as I recall, and Apple are moving to LLVM so that they don't have to release the source code to their compiler at all.

The web ad is still live

[Megane]

I ran across it this past weekend. I tried it just now and the ad is still being served via the oddsiti URL. (Not the actual content, that's on a numbered IP machine.)

I suggest you add "||oddsiti.com^" to your adblock preferences, as any ad provider that lets this kind of crap through deserves to be blocked, not to mention allowing ads to be served from numbered IP addresses.

For those of you who want to see it, here it is, but I'm adding spaces to keep the link dead without manual editing:

http://oddsiti . com/?id = 541894

FYI

[Megane]

It's being served by a different numbered IP address than it was the other day (was on a 178. address now on a 212. address), and I don't think this is MacDefender, but some other scareware trash that's just as stupid.

Re:And so it begins...

[Alioth]

Problem is those scripting tools are all closed source and proprietary. At least the ones that ship with the Mac are cross platform and libre.

Still no update

[ThatsNotPudding]

to remove smugness, I see.

Update hell

[biodata]

So if I want to protect against malware on a mac I need to update its OS every day, potentially? See the thing is, the last time I updated its OS it went down (didn't come back after reboot) which took me two days to diagnose, fix, and restore my stuff from backup. Since then I decided I don't want to update my OS any more. Will I still be protected by Apple if I don't choose to install their latest risky OS version, but just keep the one I have and will they automatically supply me the fixes to the malware search tool? Seems like it might be easier just to install an anti-malware package and be done with it.

Re:Update hell

[Guy Harris]

So if I want to protect against malware on a mac I need to update its OS every day, potentially?

No. If you want to use Apple's anti-malware protection you need to install the Security Update (which might require updating to the current version of Snow Leopard) and have it potentially update the malware definition files every day, not update the entire system every day.

Re:And so it begins...

[inpher]

Apple just announced that they were going to merge the Server and Consumer versions (scroll almost all the way down) of Mac OS X Lion, why would they split them apart into two different versions again?

I thought malware on Mac OS didn't exist

[acoustix]

Or at least that is what Apple is telling its customers.

troll mod? I mod your mod fanboy.

[drinkypoo]

An informative quotation which describes the problem and what you can do about it (Snow Leopard) is modded troll? Fail.

Re:troll mod? I mod your mod fanboy.

[Kitkoan]

Welcome to Slashdot's broken modding system

Re:troll mod? I mod your mod fanboy.

[drinkypoo]

Welcome to Slashdot's broken modding system

Don't kid a kidder, me laddo. I've been crying about the moderation system since forever.

Re:And so it begins...

[Guy Harris]

and Apple are moving to LLVM so that they don't have to release the source code to their compiler at all.

More correctly stated as "Apple are moving to LLVM, including writing their own non-GPLed front end for C/C++/Objective-C; this means that, whether they choose to do so or not, they are not required to release the source code to their changes to the compiler". Whether that is one of their reasons for doing so (not the reason) is another matter; note that it also means that they could, say, use Clang, LLVM, LLDB, etc. as libraries and link closed-source programs with them, rather than having to keep, say, the GUI bits of Xcode at arm's length to avoid having the GPL require them to provide the source to them.

Currently, the core compiler parts are open-source, under the UIUC license.

Re:I hope Apple has learned a lesson from all of t

[Guy Harris]

That user doesn't have admin privileges; that user is in effect, in the sudoers file.

In particular, one of the groups that user is in is the "admin" group (which does, in fact, happen to be in the sudoers file). At least some directories in OS X have permissions rwxrwxr-x and a group owner of admin, so users in the admin group do have, even when not sudoing something or the GUI equivalent, more privileges than users not in the admin group.

Re:And so it begins...

[ogdenk]

Cuz everyone knows SGI, DEC and Sun used to give source for their compilers.

Just because Apple has a mutant version doesn't mean you couldn't build plain GCC and an assload of free software.

And couldn't the LLVM/Clang move be for performance reasons? Last I checked GCC was merely an "OK" compiler, not the end all be all of compiler technology.

Re:And so it begins...

[makomk]

Just because Apple has a mutant version doesn't mean you couldn't build plain GCC and an assload of free software.

You can build plain GCC, but I'm not sure how well linking against Apple's libraries would work with it... they're targetted at different Objective-C ABIs and runtimes.

Re:There really isn't a cure for this kind of thin

[tivoKlr]

There is no OS or kernel patch that protects against stupid.

As most of my tech support assistance is for GOOD friends only (I long ago bailed on the frustrating path of coddling stupid users through their self inflicted fuckups), I have to agree that there is absolutely no protection against stupid, and as long as vectors use the path of least resistance, i.e. stupid, then they will win.

Stupid trumps all. Just watch some TV.