Mac OS Update Detects, Kills MacDefender Scareware

CWmike writes "Apple released an update for Snow Leopard on Tuesday that warns users that they've downloaded fake Mac security software and scrubs already-infected machines. Chet Wisniewski, a security researcher with Sophos, confirmed that the update alerts users when they try to download any of the bogus MacDefender antivirus software. Wisniewski had not yet tested the malware cleaning functionality of the update, but was confident that it would work. 'It's reasonably trivial to remove MacDefender,' said Wisniewski. 'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.' The update, labeled 2011-003, adds a new definition to the rudimentary antivirus detection engine embedded in Mac OS X 10.6, aka Snow Leopard, and also increases the frequency with which the operating system checks for new definitions to daily."

Comments

ahhh...

[CSFFlame]

The Nuclear Option

So Mac Users should expect this?

[Flyerman]

So every virus for Macs will get killed in the next update? Very nice work for Apple if it happens that way.

'It's reasonably trivial to remove MacDefender,' said Wisniewski. 'It's not burying itself in the system, not compared to some of some of the crap that we see on Windows.'

Pity it won't always be that way, survival of the fittest applies to viruses too.

Re:So Mac Users should expect this?

[Dynedain]

So every virus for Macs will get killed in the next update? Very nice work for Apple if it happens that way.

Not really any different than Microsoft's monthly "Malicious Software Removal" update that's pushed for Windows.

Re:So Mac Users should expect this?

[Anonymous Coward]

More reason to use winodws - you get a more sophisticated malware for your money.

Re:So Mac Users should expect this?

[Nerdfest]

Not really any different than Microsoft's monthly "Malicious Software Removal" update that's pushed for Windows.

Exactly. Sad to say, but exactly.

Re:So Mac Users should expect this?

[DJRumpy]

The Mac scanner only scans for Trojans at this point (3 of them including MacDefender), not viruses. Apple has typically left virus scanning up to 3rd parties, while taking a more active role in alerting users about phishing and malware up front.

Re:So Mac Users should expect this?

[at_slashdot]

That reminds me of people who were commenting here on slashdot about the fact that it doesn't matter that the malware installs without using root access, see, it does matter.

Re:So Mac Users should expect this?

[ninetyninebottles]

The Mac scanner only scans for Trojans at this point (3 of them including MacDefender), not viruses. Apple has typically left virus scanning up to 3rd parties, while taking a more active role in alerting users about phishing and malware up front.

Ummm, what viruses would it be looking for? There aren't any real, in the wild Mac viruses unless you count Mac Guard, which barely qualifies and is only delivered via trojan that happens to spawn a separate app at run time.

Re:So Mac Users should expect this?

[Deathlizard]

The only thing root access gives malware authors is rootkit installation and removal hardening. They can still read and write user files, which could lead to either ID theft, or ransomware by proprietary file encryption.

Re:So Mac Users should expect this?

[ninetyninebottles]

There have been some actual viruses in the wild for Mac, but the vulnerabilities are quickly patched, effectively preventing the viruses from spreading on any up-to-date system. http://www.scmagazineus.com/second-mac-virus-in-the-wild/article/32987/ [scmagazineus.com]

Despite the misleading claims in the article you cite, according to F-Secure, "Inqtana.A has not been met in the wild and has internal counter that prevents it's operation after 24. February 2006. So it is unlikely that this variant would be a threat to Mac Users." It was an academic proof of concept, not an in the wild spreading virus and I've seen no reports of it in the wild. Sadly, people writing articles parrot terms like "in the wild" "zero day" and "virus" without understanding what the terminology actually means.

Re:So Mac Users should expect this?

[dgatwood]

It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

To be fair, at most of those contests, more people are trying to win the Mac than the Windows box, thus making the amount of time to breach a largely uninteresting metric when it comes to determining how secure the OS is.

A more interesting metric is how long known security bugs go unpatched. Unfortunately, accurately obtaining such metrics without a colossal leak would be impossible.

Also, there's the problem that probably at least 99% of security bugs aren't reported as security bugs, and thus tend to get buried in bug tracking systems as "app crashes in obscure use case" for years on end. My rule when writing code is simple: if it crashes, always assume it's a security bug. Not everybody is that strict, though, unfortunately, hence the reason anybody still ships Flash preinstalled....

Re:So Mac Users should expect this?

[dgatwood]

No, it doesn't matter when it comes to logging your keystrokes and obtaining your credit card numbers/banking info/passwords.

Actually, on Mac OS X, it does matter.

• If the app is written properly and uses EnableSecureEventInput while the user is entering passwords (as recommended in TN2150), then event taps won't get you passwords.
• Only processes running as root can seize keyboards as of 10.5, preventing password capture down at the device access level as well.
• Only processes running as root can load kernel extensions, preventing it at the driver level.

Thus, to my knowledge, unless you exploit a bug in the OS, it should not be possible to sniff passwords in Mac OS X unless an app is running as root.

That's not to say that it can't steal passwords in other ways—spoofing password dialogs, stealing your Safari cookie files, reading your Safari bookmarks and pretending to be Safari while it displays your bank's website, etc.—but it should not be able to capture passwords that you enter in other applications. Thus, root matters. A lot.

Re:So Mac Users should expect this?

[node 3]

First off (and I only make this point because you seem to be trying to make this distinction), there are absolutely NO viruses for Mac OS X. None.

Second, there were plenty of viruses for classic Mac OS. This, however, has absolutely nothing to do with whether Mac OS X has viruses (for the rest of this post, I'm using a more broad term for virus, to include trojans and worms, and the like).

Third, there is a small handful of malware for the Mac, including (almost exclusively) trojans. No one is claiming otherwise, not even the people you are replying to.

Fourth, in White Hat conventions, *ALL* the systems fall. They tend to fall after certain restrictions have been removed. Macs often fall first (by mere seconds) because people want to win the Mac more than they want to win the PC.

Even knowing this I still don't use a virus scanner at present as I simply don't see a need. That said I am not foolish enough to believe that it will remain Virus free indefinitely.

Who is this imaginary person you think is saying that Macs will remain "virus free indefinitely"? This last line pretty much describes every single Mac user, from those that worry the Virus Armageddon is pending, and those that think they have nothing to worry about. No one claims this is a permanent state of things, just that it's how it is now, and tomorrow is another day.

Re:So Mac Users should expect this?

[BasilBrush]

Go farther back and you'll also find reports for Mac OS Classic

What's that got to do with the vulnerability or invulnerability of OS X? It's a completely different OS.

It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

Spurious. For many reasons as pointed out under those /. stories. For example with the last one, OSX was declared as first to fall on day 1. Linux hadn't even been available for exploiting yet. It was timetabled to be available on day 2.

There only seems to have been two instances of malware that got into the wild. The one that was included in the torrented pirate copies of iWork 09. And last months "Mac Defender". Both trojans. Not exploiting any technical vulnerability of OSX at all. Just ordinary applications that the user has chosen to install, which have hidden malicious intent.

I don't use a virus scanner either. And actually I do think it's unlikely there will be a real virus for OS X. More trojans, of course, there's no preemptive stopping of those. But given Apple is scanning for those as standard, I still can't see the need for third party malware-scanners.

Re:So Mac Users should expect this?

[PitaBred]

Being that it's not installed with root permissions means it's easy to remove. When it can keep you from seeing it when you're looking for it (aka, root permissions), you're hosed. It's the difference between fully installing the system again along with all your programs and such and then restoring from backup, and just possibly restoring from backup if something gets hosed. You do back up, right?

Re:So Mac Users should expect this?

[walternate]

Fourth, in White Hat conventions, *ALL* the systems fall. They tend to fall after certain restrictions have been removed. Macs often fall first (by mere seconds) because people want to win the Mac more than they want to win the PC.

I actually thought people meant it only as a joke when they said that, but in the context here it doesn't seem like it, so I'll bite. The winner of pwn2own takes home a 15.000 USD cash price. It makes no sense to risk that by not going after the easiest target first. (And btw. in pwn2own 2011 the Mac fell without any restrictions being removed, just from visiting a website - drive-by install with no user interaction)

Re:So Mac Users should expect this?

[ninetyninebottles]

No, that was just an example (of which 4 variants of Inqtana were found).

Yes, it was an example, but it was an example that did not match the criteria of an "in the wild" virus for OS X. Nor do Mac Classic viruses. Seriously, what virus definition would be of any use for Apple to include? Everyone always hand waves and says there are a few, but they always turn out to be proof of concept experiments with no payload and not in the wild, or simple trojans. There is certainly some small amount of malware out there, just not really viruses, which makes it odd that someone would complain that Apple doesn't include any signatures for viruses.

...it does not mean that OS X will always be invulnerable. It is typically one of the first to fall in White Hat conventions, which of course leads to quick patches to close any vulnerabilities.

Who claimed OS X will always be invulnerable? Just you, just now, in a strawman argument. As for OS X in hacking competitions, there don't seem to be too many of them, and while OS X has not stood up at PWN2OWN particularly well, surely even with a little knowledge of security you recognize that direct attacks by security professionals and attacks that make their way into automated malware are very, very different things.

What are we detecting?

[damn_registrars]

The summary mentions:

the rudimentary antivirus detection engine

Wouldn't we be better off detecting the viruses, not the antivirus?

Re:What are we detecting?

[OzPeter]

The summary mentions:

the rudimentary antivirus detection engine

Wouldn't we be better off detecting the viruses, not the antivirus?

No .. its customary to look for signs of an infection even if you can't see the infection itself. So that by detecting anti-virii (and spelling nazis be damned) you prove that the system has come into contact in the past with a genuine virus. Unfortunately as time goes on you find the that more and more systems develop anti-virii until the entire population has developed them, thus leading you to posit that the original virus was very very wide spread. However by now, due to the universality of the anti-virii, all systems are now safe from the original virus. Which is all well and good until something to do with an unclean telephone occurs. Hmm does that make Apple one of the telephone santizers????

Re:What are we detecting?

[Jeremi]

Wouldn't we be better off detecting the viruses, not the antivirus?

The distinction between those two categories grows hazier every year...

Or for more comprehensive scanning

[Sycraft-fu]

Microsoft Security Essentials. It is not included in Windows, due to anti-trust restrictions (so that may change with Windows 8 since those restrictions are going away) but it is a free download. Updates itself automatically like all AV scanners, will also update via Windows Update if there's a problem.

Re:Or for more comprehensive scanning

[gman003]

Microsoft isn't the one responsible for that. Symantec and McAfee both spend a lot of money paying computer manufacturers to pre-load trial versions their software. The average (translation: stupid) user will assume that, since it came with the computer, it is somehow an actual necessary part of the computer, and pay for the full service. Both companies end up with more money.

Also, Microsoft includes an extra set of license checks with MSE - it's supposedly quite difficult to get it working on pirated copies of Windows. So it serves as an incentive for people to buy their OS (rather than pirate). Thus how MS sees it as a profit-making product.

Re:Or for more comprehensive scanning

[PyroMosh]

If I am reading what you said correctly you believe that Microsoft insists all computers sold with a Windows pre-install also come with a MacAfee pre-install?

If I parsed that correctly, you're mistaken. Microsoft insists no such thing. Where did you get that idea? Or am I misunderstanding what you're trying to say?

Re:Or for more comprehensive scanning

[weicco]

Microsoft isn't the one responsible for that. Symantec and McAfee both spend a lot of money paying computer manufacturers to pre-load trial versions their software.

It also lowers the price of the computer. That's why computers with Windows can be cheaper than computers with Linux. It could be win-win-win-win (MS, manufacturer, AV-vendor, user) situation if only those Symantec and McAfee products would actually work and work good.

Re:Or for more comprehensive scanning

[hairyfeet]

Frankly if you are gonna give someone a free AV I'd recommend Avast over MSE any day of the week. MSE is great for someone who is ONLY going to relatively safe sites and preferably has ABP to keep malicious JavaScript at bay, because frankly I have seen XSS attacks get through MSE, such as a nasty one going around the Youporn sites that will spam everyone in the person's Yahoo address book .

Avast sandboxes the browser and scans the page BEFORE it loads and seems to kill that and other JavaScript bugs dead, it also has the optional messenger shield and P2P shield if they use those programs and it seems (at least in my experience) to use less RAM and CPU overall than MSE.

So while I would personally not mind if MSFT gave some sort of AV as a pack in just to help cut down on the bugs, actually seeing it in action I just don't think very highly of it compared to Avast or Comodo. As for TFA allow me to say...Welcome to the club Apple users! Meetings are on Tuesdays and Thursdays, coffee and donuts are in the back.

Seriously now that there is blood in the water the sharks will come, and it will only get worse. they saw they were able to get some good numbers with MacDefender and now MacGuard, and thanks to Hackentosh they don't even need to buy an Apple to test their code on! The first Windows bugs were pretty primitive and easy to kill too. I remember when a simple booting into safe mode and tossing the files would kill a great number of bugs. Mark my words this is just the beginning, within 6 months I predict we'll be seeing our first really nasty deep buried Apple malware. Who knows, we may even see an Apple Code Red style mass infection!

Either way it will be quite interesting to see how Apple handles it. Their "don't say the M word" attitude at the beginning doesn't fill me with confidence, Apple seems to care about its image too much when weighed against helping their customers. How long did it take them to cook up a tool for this "simple to remove' bug? How are they gonna handle getting a real deep Windows style nasty? Should be quite interesting to watch and see.

Re:Or for more comprehensive scanning

[macs4all]

Seriously now that there is blood in the water the sharks will come, and it will only get worse. they saw they were able to get some good numbers with MacDefender and now MacGuard, and thanks to Hackentosh they don't even need to buy an Apple to test their code on! The first Windows bugs were pretty primitive and easy to kill too. I remember when a simple booting into safe mode and tossing the files would kill a great number of bugs. Mark my words this is just the beginning, within 6 months I predict we'll be seeing our first really nasty deep buried Apple malware. Who knows, we may even see an Apple Code Red style mass infection!

Yeah, their "Pretty Good Numbers" were measured in maybe a few hundred Macs, worldwide. Yeah, that's some epidemic. And the ONLY reason it got as far as it did, was because of all the lame-ass website admins. who got infected by the fake banner ad, and then the genius move of then poisoning several Search Engines' Page Rank systems, so those sites came up high in search results. So, the REAL SUCCESSFUL "attack" was on those websites. And I would bet my bottom dollar that the vast majority of infections were of gullible Windows-Switchers, who cannot fathom a computer platform that DOESN'T regularly need "Virus Scans". The veteran Mac users KNOW better! (Yes, I'm being smug).

Oh, and one of the reasons this will NEVER get to the level of a Windows problem is simple: Macs don't have a "Registry", in the sense that Windows does. Without that idiotic, centralized database of thousands of system and application settings, it is literally impossible to create malware that can survive simple file-replacement techniques. The problem is that there is literally NO reliable mechanism to "rebuild" a seriously damaged Registry. Microsoft can't do it, Third Parties can't do it, and users DAMN sure can't do it!

This is why SO many problems with Windows end with the tried-and-true mantra of "Wipe and Reload" (a/k/a the "back off and nuke it from orbit" method). Because, quite literally, it is often the ONLY way to be sure.

But, since Apple uses .plist files, and since the rule is that they can be REBUILT if deleted, it's gonna be pretty damned hard for something to really scrog an OS X system. At least in a way that cannot be relatively easily "rebuilt".

And that tune you've been singing has been sung for over ELEVEN years now, and what? Heck, even Linux has much, much more "malware" that OS X. In fact, over 250 times as much.

Re:Or for more comprehensive scanning

[liquidweaver]

I'm no MS apologist ( I run slack on my laptop and Ubuntu server at work, eucalyptus cloud), but there is a whole lot of inaccuracies here. Any kernel level malware invalidates your "literally impossible" file replacement argument. The original execution of the registry was poor, but the concept of a fast and reliable btree key-value store for all your program settings isn't that idiotic (think dbus, gnomeconf, etc). The modern windows registry has plenty of permissions built in the important areas, although it is admittedly a mess of disorganization still. There are plenty mechanisms to restore a registry; in fact it can be rebuilt in parts if need be. You can walk the structure and recreate the index. UBCD has an excellent one, for example. If you want to get on a soapbox against MS, there are plenty of arguments why the OS sucks, from a bone-headed approach to library version control, to ugly API's like the MFC, inconsistent handling of kernel mechanisms/calls, a still evolving/broken application install system, extension based file types, a complete lack of usable logs and diagnostic tools built into the OS, the command line is a joke... I could go on and on. But please, don't give the windows guys a swiss cheese argument... there are some smart ones out there, if we want to point and laugh we need to go at them with facts :)

Re:Or for more comprehensive scanning

[jimicus]

Complete balderdash.

You can't trust a machine that's running malware to tell the truth when it tells you that it is now clean - because for all you know, the malware has hooked into the very API routines your anti-malware product depends upon. Anyone who's spent any serious length of time trying to clean up a heavily infested Windows PC will attest to that.

There's booting from a CD - which is much more sensible but only 100% workable if you have a whacking great database of checksums for every valid executable, every DLL, everything that may contain runnable code on the planet and you can somehow use the CD to patch all known vulnerabilities on a system - including local exploits that may take advantage of something the user's already downloaded.

A heuristic algorithm is never going to be 100% reliable because you're essentially only one step away from trying to solve the halting problem - the only real difference is instead of saying "Will the computer halt?" you're saying "Will the computer do something undesirable?". The best you can hope for is to say it probably won't.

Re:Or for more comprehensive scanning

[macs4all]

I'm no MS apologist ( I run slack on my laptop and Ubuntu server at work, eucalyptus cloud), but there is a whole lot of inaccuracies here. Any kernel level malware invalidates your "literally impossible" file replacement argument.

And yet, you fail to explain how. And yes, the rest of your comment firmly labels you as a Windows (or at least Windows Registry) apologist.

The original execution of the registry was poor, but the concept of a fast and reliable btree key-value store for all your program settings isn't that idiotic (think dbus, gnomeconf, etc).

ANY centralized database of critical configuration information is inherently fragile. Period. And doubly so with the Windows registry, because it is such a mess.

The modern windows registry has plenty of permissions built in the important areas, although it is admittedly a mess of disorganization still.

Permissions are only good until the filesystem is tricked into ignoring them with a privilege escalation. And since most Windows users still run as Administrator, that isn't even necessary.

There are plenty mechanisms to restore a registry; in fact it can be rebuilt in parts if need be. You can walk the structure and recreate the index. UBCD has an excellent one, for example.

That assumes you both know which of the hundreds or thousands of keys have been affected, and then, what you need to set those keys' values to.

If you want to get on a soapbox against MS, there are plenty of arguments why the OS sucks, from a bone-headed approach to library version control, to ugly API's like the MFC, inconsistent handling of kernel mechanisms/calls, a still evolving/broken application install system, extension based file types, a complete lack of usable logs and diagnostic tools built into the OS, the command line is a joke... I could go on and on.

Please! Don't let me stop you...

But please, don't give the windows guys a swiss cheese argument... there are some smart ones out there, if we want to point and laugh we need to go at them with facts :)

I personally don't think that pointing out the Registry as a big, steaming pile of Windows vulnerability is anything like "swiss cheese", and neither do these people.

Re:Or for more comprehensive scanning

[doggo]

"XP is 10 years old. Why compare a 10 year old OS with the latest version of MacOS X?"

Why? Because vast swaths of Windows users haven't upgraded because:

a) Vista was a fucking train wreck, and most users down-graded back to XP if they could find a way to.

b) Users are wary of Windows 7 because of Vista and continue to use XP because it works well enough on their current hardware, which was probably "Designed for Windows Vista".

c) Did I mention Vista?

d) Vista.

Re:From no malware on Mac

[je ne sais quoi]

Does the concept of "false equivalence" mean anything to you? Yes, macs have had trojans for awhile on pirated copies of software. Yes, this is an evolution of the malware on OS X since it attempts to trick the user into installing the software. Yes, it'll probably get more complicated than this, but come on -- are you really telling me that since OS X has gotten two instances of malware, after being in use for over a decade, is the same as what has happened with windows? Really?!?

Re:And so it begins...

[Guy Harris]

The slow, but inevitable slide to Mac OS X being locked down in the exact same way that iOS is.

First they block apps in the name of protecting users from themselves... Then they just slowly increase the definition of "harmful apps."

If by "first they block apps..." you mean "first they warn you that an app might be harmful, suggesting that you drag it to the trash, and providing a one-click option to do that from the warning dialog...", yeah.

There really isn't a cure for this kind of thing.

[bmo]

Userspace malware is nothing different than Purple Gorilla Bonzi-Buddy shit.

There is no OS or kernel patch that protects against stupid.

I can install the SELinux scripts, and there is nothing preventing me from utterly hosing the system as administrator or my own account with my own permissions. You would have to make a read-only system, maintained by someone not-me. This is what corporate IT does.

I see a market for itinerant bonded neighborhood sysadmins should people get over themselves and admit that joe-user can't handle his own computer at home.

--
BMO

Re:From no malware on Mac

[je ne sais quoi]

Sorry, I guess I read your comment as being more invective than it actually was. The point I was thinking of was that Apple ran the "Macs don't get viruses." add in 2006. That's five years ago, when there really was no widespread malware for OS X. If we're going from no viruses from 2000-2007, to a trojan on pirated software in 2008 and now a social engineering attack three years later in 2011... it's not a pace of development that I'm particularly worried about.

Re:Honest question about security of unix systems

[catmistake]

Depends on who you ask. If you ask a security expert that, due to the fact that they are a security expert, they of course spent most of their time buried in Windows fixing the broken, they will tell you all computer operating systems are equally susceptible. However, if you ask a long toothed grey beard UNIX systems administrator, he will tell you all computer operating systems are equally susceptible, but he's never seen a virus because he has spent most of his time buried in UNIX.

Re:Honest question about security of unix systems

[betterunixthanunix]

A few things:

• The simple Unix security model is better than the (largely historic) Windows model because users do not have the ability to make systemwide changes. This ensures that even if malware infects a user's machine, it is always possible for the root user -- what Windows refers to as an "Administrator" -- to remove the infection, and the worst case is that the user's files are all gone.
• A Windows system can be set up to have the same security model as a Unix system, and this has been recommended by Microsoft for years. However, so many legacy applications expect "administrator" privileges in Windows that this is not the easiest thing to do.
• Modern security requires a lot more than just separating user accounts. For a home user, losing all the files in their home directory or having their account compromised can be a worst case -- it can mean a raided bank account, lost family albums, etc. I am of the opinion that the answer lies with mandatory access control: an unverified program that you download from the Internet should not be able to access files in your home directory even if it is running under your username, unless you specifically authorize it to do so. This is possible to set up in Windows, GNU/Linux (using SELinux; you can also simplify things and run your web browser in the SELinux sandbox, which confines downloaded programs to the same sandbox, and by default deletes those programs when the sandbox is closed), FreeBSD (with TrustedBSD), TrustedSolaris (if anyone still cares about Solaris), AIX, etc...but I am not sure that this is something that is officially supported in Mac OS X. That being said, Mac OS X does have mandatory access control built into its kernel, and as far as I know that is what is used to implement "parental controls."

As a final note, Mac OS X is routinely the first system to be defeated at pwn2own; some say this is because it is less secure, others say it is because the participants want Mac OS X systems more than Windows systems.

Re:And so it begins...

[Anonymous Coward]

Bonus points if you can explain how you're gonna make Flash movies or do any sort of programming on a Mac with iOS-like restrictions.

Same way you do programming on the iPhone: pay $100/year for a developer license.

And if you think they aren't going down that road already, remember how developer tools used to come with the Mac OS X DVD?

You can no longer download Xcode for free. It now costs $5 and is only available with an Apple account off the Mac OS X App Store. (Or free from the App Store if you already have a developer license, but you still need to get it through the App Store.)

Apple is already down the path to locking down Mac OS X. This is just another step.

Re:And so it begins...

[zippthorne]

And yet, Apple Desktops and Laptops come with a fairly complete BSD Unix toolset, including several scripting languages (perl, python, ruby, shell, probably some others I don't know about, applescript, automator, a gcc compiler...

How much of that stuff can you get on Windows' default install?

Now, it's apparently true that Xcode is no longer a free download (although I suspect it's still on Snow Leopard install disks...), but let's wait to see what the next version has to offer before we assume they're just taking it all away and locking everyone down to toy computers with no capability for hobbyists and tinkerers.

Re:Honest question about security of unix systems

[ninetyninebottles]

This is possible to set up in Windows, GNU/Linux (using SELinux; you can also simplify things and run your web browser in the SELinux sandbox, which confines downloaded programs to the same sandbox, and by default deletes those programs when the sandbox is closed), FreeBSD (with TrustedBSD), TrustedSolaris (if anyone still cares about Solaris), AIX, etc...but I am not sure that this is something that is officially supported in Mac OS X. That being said, Mac OS X does have mandatory access control built into its kernel, and as far as I know that is what is used to implement "parental controls."

OS X's Mandatory Access Controls are a port of TrustedBSD. They are used to sandbox selected services in OS X to improve security, but not widely deployed yet for userspace software. You can configure them yourself using the CLI or using a third party application like "Sandbox".

Re:Honest question about security of unix systems

[Billly Gates]

Windows was more insecure because Microsoft designed it to be be scriptable with com/dcom objects that apps can use to integrate into one another for app embedding. ActiveX are just objects that are designed from the ground up to be mix win32 applets inside IE. The whole object model is based upon using proprietary win32 code and api's so the programmers do not have to code as much. This was designed for lock in and accessibility everywhere with no security in mind.. Unfortunately, this meant I can write some VB 6 app to call win32 functions to wipe your hard drive and I can just copy the dll over as an activeX object in IE. If you have IE 5 or earlier all you would have to do is visit my webpage and it would run automatically on your computer and it would be trash. The iloveyou worm that hit it big in Outlook was a simple VBA script that copied the string and did a simply call to the user's address book. Most of the win32 api was designed for Windows95 built on Dos which had no concept of user rights. Only the security API for Windows NT had that modern concept. These api's were ported over to WindowsXP.

Buffer overflows are something else and poor memory management of Windows causes GP faults which everyone and their brother received back in the Win 9x days. Microsoft had trouble enforcing this because Dos and Windows 3.1 apps just took random memory addresses mostly and one would just take an address of something else and bluescreen and take down your system. So if you are a hacker and know when a ram address ends with a certain DLL (thanks to a debugger) you can put some code in that adress and WHAM instant execution. Windows also has no concept of data for execution vs data for storage. This is a flaw of x86 actually but you could put executable code in just a cookie or a temp file and it would not be hard to trick Windows when it is done executing a DLL to go to your program and it will totally bypass security. You can do this in Unix as well but this is very uncommon today as you need to be root and was a hack of the early 80s when coders wrote in assembly to gain performance tricks. This is frowned upon in the Unix world as there are excellent libraries that can obtain speeds close to assembly. Not to mention users do not want to log in as root. This same assembly calls stayed in Windows due to backwards compatibility as WindowsXP has the default user as an administrator. Doh

Anyway, this was why Windows was less secure and why MS wants you to switch to .NET. Less to do with marketshare but more to do with poor design decisions and the requirements to be backwards compatible. I am so sick of those saying Windows is great and it is marketshare or something else stupid.

I hope Apple has learned a lesson from all of this

[antifoidulus]

I hope Apple takes this incident to heart and makes one minor, but very significant, change to how their OS(or more specifically, their OS setup process) works: namely that the default user should not have admin privileges! Currently an out of the box Mac will prompt the user to set up an account, and that account will have admin privileges. To actually set up another account the user has to know enough to go into sy

Hopefully in Lion they will, at the very least, explain to users that they should set up a non-admin account to do their everyday computing and only use the admin account when they need to do admin things.....

Re:I hope Apple has learned a lesson from all of t

[digitallife]

Almost completely irrelevant.
When the 'admin' user attempts to do anything requiring root privileges, the system prompts for a password. If you are running as a non-admin user, you just have to fill in a different username in the password box that pops up (that of a admin account). If you don't know the admin account password, then you are obviously not managing your computer, and if you do... Then you have to type in an entire extra word to get root privileges! Wow!

Re:Honest question about security of unix systems

[benjymouse]

Windows was more insecure because Microsoft designed it to be be scriptable with com/dcom objects that apps can use to integrate into one another for app embedding. ActiveX are just objects that are designed from the ground up to be mix win32 applets inside IE.

COM/DCOM is a binary object model for creating object oriented API. A COM API is just an API following some specific conventions. The convention describes how an "object" must point to a type which must have a jump table. Nothing is more or less secure about it.

It is correct that ActiveX is a COM model for extending the browser (and other types of applications). As such you can compare it to extension APIs such as NSAPI in other browsers. Nothing inherently more secure or insecure about that. Now, MS *also* billed ActiveX for websites to extend the user experience because they needed a good response to Suns Java applets. In other words they encouraged websites to embed ActiveX controls into the sites and they made IE accept those controls.

The area to which ActiveX was applied was wholly unsuitable for binary components. It would be the equivalent of letting websites calling the Linux kernel API directly from the website after aking the user if that would be ok. COM or ActiveX as technologies were never the problem, indeed very few bugs have ever been found in the COM infrastructure. COM exists to this day and still forms a critical part of Windows infrastructure. But as it is just an API it doesn't make it more or less secure for that.

The whole object model is based upon using proprietary win32 code and api's so the programmers do not have to code as much. This was designed for lock in and accessibility everywhere with no security in mind..

With no security in mind? It is just an API. The methods being called are supposed to handle access control. If you implement an API an expose it as a plain old C API or as a COM API, you *still* has to consider security and access control. If anything, COM allows you to *better* secure your system because you can do so more fine-grained.

Unfortunately, this meant I can write some VB 6 app to call win32 functions to wipe your hard drive

As you can with a C API. It is just an API model. Nothing more or less secure about that.

and I can just copy the dll over as an activeX object in IE. If you have IE 5 or earlier all you would have to do is visit my webpage and it would run automatically on your computer and it would be trash.

No it would *not* run automatically on my computer. It never did that. You *always* had to accept a new control. Was it still a stupid model for extending websites? Yes. But stop lying about how it worked.

The iloveyou worm that hit it big in Outlook was a simple VBA script that copied the string and did a simply call to the user's address book.

Yes, a script which could call an API. The script should never have executed. That was a failure of Outlook, not a failure of Windows or COM. If another mail client allowed a mail message to execute scripts (e.g. bash) you would still be toast. You seems to be confused about what exactly are OS, API and applications.

Most of the win32 api was designed for Windows95 built on Dos which had no concept of user rights. Only the security API for Windows NT had that modern concept. These api's were ported over to WindowsXP.

So many things are wrong with these statements that I don't even know where to begin. But ok: Win32 API was built around the concept of handles and "objects". This is a model which quite easily supports securing the objects very fine-grained and has served Windows well. While Win9x didn't have much in the security department, the model is much more potent than a plain pointer API like in *nix.

When you want to call a method on an Win32 object you go through the handle. The handle internally p

Re:I hope Apple has learned a lesson from all of t

[Ixokai]

Not exactly.

That user doesn't have admin privileges; that user is in effect, in the sudoers file. They can authorize admin privileged actions. The default user can't modify or tweak anything in /System. But they can be prompted to allow elevated access to allow things to write into important parts of the system.

And frankly, that SHOULD be the default. It doesn't make any sense at all to be more restrictive then that. Yes, you should not run as root, or administrator on windows, in your day to day stuff. But in your regular, day to day stuff, on your machine-- you will in the normal course of events need to authorize programs to install globally or tweak system prefs or whatever else on occasion.

No one will EVER learn the "lesson" you want them to be taught. In a secure environment, you may have your regular user, who can't even possibly access (even via sudo) admin power, and an entirely separate account you use to do the system configuration and application install tasks that need higher authority. That will NEVER happen on user-focused machines. Its a frankly absurd notion.

Yes, that means machines will always be susceptible to stupid people running crap that they don't mean to download or are tricked to downloading, and that means there is no /solution/ to the problem of malware. In truth, even with such a system, you wouldn't solve the stupid. You can't solve the stupid.

The default user that people operate on, and which programs they naturally, passively run under -- should not have admin access. Of course not. Even Microsoft gets that, though their implementation of the escalation process is less then ideal. But if you expect someone to sit down on their desktop machine and ever have more then a single account, you're -- out of touch. That account should not have direct system-level access, no: but no one but a tiny minority of power users will ever accept having to set up some entirely separate account that can escalate privileges.

Its not that people are stupid, or careless. Its that you're expectations are absurd. Security and ease-of-use are opposing concerns. Everyone with any sense knows this: in some situations the demands of security are such that we force the pain on usage, in others we try to find a balance which isn't as difficult.

There will never be a world where people will have two separate accounts on their home machine and that they need to decide to go from one account to another to make changes or operate said machine. People will simply use the tool given them, as they understand it is to be used.

Even on linux, more is rarely expected outside of highly secure environs. Sudo is the norm. Yeah, your account can't do much, but you can explicitly invoke its elevation with your own same password -- and that's fine. Home machines will never, ever, be bastions of secure practice.

Its just not worth the pain in the ass to regular people doing regular things. Is it as good as it can be, as secure as it can be? Not yet, but they are working on it. Windows has its UAV method of privilege escalation that is overly in your face so its too easy to hit 'yes' without thinking; linux has its explicit 'sudo' which is fine (and with GUI helpers in certain environments), and Mac has its own escalation prompt. Is this paradigm of the default user being a sudoer ideal? Maybe not. But its usable, and better then the situations where everything runs as root/administrator.

Usability frankly trumps security. You can not honestly expect users to give up much on their home systems, usability wise; or you're just out of touch with reality.