Slashdot Mirror


New MacDefender Defeats Apple Security Update

XxtraLarGe writes "Apple released a security update yesterday designed to rid Macs of the menacing MacDefender malware that has plagued users for nearly a month. But mere hours after the update, cyber-criminals released a new variant of the malware that easily defeated Apple's belated security efforts. That didn't take long."

427 comments

  1. Obligatory Clarification by maccodemonkey · · Score: 4, Informative

    Apple's security update include a new daily malware definitions update. So this is hardly the easy defeat that the description is hinting at. More like the beginning of a long drawn out war...

    1. Re:Obligatory Clarification by i+kan+reed · · Score: 3, Interesting

      Welcome to the windows security world. it's the end of "it just works" and the begining of "it just works as long as you do X, Y, and Z right".

    2. Re:Obligatory Clarification by maccodemonkey · · Score: 3, Informative

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

    3. Re:Obligatory Clarification by obergfellja · · Score: 1

      it reminds me when Nintendo released an update to Wii to get rid of Homebrew app (in version 4.1 or 4.2), but it (the homebrew) was changed enough to not be noticed within a week.

    4. Re:Obligatory Clarification by Anonymous Coward · · Score: 1, Insightful

      You'll always be at the nu'uh stage.

    5. Re:Obligatory Clarification by recoiledsnake · · Score: 1, Insightful

      That would probably happen on Windows too if Microsoft is allowed to bundle MSE into the OS over 'OMGZ ANTITRUST" shouts.

      --
      This space for rent.
    6. Re:Obligatory Clarification by jesseck · · Score: 1, Insightful

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      If Microsoft had it's way, the malware detection would be built into the system as well (think Microsoft Security Essentials), but anti-trust fears and a huge security software market keep that from happening. And, as with Windows, until Macs are malware-proof (which they aren't) you still need to do X, Y, and Z. Even with the latest Apple updates.

    7. Re:Obligatory Clarification by Altus · · Score: 2, Funny

      Didn't the anti trust regulation period end a while back? I assume windows will become the garden of peace and prosperity any day now.

      --

      "In America, first you get the sugar, then you get the power, then you get the women..." -H. Simpson

    8. Re:Obligatory Clarification by CmdrPorno · · Score: 1

      I can't help but wonder why there appears to be preference pane for this malware program and its update process?

      --
      Sent from my iPhone
    9. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

      Did you read the summary? "It just works." was one-upped within hours. Now the user is back to relying on knowing not to do X (fall for social engineering).

    10. Re:Obligatory Clarification by Sir_Sri · · Score: 0

      If Microsoft built MSE out of the box into windows they would find themselves in front of a court before it could run its first AV scan.

      And MSE has updates every day. How long has it taken Apple to roll out an update? Oh, and it's self updating.

      How is a process that runs invisibly ever a good thing? What do you do if that AV has a bug in it, or otherwise breaks things? How do you turn it off if it accidentally keeps frying something important?

      I'm not sure 'built into the system' means anything. Calculator apps are 'built into the system' and I can live without them. It matters what AV products can hook into, which both seem to be adequate at.

    11. Re:Obligatory Clarification by EraserMouseMan · · Score: 1

      I like it when my Mac has a problem. It's just another excuse to get on the phone with a hot Apple Care chick.

    12. Re:Obligatory Clarification by sangreal66 · · Score: 1

      It only just ended 2 or 3 weeks ago (May 12)

    13. Re:Obligatory Clarification by suutar · · Score: 1

      The oversight period for the big antitrust case of 10 years ago just ended. The EU still makes noises about antitrust suits whenever MS blinks too often.

    14. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      You keep a box of Trojans next to your computer just in case you want a hot chick to take care of your Apples, don't you?

    15. Re:Obligatory Clarification by Volante3192 · · Score: 1

      Ninty never kept up on it though; they'd go months without releasing patches like that.

      Usually every time a big first party title came around there would be a 'firmware update.' Then, barring actual bugs or features (the exception), it'd sit there til the next big first party title.

    16. Re:Obligatory Clarification by spun · · Score: 4, Insightful

      maccodemonkey writes:

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

      Okay, maccodemonkey, here's the thing: if the malware detection which is built into the system, invisible, automatic, and self updating is defeated within hours of it being release, we are no longer at "It just works." What part of "It doesn't work anymore" sounds like "It just works" to you?!?

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    17. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      That "hot Apple Care chick" is really a guy with a high pitch voice

    18. Re:Obligatory Clarification by teslafreak · · Score: 2

      Also, just because they could now bundle it in, doesn't mean it is the best option. Since they had to let other people do AV, most people have their own now. It would be a bad practice at best to make all the machines run two AV systems, and people would cry foul if the software they paid for was forcefully removed. Microsoft isn't really able to solve it at this time, but it isn't really an incompetence thing.

    19. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      let me guess, you believe the girls on the sex chat lines are hot too right?

    20. Re:Obligatory Clarification by toadlife · · Score: 1

      That's funny that you think inherently reactive, definition-based anti-malware software can do a decent job of preventing infection.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    21. Re:Obligatory Clarification by jimicus · · Score: 0

      Before Microsoft really started pouring effort into IE, most people had Netscape.

    22. Re:Obligatory Clarification by cheeks5965 · · Score: 1

      Or a box of tissues...

      --
      -- Flame me and I will happily flame you back. Bring it!
    23. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Ya because one piece of malware puts OSX on the same security scale as Windows.

    24. Re:Obligatory Clarification by N0Man74 · · Score: 1

      If Microsoft built MSE out of the box into windows they would find themselves in front of a court before it could run its first AV scan.

      Maybe, but I am not so sure. Bundling tools in the OS that help protect the OS is a lot more justifiable than what they pulled with IE.

      There have been many tools and utilities from third party developers that once filled shortcomings of the OS that have gradually been obsoleted as the OS has become more robust. I can't remember the last time I used XTree Gold out of anything other than nostalgia, as an example.

    25. Re:Obligatory Clarification by maccodemonkey · · Score: 2, Insightful

      Okay, maccodemonkey, here's the thing: if the malware detection which is built into the system, invisible, automatic, and self updating is defeated within hours of it being release, we are no longer at "It just works." What part of "It doesn't work anymore" sounds like "It just works" to you?!?

      Because the user experience hasn't changed. The user neither notices the viruses, or the antivirus.

      To a user, nothing has changed since before MacDefender.

      Mac OS X and Linux have a root user that protects the system against rogue processes causing too much damage. Do we call that a fault in the system because it has to exist, or do we call that a solution?

      No system is immune to trojans. Especially when users hand the trojan their root password, like what was done with MacDefender.

    26. Re:Obligatory Clarification by Dunbal · · Score: 1

      You have obviously not seen this "chick".

      --
      Seven puppies were harmed during the making of this post.
    27. Re:Obligatory Clarification by radish · · Score: 1

      And Windows has "Administrator" - what's the difference?

      The real issue here is that actual users care very much more about the stuff under their user account that the stuff owned by root. Installing malware as a regular user can do plenty of bad stuff without needing root.

      --

      ---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"

    28. Re:Obligatory Clarification by Hamsterdan · · Score: 5, Informative

      I was working at an ISP during that period. Before Win 95, we had to *license* Netscape, send out two floppies containing Netscape, Trumpet Winsock and a connection script on two floppies (or sell them in a box as our Internet Access Kit). When 95 came out, IE was free for the ISP, so only one floppy with a configuration script and IE. Later on, only the configuration script was needed. Since it was only one floppy and IE was free, it cost way less that way, and we saved one floppy. Besides, since everything was included in 95, it could even be done over the phone. That's what really killed Netscape IMO. Netscape 3.02 was a better browser than IE3 or IE4, but since IE was free and good enough, that's was people used, especially new costumers. Heck, I remember when we shipped Mosaic :)

      --
      I've got better things to do tonight than die.
    29. Re:Obligatory Clarification by whoda · · Score: 1

      It doesn't 'just work', or people would be infected and not know it, their machine would be cleaned and they still wouldn't know it.

    30. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      The part where the malware gets removed with the next daily definition update?

      Malware that only manages to hang onto the infected system for 24 hours doesn't seem like it will be very effective at its job.

    31. Re:Obligatory Clarification by maccodemonkey · · Score: 1, Insightful

      And Windows has "Administrator" - what's the difference?

      The difference is the type of people who seem to consider administrator or root a "feature" are calling an invisible tool that checks code against code signing and profiles... well... things other than a feature.

      If Apple was suggesting everyone go out and pick up a copy of Nortons at their own cost to fix this, I'd be crying foul. But they fixed this at an operating system level quietly and transparently.

    32. Re:Obligatory Clarification by Skuld-Chan · · Score: 1

      Oh kinda like MSRT? Its mostly useful assuming the malware even lets it run...

    33. Re:Obligatory Clarification by Anonymous Coward · · Score: 1

      I'm sorry but no.

      You are aware that most malware infections on Windows are from users being idiots right? Mac has that same vulnerability, especially with a growing market share and their retarded "my system is totally secure because I'm told that it is" attitude.
      Also, if you had actually bothered to read the older article, MacDefender can be installed without the password at this point.

      All systems are equally vulnerable. The issue is the users, the huge lack of understand on their part and idiots like you propagating that one system is more secure that the other and having people blindly accept that.

      Do you have flash installed? Because if you do, there's one vulnerability right there.

    34. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      The part with blind fanboy syndrome.

    35. Re:Obligatory Clarification by fuzzyfuzzyfungus · · Score: 3, Interesting

      Given that "Windows Security Center" already detects most remotely common AV packages and whines at you if you don't have one running and in good condition it would be simple enough to simply replace that behavior with "If 3rd party AV present, do nothing(as at present). If 3rd party AV not present or inactive, run MSE(instead of whining, as at present).

      Doesn't change the effectively whack-a-mole nature of antivirus(particularly now that sneaky shit like kernel-mode DRM drivers and silent phoning home are features of "legitimate" software...); but it wouldn't be a significant problem in itself.

    36. Re:Obligatory Clarification by spun · · Score: 1

      Yeah, malware that steals a user's credit card number and then gets found the next day when the patch comes out sounds pretty useless all right...

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    37. Re:Obligatory Clarification by spun · · Score: 3, Informative

      Fuck Windows too. This is Slashdot. I have a four digit user ID. What operating system do you think I use, dipshit?

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    38. Re:Obligatory Clarification by Anonymous Coward · · Score: 1

      The "it just works" phrase was used by Apple to denote peripherals that worked out the box without messy setup problems encountered by Windows users at the time. It has always been easy to install malware on any computer at any time. This new variant is no different.

      Some objectivity would help rather than the girlish squealing of little linux fanboys.

    39. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      I was going to make a "fag hag" joke, but simply can't be bothered.

    40. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      They deserved exactly what they got. And you know it.

    41. Re:Obligatory Clarification by badboy_tw2002 · · Score: 1

      I'm baffled as to what speech impediment not only transposes "chuh" with "dih", but also causes you to write it that way.

      That aside, are the fees stiff?

    42. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      wrong. apple is a step behind. the approach they are taking will always leave them playing catch-up. obvious fanbitch modding. pathetic.

    43. Re:Obligatory Clarification by Holi · · Score: 2

      From what I have seen lately, MSE seems to be the best, everyone else seems to just want to add useless features. MSE is small and out of the way and it works. Take a hint do one thing and do it well.

      --
      Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
    44. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      What, like Windows Defender or the Malicious Software Removal Tool?

    45. Re:Obligatory Clarification by fuzzyfuzzyfungus · · Score: 2

      <quote><p>Apple's security update include a new daily malware definitions update. So this is hardly the easy defeat that the description is hinting at. More like the beginning of a long drawn out war...</p></quote>

      What I haven't been able to find anywhere is information on what sort of "definitions" are used.<br><br>

      The system is based on OS X's existing "file quarantine" feature, which sets a flag on files originating from safari, mail, and a few other sources, which throws a caution flag when you try to open them. Now, there is some sort of "definition" check that throws up a much scarier warning flag for known malware.<br><br>

      The question is what sort of check it is: Does it just hash the file and compare against a list? If so, the situation is hopeless. Programmatic production of permutations will be limited largely by how fast new versions can be sent out through the distribution network, and all of them will hash differently. Is it more sophisticated than that, and how much more, if so?<br><br>

      I grabbed the "SecUpd2011-003Snow.dmg" manual security update installer and dug around a bit. "Security Update 2011-003\SecUpd2011-003Snow.pkg\SecUpd2011-003Snow.pkg\Payload\Payload~\.\System\Library\CoreServices\CoreTypes.bundle\Contents\Resources\" contains a file called "Xprotect.plist"<br><br>

      Here is the snippet that appears to pertain to 'MacDefender':<br><br>

      <dict>
      <key>Description</key>
      <string>OSX.MacDefender.B</string>
      <key>Matches</key>
      <array>
      <dict>
      <key>MatchFile</key>
      <dict>
      <key>NSURLNameKey</key>
      <string>Info.plist</string>
      </dict>
      <key>MatchType</key>
      <string>Match</string>
      <key>Pattern</key>
      <string>3C6B65793E434642756E646C654964656E7469666965723C2F6B65793E*3C737472696E673E636F6D2E61766D2E706B672E617653657475703C2F737472696E673E</string>
      </dict>
      <dict>
      <key>MatchFile</key>
      <dict>
      <key>NSURLNameKey</key>
      <string>Archive.bom</string>
      </dict>
      <key>MatchType</key>
      <string>Match</string>
      <key>Pattern</key>
      <string>617652756E6E65722E61707000*617652756E6E657200*446F776E6C6F6164506963742E706E6700</string>
      </dict>
      <dict>
      <key>MatchFile</key>
      <dict

    46. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      How lonely are you?

    47. Re:Obligatory Clarification by Colonel+Korn · · Score: 1

      maccodemonkey writes:

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

      Okay, maccodemonkey, here's the thing: if the malware detection which is built into the system, invisible, automatic, and self updating is defeated within hours of it being release, we are no longer at "It just works." What part of "It doesn't work anymore" sounds like "It just works" to you?!?

      Maybe he meant that the malware "just works."

      --
      "I zero-index my hamsters" - Willtor (147206)
    48. Re:Obligatory Clarification by gnasher719 · · Score: 1

      Okay, maccodemonkey, here's the thing: if the malware detection which is built into the system, invisible, automatic, and self updating is defeated within hours of it being release, we are no longer at "It just works." What part of "It doesn't work anymore" sounds like "It just works" to you?!?

      Here's the thing that you are missing: The very first version of malware detection that detects MacDefender wasn't defeated within hours, it was defeated many days before it was released. It is obvious to anyone except you that these malcreants had a variant of their software ready, and since Apple has seen only one variant, their detection doesn't know yet how to detect variants. Very soon they'll know, and then things get a lot harder.

    49. Re:Obligatory Clarification by Risen888 · · Score: 2

      Because the user experience hasn't changed. The user neither notices the viruses, or the antivirus.

      Um. Er.

      I'm pretty sure the user notices the virus, actually.

      --
      Hey, I finally got my first freak! Took you long enough!
    50. Re:Obligatory Clarification by Runaway1956 · · Score: 1

      Uhhhhh - no, not exactly. Microsoft COULD HAVE bundled real security into Windows way, way, way back, around Windows 95, or 98, or NT4 . . . well, you get the idea. Bundling real security would have been comparably easy BEFORE they got their teats in the wringer with those anti-trust suits. Now, not so much. But, the lesson learned here is, security is one of Microsoft's low-priority concerns, and has only rated that low priority for a couple of years now. When was it that MSE was introduced?

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    51. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      That's the reality distortion field in action, baby!!!

    52. Re:Obligatory Clarification by Risen888 · · Score: 1

      Son of a bitch, if I hadn't already posted. +1 Insightful.

      --
      Hey, I finally got my first freak! Took you long enough!
    53. Re:Obligatory Clarification by Risen888 · · Score: 1

      (Not commenting on the substance of your post, but...) "Ninty?"

      Jesus, people. Literacy is not a crime.

      --
      Hey, I finally got my first freak! Took you long enough!
    54. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Arg. I only wanted the raw code formatting to apply to the Plist tag-soup. Oh well, you get the point, and anybody else is free to download the update .dmg and verify the contents of the file at their leisure.

    55. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Netscape required re downloading the entire web page every time you resized the window. Better browser my ass.

    56. Re:Obligatory Clarification by smash · · Score: 1

      Also with 3.1 - trumpet was only a 16 bit tcp stack which couldn't even reach high ports. Ie for win 3.1 included a good easy to configure dial up tcp/ip stack. I agree with the parent - that killed Netscape. I too worked at an ISP and for windows users (like 99% of your userbase) ie was far far easier to deal with. Netscape should have been focusing on how to get their foot in the door with ISPs far more.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    57. Re:Obligatory Clarification by smash · · Score: 1

      Pretty sure dos 6.x included av. Not sure why win95 didn't...can't remember.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    58. Re:Obligatory Clarification by Nom+du+Keyboard · · Score: 1

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

      So far that also apparently describes the latest virus package installation. It Just Installs.

      --
      "It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
    59. Re:Obligatory Clarification by smash · · Score: 1

      If you can't see them, who cares?

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    60. Re:Obligatory Clarification by DeathElk · · Score: 1, Funny

      Really? Is your ass a better browser? Bring it over and let me open it and enter some long URLs then. A thorough bout of user acceptance testing is in order, I say.

    61. Re:Obligatory Clarification by mrrudge · · Score: 1

      So, today was the day I lost any remaining respect for a low id, and I think with it realise that this is what /. is. Some intelligent people attempting to discuss things while being bombarded by people thinking their bias is more important than objectivity. The elder members of a community are supposed to be doing the opposite of trolling, but if you've been doing this since about 1997 then it's not likely to change.

      Yes, I know, you REALLY don't care.

      It's a real shame. If anyone passing by knows of a tech forum which has a higher % of discussion to zealotry, please pm me.

    62. Re:Obligatory Clarification by Slutticus · · Score: 2

      Where X,Y,Z = "only download software from our walled-garden app store"
      *sigh* I fear this is the end of OS X as we know it....

    63. Re:Obligatory Clarification by jht · · Score: 1

      You missed something. Since _yesterday_, the Mac OS now has daily checking for malware signatures. So the signature that was already in there with the initial install of the security update is bypassed. Point being, if it's not blocked tomorrow, then we can gripe. Right now it may well be fine with tomorrow's update. If the OS can block would-be exploits within a day of their hitting the wild, that's pretty good response.

      Still to do for Apple, though:

      - Turn off the default for Safari to execute files upon download
      - Increase default security on the Applications folder
      - Build more security checks into the Installer (in particular, I think it should tell people where it will place files)

      Right now, Apple users are seeing multiple variations of a single attack that, on Windows systems, is a bloody nuisance to rip out and usually drops a rootkit behind. On the Mac, it relies on social engineering to get you to install an application into user space and takes about 5 minutes or less to get rid of.

      Not that Macs are 100% safe (or ever were), but there's a fundamental difference here. When this Mac Defender starts getting dropped in with a kernel extension that I can't find because it patches an existing .kext and is installed silently in the background via a PDF exploit using JavaScript, then I'll worry a lot more about Macs.

      --
      -- Josh Turiel
      "2. Do not eat iPod Shuffle."
    64. Re:Obligatory Clarification by elPetak · · Score: 1

      No, they didn't fix it.
      They just patched it temporarily for a few hours.

    65. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      So the next round of Mac malware will just disable automatic updates...

    66. Re:Obligatory Clarification by sumdumgai · · Score: 1

      I don't remember signing any objectivity contract when I joined /. Unreasonable expectations much?

      --
      âoeIn theory, theory and practice are the same. In practice, they are not." â Albert Einstein
    67. Re:Obligatory Clarification by dunng808 · · Score: 1

      Your age is showing. I remember Mosaic.I remember accessing Yahoo as a one page list at Stanford. Trumpet Winsock, with a wedge that let it work with Netware. There was more to be had on Gopher, but I was convinced Mosaic was the way to go. My co-workers were sold on Lotus Notes and thought the web was just a toy.

      We own a lot to the folks who brought us Gopher, Mosaic, WAIS, Trumpet Winsock, Archie, ... often the work of just one or two dedicated folks.

      --

      Gary Dunn
      Open Slate Project

    68. Re:Obligatory Clarification by sumdumgai · · Score: 1

      There is nothing invisible about malware detection software. It is bloated and eats up valuable resources.

      --
      âoeIn theory, theory and practice are the same. In practice, they are not." â Albert Einstein
    69. Re:Obligatory Clarification by exomondo · · Score: 1

      Especially when users hand the trojan their root password, like what was done with MacDefender.

      Except it didn't take long for them to release a version that doesn't need the admin password.

    70. Re:Obligatory Clarification by sumdumgai · · Score: 1

      That is why Microsoft was found guilty of abusing their monopoly in the desktop market to take over the browser market.

      --
      âoeIn theory, theory and practice are the same. In practice, they are not." â Albert Einstein
    71. Re:Obligatory Clarification by teslafreak · · Score: 1

      Apples and oranges. No one would care if they had more than one browser (I think it's a fair bet most people do). It is a horrible idea to run more than one AV system.

    72. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Maybe you missed it but this is not a security breach this is users authorizing installation of software...not what you have in the Windows world which is fully owned systems by simply being on and connected to the internet.

      Get with the times you hippie fucktard, that hasn't been the case for a decade, but based on the rest of your post you're too stupid to know that anyway.

    73. Re:Obligatory Clarification by amicusNYCL · · Score: 1

      Here's the thing that you are missing: The very first version of malware detection that detects MacDefender wasn't defeated within hours, it was defeated many days before it was released. It is obvious to anyone except you that these malcreants had a variant of their software ready, and since Apple has seen only one variant, their detection doesn't know yet how to detect variants. Very soon they'll know, and then things get a lot harder.

      And how do you know exactly what changed in the malware, and what Apple was detecting? I'll tell you this - one of the things that changed was the filename. So it's possible that Apple was just looking for particular filenames. If that's the case, that's no better than blocking files called "virus.exe" from running. It also took them 8 hours to release the new version. If they had one ready, it wouldn't have taken 8 hours to roll it out. It sounds to me like they updated their test platforms as soon as Apple released the update, determined what the update was looking for, and made a new version in 8 hours. I don't know what you think you mean by "how to detect variants", but it's not really as simple as that. If you need proof, look at the Windows malware industry.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    74. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Except for the fact that Microsoft Security Essentials is garbage software meant to give a false sense of security, and was ever since Microsoft bought out the components from other companies. I used to love the software they bought out (I forget the name nowadays), but as soon as Microsoft got their grubby hands on it, it became garbage within less than 6 months.

    75. Re:Obligatory Clarification by amicusNYCL · · Score: 1

      I'm going to go ahead and guess "so it looks legitimate". Apparently it's still a long way off before malware writers are able to use proper English grammar, but at least they try to make it look legit.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    76. Re:Obligatory Clarification by LordLimecat · · Score: 1

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating

      So would that be like Windows Defender (self updating and never gives popups), the Malicious Software Removal Tool (built into windows updates, self-updates and self-runs), or Microsoft Security Essentials (free for all with a windows update, self-updating, self healing, etc)?

      Oh but thats right, its not Apple, so it doesnt count.

    77. Re:Obligatory Clarification by LordLimecat · · Score: 1

      Malware detection already is; what do you think Windows Defender and the Malicious Software Removal Tool are?

    78. Re:Obligatory Clarification by causality · · Score: 1

      So, today was the day I lost any remaining respect for a low id

      Sounds like you finally released your attachments to the false, erroneous appeal to authority. Good, that means progress.

      Much as we try so hard to find ways around it, looks like you'll have to fall back to actually evaluating the merits of what the person is saying. That's ultimately a good thing. Why anyone would want that ability to go unused, to atrophy, well there is no good reason for it. I don't give a damn who you are -- you are subject to the same tests of truth as anyone. The more lofty your position, the higher the standard to which you will be held. That is all, and is as it should be.

      --
      It is a miracle that curiosity survives formal education. - Einstein
    79. Re:Obligatory Clarification by slater86 · · Score: 1

      Here's the rest over at apples site:
      http://configuration.apple.com/configurations/macosx/xprotect/1/clientConfiguration.plist

      Just search for defender

      --
      When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
    80. Re:Obligatory Clarification by fuzzyfuzzyfungus · · Score: 1

      Thanks. It looks like it already detects a handful of things(OSX.RSPlug.A, OSX.Iservice, OSX.HellRTS, OSX.OpinionSpy,OSX.MacDefender A, B, and C) , though nothing that I could find in the file(presumably this is the one that will be getting updated as time goes on) looks like the rules for an even remotely sophisticated detection system: better than a simple naive filename or whole-dmg hash check(if it were that, it'd be about 4 real lines long); but I can't see anything that isn't either a check for the hash of a file or a check for a string.

      Good enough as long as the rate of variation remains low(for reference, this file is 13k, much of that compressible whitespace/tag soup. The definition dumps that symantec's corporate AV product pukes out to the clients on each update are ~40MB); but unless there is something architectural preventing the kiddies from performing assorted padding and encoding trickery, it won't last long. The real limit would likely be that said kiddies are probably using stolen/hacked/botted hosting, which doesn't necessarily come with convenient server tools. If not for that, every single package downloaded could, conceivably, be padded slightly differently.

    81. Re:Obligatory Clarification by Luckyo · · Score: 2

      MSE as a download seems to be an anti-piracy measure as well. You need a legit key to get it.

    82. Re:Obligatory Clarification by Luckyo · · Score: 2

      And it's a good thing someone does. Anyone who is even remotely familiar with microsoft's track record on the issue wouldn't bet a broken dime on MS not abusing its monopoly whenever possible.

    83. Re:Obligatory Clarification by Luckyo · · Score: 1

      "Fixed it".

      "Transparently".

      Wow, market speak drones being quoted as THE TRUTH. C'mon, even the biggest and most annoying apple fanboys aren't this stupid.

    84. Re:Obligatory Clarification by Luckyo · · Score: 1

      Give it time. Windows stuff didn't start with intelligent rootkits either, but it sure got there eventually.

    85. Re:Obligatory Clarification by slater86 · · Score: 1

      Although its a bit old and things may have changed since then, this article shows how basic the detection is (video within):
      http://nakedsecurity.sophos.com/2010/06/18/apple-secretly-updates-mac-malware-protection/

      Keep in mind its sophos's own site/blog so there's a definite conflict of interest potential.

      --
      When people ask if I'm an optimist, I say "I hope so". --Bill Bailey
    86. Re:Obligatory Clarification by ninetyninebottles · · Score: 1

      And how do you know exactly what changed in the malware, and what Apple was detecting? I'll tell you this - one of the things that changed was the filename. So it's possible that Apple was just looking for particular filenames.

      True it would be possible, or you could look at the actual list at: /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist and see that there are a variety of pattern matches for each malware variant.

    87. Re:Obligatory Clarification by yuhong · · Score: 1

      Also don't forget MS Forefront Client Security, their enterprise anti-virus solution. MSE is for home users and small businesses only.

    88. Re:Obligatory Clarification by ILongForDarkness · · Score: 1
      Good point I never really thought of the AV side of the problem of apps phoning home routinely. Perhaps a solution would be rather than let apps phone home make their messages be batched and then periodically (say once a week) ask people "Do you want to let: Office Beta, Visual Studio, Skype whatever "phone home"?". Really how urgent is usage statistics for Office or VS? This week or next week shouldn't matter in a reasonable time MS will find out that I never use dialog X to do Y but am constantly searching for the damned paste button on the edit dialog.

      If it would help unclutter the "is it a virus or is it supposed to do that?" determination of the AV that is what they should do. For a lot of users I think something as simple (though probably hard to implement) as requiring there to have to have been an explicit user GUI interaction triggering the network connection could help. Ie start a torrent app you implicitly agreed to allow that app to connect to the network, some random service running in the background has to explicitly ask for permission the first time since reboot and periodically there after. Things could be bundled a bit, say after 30min a list of things pending network connection could be displayed with a simple allow/allow all/deny/deny all choice.

    89. Re:Obligatory Clarification by oztiks · · Score: 1

      No, you're forgetting one important factor. MS wasn't up with the whole AV process / industry. Remember the really cool partnership Symantec was ranting and raving about opening the doors of heaven to MS programmers giving them literally the keys to the kingdom? Shortly thereafter MS stabbed them in the back creating their own solution?

      I would imagine MS being in the AV industry much sooner but they first had to exploit the knoweldge to get in to the industry originally.

      The moral of the story is Apple is unprepared for personal security, mainly because their marketshare kept them under the radar. Mobile technology that Apple has created has been done in such a way that breaching the iGadget is going to be tough, they've forgotten about their workstations though and the debate that "it wont happen to me because I have a Mac" is no longer valid.

    90. Re:Obligatory Clarification by Runaway1956 · · Score: 1

      Hmmm - yeah.

      How about backporting Security Enhanced Linux, for starters? (probably already done, somewhere, by some evil "hacker", but since I don't use Mac, I couldn't say, yea or nay) Oh - I understand that a lot of Mac-heads will resist the inconveniences involved, just as most Windows users resist the inconveniences of security. But, I would imagine that Mac users will fall in line with something like a modified SEL more readily than the average Windows user.

      And, to be fair, most Linux users don't bother with SEL either. Only the paranoid and/or the poeple with something really worth stealing. So, what you say about Mac users pretty much applies to Linux users as well. We've been under the radar, we're not being shot at - but if the bullets start flying, we DO OWN better armor than hopes and prayers.

      Things to think about, huh?

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    91. Re:Obligatory Clarification by gumbi+west · · Score: 1

      Forget RTFA, you didn't even read this thread.

    92. Re:Obligatory Clarification by gumbi+west · · Score: 1

      You know, many mac users do have Windows computers at work, so we do know that Windows AV is anything but silent.

    93. Re:Obligatory Clarification by shutdown+-p+now · · Score: 1

      Apple's security update include a new daily malware definitions update.

      So, on OS X, every day is a "patch Tuesday" now? ~

    94. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Maybe you didn't read the story but the fix was an absolute fail.

    95. Re:Obligatory Clarification by RightSaidFred99 · · Score: 1

      God it's going to be funny watching the Mac fall to the same malware issues as Windows. Microsoft, through sheer blundering brunt force over the years, undertstands OS security very well. All Apple has is platitudes and wishful thinking to fall back on.

    96. Re:Obligatory Clarification by RightSaidFred99 · · Score: 1

      Nonsensical. By including anti-malware in the OS they would probably be opening a new golden age of Johnny Trustbuster bullshit. Just because the last period ended doesn't mean they won't open a new one if their competitors mewl about it enough.

    97. Re:Obligatory Clarification by RightSaidFred99 · · Score: 1

      Security is one of Microsoft's top concerns, it's a piece of every development methodology they espouse.

    98. Re:Obligatory Clarification by Totenglocke · · Score: 1

      Yes, because all other OS's don't include a browser built-in and people don't expect a browser when they first boot up. Oh, wait....

      Seriously, this argument was old before the first bogus lawsuit was filed 15 years ago (or whenever the exact date was). Anyways, you better believe if they put MSE as part of the OS or even just pushed it through Windows Update that they would get raped just as an excuse for governments to pull in more revenue.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    99. Re:Obligatory Clarification by Totenglocke · · Score: 1

      MSE is silent. You're thinking of McCrappy or Shitmantec (the two most popular AV's for companies). Both of those are utter crap (no idea why companies continue to use them). MSE on the other hand is amazing.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    100. Re:Obligatory Clarification by palegray.net · · Score: 1

      That would be the "self updating" part. It should be noted that "updates" can happen more than once in the course of both program execution and the life of any particular computing system. I'll state for the record that my personal view on any compromise is that it's a lot like sex: once you're penetrated, you're fucked. However, that doesn't mean that continuous adaptive updates won't protect a huge number of users.

      Given your exceptionally low UID and the supposed credibility that comes with it, I'm willing to give you the benefit of the doubt and suggest that perhaps you've had one or five too many whiskeys this evening (Lord knows I've had a couple myself). However, the mods that rated your comment "+5 Insightful" should hand in their Critical Thinking Cards ASAP, because in all truthfulness your reply is nothing short of reactionary garbage, minus even the trivial amount of analysis a Fox News correspondent might attempt to apply to the matter at hand.

      Posting as a die-hard Debian & BSD user, btw. Also, greetz from the 404. Wildcat4lyfe.

    101. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Oh, really... like the way a virus/worm which gets injected on one computer can rocket its way through entire networks in seconds even with all the Windows security bullshit?

      http://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_
      http://www.siasat.com/english/news/us-military-computers-hacked-flash-drive

      Who's the fucktard now, asswipe?

    102. Re:Obligatory Clarification by Divebus · · Score: 1

      Does that mean you have to fall for that trick over and over again to reinfect yourself? The next patch should make the computer punch the user in the mouth when he clicks on it again.

      --

      Most of the stuff on /. won't survive first contact with facts.
    103. Re:Obligatory Clarification by Jibekn · · Score: 1

      They're used because they have fired every IT personnel with a clue.

    104. Re:Obligatory Clarification by Divebus · · Score: 1

      The funniest part is the asshole who owns the computer has to keep downloading and infecting himself over and over - AND DOES IT!!! The next patch should start a counter which scolds the user after the third iteration of being an idiot.

      --

      Most of the stuff on /. won't survive first contact with facts.
    105. Re:Obligatory Clarification by CodeBuster · · Score: 1

      To a user, nothing has changed since before MacDefender.

      No doubt, that is a primary goal of the hack. Users are much less likely to take aggressive removal actions if they don't even realize that their system has been compromised. Meanwhile, the rootkit silently steals login credentials (your online banking credentials perhaps), participates in other hacks and receives instructions from the remote command and control system of the botnet to which it has been linked.

      Mac OS X and Linux have a root user that protects the system against rogue processes causing too much damage.

      The goal is not to "damage" your system, or at least not in the way that most people think. The goal is to monetize your computing resources, without your consent and against your wishes, irrespective of legality. If it makes money and they can use your machine to do it, especially without alerting you to their presence, then it will be done.

      Especially when users hand the trojan their root password, like what was done with MacDefender.

      It was also released in a variant that rooted the machine without needing to ask the user for the password. The update may have closed that particular hole, but silently rooting the system without having to ask a user for the password is a complete p0wn of the most serious kind. These types of exploits are just the sort that rootkit authors are always on the lookout for and will pay dearly for.

    106. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      So far, I'd disagree with that. The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all. We're still at "It just works."

      Not saying that couldn't change in the future, but we're not there yet.

      Windows also has something the very same. Its called Windows Defender. It to is built into the OS, runs automatically and does all the "Just Works" stuff.

      Windows Vista is calling... it wants its ideas back.

    107. Re:Obligatory Clarification by macs4all · · Score: 1

      Before Microsoft really started pouring effort into IE, most people had Netscape.

      Wait, MS didn't really start pouring effort into IE until around version 8. It was mostly IE's being bundled with Windows that made all the difference. That, and Netscape's inability to fix many, many longstanding bugs (until it was Open Sourced, that is)...

    108. Re:Obligatory Clarification by macs4all · · Score: 1

      What I love about this whole scenario is that, if the Mac users that were social engineered into thinking their machines were virused had simply just followed the rule of "Macs don't get viruses", they would have never gotten infected in the first place.

      That is exactly why I postulate that the majority, if not all, of the people who got hosed were ex-Windows users, who are too used to clicking on things that look like Virus Alerts.

      BTW, I have yet to see one of these fake banners on my Mac. I guess I must not be surfing the right sites, eh?

    109. Re:Obligatory Clarification by Xest · · Score: 1

      Agreed, I'm struggling to see by what objective metric Netscape could've been deemed the better browser.

      It really did lose the browser wars simply because it was shit. I dealt with any number of average users who tried it and went back to IE- it wasn't simply that IE was there, it was that it was better so that even those that did try Netscape realised it wasn't worth bothering with, and they fed that back to friends and family, who also saw little reason to bother. Netscape was just technically inferior, and worse from a usability perspective. It didn't even have a performance advantage which is really one of the major factors in pulling people from IE6 to Firefox in the end.

      By the time IE3 and IE4 came out CDs were the normal distribution method for browsers from ISPs, and CDs were still big enough to stick everything an ISP would ever want to stick on them and then some so I don't know what he's on about floppies for, it was really irrelevant at the point the browser wars were truly underway. Just to highlight how big CDs seemed back then, they tended to be the classic 650mb, and a minimal Windows 95 install on your hard drive was 25mb. The install files for it were maybe 80mb, if that.

    110. Re:Obligatory Clarification by macs4all · · Score: 1

      Maybe you didn't read the story but the fix was an absolute fail.

      So, Mr. Smarty-Pants Communist; just exactly HOW would YOU "fix" an OS (any OS) so that the user can't be social-engineered?

      [Crickets]

      Personally, I would be using INTERPOL to locate and prosecute the FUCK out of the people responsible for this. Do that about ten times, and the problem would solve itself.

      If you've got another way that can protect a user from themselves, I'm all ears. And so is the rest of the world.

      OS X doesn't even enable "root". Even an Administrator-level account isn't "root" on an OS X system. But unless you create a scenario where users cannot modify their own system (not bloody likely!), then there will always be the possibility of this kind of slow-moving, small-numbers attacks (everything's relative; but I'm talking about in comparison to some of the worms seen on Windows systems).

      So, prove me wrong or STFU.

    111. Re:Obligatory Clarification by macs4all · · Score: 1

      Because the user experience hasn't changed. The user neither notices the viruses, or the antivirus.

      Um. Er.

      I'm pretty sure the user notices the virus, actually.

      Actually, since the only real goal of this TROJAN (not "virus") was to gather Credit Card info, I'm pretty sure it doesn't actually do anything more after that. It could do some other stuff (like zero out someone's Home folder); but there's no profit in that; so it doesn't. Once it gathers CC info from the LUser, it's work is done.

      And, BTW, if the user is smart enough to run something like Little Snitch, they get another crack at negating the effectiveness of this Trojan; by keeping it from phoning home.

    112. Re:Obligatory Clarification by TheVelvetFlamebait · · Score: 0

      maccodemonkey writes: ...

      TheVelvetFlamebait writes that not all people are stupid enough to be swayed by ad hominem attacks.

      --
      You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
    113. Re:Obligatory Clarification by macs4all · · Score: 1

      Especially when users hand the trojan their root password, like what was done with MacDefender.

      Except it didn't take long for them to release a version that doesn't need the admin password.

      But even with that version, the user still has several chances to avoid infection:

      1. Don't fall for the fake alerts in the first place.
      2. Don't have "Open Safe Files After Downloading" enabled in Safari.
      3. If they DO have that option enabled, don't allow the application to run when OS X puts up the "This application was downloaded from the Internet..." dialog.
      4. Think about why the application immediately wants CC info, and do not enter it until doing further research.

      It is ONLY Lusers that fail at least 3 out of 4 of those "warning signs" (they could have had "Open Safe Files" UNchecked, but downloaded and launched the app on purpose) that were compromised. We'll of course never know how many users got the Alert and said "I don't THINK so!"; but I'm pretty sure that, just as with any other Social Engineering attack, that that percentage was MUCH higher than the people who were gullible enough to actually go through the multi-step process to get infected.

      And none of that was compromised or negated (other than not requiring the additional, unnecessary step of entering a password), by the "non-root" variant. I would imagine that the first version collected the admin. passwords for possible future uses; because the only thing this actually does is eventually trick the user into entering their CC info. Nothing more, nothing less.

    114. Re:Obligatory Clarification by mrrudge · · Score: 1

      Yet you seem to be responding to me questioning this site's integrity by taking a small part of my post in isolation, extrapolating it to a position where you can push your personal politic and adopting an intelectual high ground to create a false position where you can advertise a slippery slope argument as to what will happen ( 'atrophy' ) should I ignore you.

      I also know that an objective discussion of authority must include human beings as an hierarchical animal, and that the cultures we build from this are in large part responsible for us being able to have this conversation. I don't have the time, or expertise, to question the myriad decisions made every day by people in authority which affect my life. Neither do you. A pragmatic response to this may be to choose to which hierarchies I belong.

      The authority I'm questioning is this site in general. The signal to noise ratio is getting worse, encouraged by the editors who have a financial interest in the number of ad impressions generated by it. That the majority of posts in a thread about malware ( a problem which affects everyone, especially those in computing, via spam ) spreading to a previous uninfected platform is discussed with schadenfreude based on Apple's marketing that Apple users are 'different' is disappointing. I have both a mac and a PC under my desk and have noticed no change in personality as I move between them.

      The wrong assumption geek/nerd = intelligent = objective is mine. I'll reexamine as a social stigma labelling I've never felt personally.

    115. Re:Obligatory Clarification by macs4all · · Score: 1

      Give it time. Windows stuff didn't start with intelligent rootkits either, but it sure got there eventually.

      But, the malware writers have had over a decade to get their shit in gear, and this puny Trojan is the best they can do?

    116. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Sounds like MacDefender just works.

    117. Re:Obligatory Clarification by macs4all · · Score: 1

      That's funny that you think inherently reactive, definition-based anti-malware software can do a decent job of preventing infection.

      So, what would YOU do in Apple's position? Keeping in mind that this is a Social Engineering attack.

    118. Re:Obligatory Clarification by macs4all · · Score: 1

      God it's going to be funny watching the Mac fall to the same malware issues as Windows. Microsoft, through sheer blundering brunt force over the years, undertstands OS security very well. All Apple has is platitudes and wishful thinking to fall back on.

      Hardly.

    119. Re:Obligatory Clarification by mrrudge · · Score: 1

      FAQ's. How do I delete my account.
      A: You can't.

    120. Re:Obligatory Clarification by macs4all · · Score: 1

      wrong. apple is a step behind. the approach they are taking will always leave them playing catch-up. obvious fanbitch modding. pathetic.

      Apple is in no way a step behind; other than in the fact that no one can create a malware signature before the malware exists.

      And, although Apple doesn't make a big deal about it, they certainly take security quite seriously, now, and even more in their soon-to-be-released OS X, 10.7, "Lion", as any slashdot reader knows.

    121. Re:Obligatory Clarification by macs4all · · Score: 1

      Apple's security update include a new daily malware definitions update.

      So, on OS X, every day is a "patch Tuesday" now? ~

      And you would propose exactly what update frequency?

    122. Re:Obligatory Clarification by Tim+C · · Score: 1

      Netscape 3.02 was a better browser than IE3 or IE4

      That may be true (though it's not my recollection), but Netscape 4 was a buggy piece of shit that crashed at the drop of a hat - and I say that as someone who used it all the way up until I switched to Linux and started using Galeon instead, and who has never used IE by choice and most likely never will. IE4 was comparable to NN4, and IE 5 simply wiped the floor with it in every way that a user cared about. The years of being stuck at version 4 as they tried to rewrite from scratch for version 5 was the final nail in the coffin.

      Microsoft may have been gunning for Netscape, but it committed suicide before they could kill it. At most they delivered the coup de grace.

    123. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      As a developer and IT professional at the time I can tell ya your full of it. Simply put Netscape dropped the ball, from version 3 onward it was a piece of shit. I got burnt so badly in supporting that piece of crap on an IT project and had to bite my pride half way through and swap to IE as having a slow unstable browser that leaked memory was making our project look terrible. As bad as IE was/is, at the time it was inifinitely better than anything netscape was about to churn out. Netscape commited suicde, Microsoft simply put it out of its misery.

    124. Re:Obligatory Clarification by captainproton1971 · · Score: 1

      It was also released in a variant that rooted the machine without needing to ask the user for the password.

      Citation, please? The variants that I'm aware of were a) Install in the Applications folder, requiring Adminstrator credentials and b) Not needing a password by installing in the user's folder. In neither case was there any “silent rooting”.

    125. Re:Obligatory Clarification by makomk · · Score: 1

      So, Mr. Smarty-Pants Communist; just exactly HOW would YOU "fix" an OS (any OS) so that the user can't be social-engineered?

      The normal practice in this case seems to be difficult-to-ignore and scary warning messages to tell you that you're downloading and running random software off the Internet. Mac OS X is meant to have them, but for some reason they don't seem to be appearing for most people this malware tries to infect.

    126. Re:Obligatory Clarification by makomk · · Score: 1

      1. Don't fall for the fake alerts in the first place.

      Doesn't help - the malware has hijacked various sites and search results, and no interaction with the website is required for it to download and ask you to install it.

      2. Don't have "Open Safe Files After Downloading" enabled in Safari.

      Unfortunately, Apple in their infinite wisdom made that the default, and very few users change the defaults when doing so makes their life less convenient.

      3. If they DO have that option enabled, don't allow the application to run when OS X puts up the "This application was downloaded from the Internet..." dialog.

      As far as I can tell, most users haven't been getting that dialog for some reason. They get an installer prompt that they can decline to avoid being infected, but it doesn't have any warnings on. (There's also the problem of users totally disabling that warning because "Macs don't get viruses" and it's annoying them.)

      4. Think about why the application immediately wants CC info, and do not enter it until doing further research.

      That stops your credit card details from being stolen - probably, anyway - but you still have the problem of a computer that's infected by malware.

    127. Re:Obligatory Clarification by Morth · · Score: 1

      Those are glob patterns based on hexstrings:
      <key>CFBundleIdentifier</key>*<string>com.avm.pkg.avSetup</string>
      avRunner.app*avRunner*DownloadPict.png

      Not sure about the "Identity" param though. It's 160 bits, so could be a sha1 checksum.

      Still seems rather trivial to get around.

    128. Re:Obligatory Clarification by AmiMoJo · · Score: 1

      The malware detection is built into the system, invisible, automatic, and self updating. So the user doesn't have to do X, Y, or even Z at all.

      Sounds exactly like the Microsoft Malicious Software Removal Tool (MSRT) and Security Essentials. It is just a shame that they can't roll Security Essentials into Windows for anti-trust reasons.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    129. Re:Obligatory Clarification by AmiMoJo · · Score: 1

      The first version of all Apple products suck?

      Certainly looks like they want to play whack-a-mole with this one.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    130. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      lol, pure signature scanning died in the PC world back in the early 90's with polymorphic viruses. Its value is ... limited, to say the least. Mac users had better hope this is just a desperate stop-gap from apple whilst they try and find a better solution.

      Also, congrats on your accidental(?) page-widening.

    131. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Please provide evidence that any significant number of malware authors were trying and failing at infecting OSX for the past ten years. I suppose in the RDF influenced reality that exists only in your head it could be true.

    132. Re:Obligatory Clarification by walternate · · Score: 1

      Give it time. Windows stuff didn't start with intelligent rootkits either, but it sure got there eventually.

      But, the malware writers have had over a decade to get their shit in gear, and this puny Trojan is the best they can do?

      Or, they didn't care about size of Mac user base before now and are just getting started, as the recent development seems to indicate.

    133. Re:Obligatory Clarification by ThatsNotPudding · · Score: 1

      What operating system do you think I use, dipshit?

      Assembly?

    134. Re:Obligatory Clarification by m50d · · Score: 2

      I'm guessing VMS or OS/390?

      --
      I am trolling
    135. Re:Obligatory Clarification by speculatrix · · Score: 1

      and the malware is built into the system, invisible, automatic, and self updating. So the user will have to do X, Y, or even Z at all. We're still at "It's just broken."

    136. Re:Obligatory Clarification by markhb · · Score: 1

      IE development didn't stall until after IE 6 was released. IE 1 was essentially just rebadged Spyglass Mosaic, and wasn't even included with the August release of Win 95; you had to buy Microsoft Plus to get it. IE 2 was, I think, only shipped with NT 4 or something, and by the time Y2K patching was in order it was no longer allowed into microsoft.com (it received a hard "upgrade your browser" denial page) so you had to install Netscape if you wanted to download MS's Y2K patches onto a clean install. IE 3 was the first big update that was available, and IE 4 was the one that merged browsing capabilities into Windows Explorer, giving us Active Desktop and the "inextricability" aspect of Win 98. I'm not sure of the timeline for IE 5 and IE 6, but after IE 6 came out and Netscape stalled in 2000 was when IE development stopped.

      --
      Save Maine's economy: write stuff down. All comments are exclusively my own, not my employer.
    137. Re:Obligatory Clarification by N0Man74 · · Score: 1

      Yes, because all other OS's don't include a browser built-in and people don't expect a browser when they first boot up.

      Listen, I know you are having fun being sarcastic and all, but they didn't just simply include a browser, they tied it to the OS at such a deep level, that Microsoft themselves made the claim in court that Windows would be slow, unstable, and would not work without the browser. They did more than include it. They required it, and didn't want you to be allowed to get rid of it.

    138. Re:Obligatory Clarification by CodeBuster · · Score: 1

      Citation, please?

      take your pick

    139. Re:Obligatory Clarification by rgviza · · Score: 1

      ... and never will be.

      --
      Don't kid yourself. It's the size of the regexp AND how you use it that counts.
    140. Re:Obligatory Clarification by thejynxed · · Score: 1

      That's because instead of doing it the Windows way, where the malware clones the Windows error messaging system and reports what it wants, this particular malware just skips that step and outright attempts to suppress any warning windows whatsoever produced by OSX.

      Crude but effective.

      --
      @Mindless Drivel: 100% of Twitter posts ever Tweeted.
    141. Re:Obligatory Clarification by spun · · Score: 1

      It is NOT an ad hominem. Learn your terminology. First, It was not a personal attack. Second, his username is relevant because it indicates his bias. Third, I'm not saying what to make of that information. I'm not saying "Don't trust this guy." For all I know, you feel that an apple fanatic is MORE trustworthy.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    142. Re:Obligatory Clarification by spun · · Score: 1

      Oh palegray, I just can't help myself. It's a weakness. A personal failing. I see a story about Macintoshes and I have to troll it. I've got nothing against Apple. Great brand. I learned the WIMP interface on a Mac Plus with dual floppies. It's the Apple users. Outside of the Christian religion, I have never met a group of people who were, at the same time, so very smugly superior, and yet so full of feelings of persecution. That combination is like waving a red cape in front of my face. It's like Apple users wander around thinking, "Everyone hates me because I'm better than them."

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    143. Re:Obligatory Clarification by amicusNYCL · · Score: 1

      I don't have a Mac to look that up on, but from what I've seen posted here it looks like they are checking for specific files in the package, with hashes or other data to look for. It seems pretty trivial to change the software enough to produce a different hash or pattern if they can identify what is being searched for.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    144. Re:Obligatory Clarification by CheerfulMacFanboy · · Score: 1

      Yeah, malware that steals a user's credit card number and then gets found the next day when the patch comes out sounds pretty useless all right...

      It doesn't steal the CCN (leaving jokes about it still being there aside) - it asks for it.

      --
      Fandroids hate facts.
    145. Re:Obligatory Clarification by Totenglocke · · Score: 1

      So? There are many parts of the OS that you cannot get rid of. I can't get rid of Media Player or Notepad. I can't replace the built-in zip program. I can't replace the built-in defrag program. However, what you CAN do (just like with IE) is install something else and not use the one that's included in the OS. No one is forcing you to use IE or any other default program - you have the freedom to install alternatives all you want.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    146. Re:Obligatory Clarification by jscotta44 · · Score: 1

      Wrong. It continues to just work.

      New Mac Defender variant already being blocked by Mac OS X

      http://www.macnn.com/articles/11/06/02/definitions.updating.silently/

    147. Re:Obligatory Clarification by jscotta44 · · Score: 1

      And with years of notice that it would be ending, Microsoft did not have a service pack ready to go that would include all that goodness? Maybe it is running on a Vista release schedule.

    148. Re:Obligatory Clarification by jscotta44 · · Score: 1

      The moral of the story is Apple is unprepared for personal security, mainly because their marketshare kept them under the radar. Mobile technology that Apple has created has been done in such a way that breaching the iGadget is going to be tough, they've forgotten about their workstations though and the debate that "it wont happen to me because I have a Mac" is no longer valid.

      Wrong. First off, trojan's have always been around–even for Macs. If you give a piece of software permission to screw you, then bend over and don't complain. However, there has yet to be a real self-propagating virus on OS X, in the wild. Can you say that about Windows or even Linux (I'm sure a fan of the odd distro will jump in here and correct me that the statement doesn't apply to *all* distros)?

      And, no, Apple has not forgotten about their workstations as evidenced by the built-in protection provided by OS X. And by the evolving Mac App Store where users can get curated apps similar to the App Store for the iPad/iPhone/iPod.

    149. Re:Obligatory Clarification by jscotta44 · · Score: 1

      And this was at a time when they were purposefully using their monopoly position to squash competition (i.e. Netscape). There is nothing inherently evil in being a monopoly. However, Microsoft misused that market position and that is what got them in trouble.

    150. Re:Obligatory Clarification by TheVelvetFlamebait · · Score: 1

      OK then, my mistake. I must have misunderstood you.

      However, I have to say, it's not even a matter of trust, that's my point. The bias is only relevant if we have to take any of his points on faith, which we don't.

      Ad hominem arguments are just one of many fallacies that I abhor, but that seem to be so popular. Sorry that you got unjustly caught in my (over)zealotry.

      --
      You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
    151. Re:Obligatory Clarification by jscotta44 · · Score: 1

      1. Don't fall for the fake alerts in the first place.

      Doesn't help - the malware has hijacked various sites and search results, and no interaction with the website is required for it to download and ask you to install it.

      Ummmit still does require user interaction to run the installer. It just doesn't require Admin privileges because it is installing in the user's folder and not the normal Applications folder.

    152. Re:Obligatory Clarification by spun · · Score: 1

      That's alright, it was bordering on ad hominem, and might legitimately be called a case of 'poisoning the well.' But we actually must take the original poster's main point on faith, that it still 'just works.' An by 'taking it on faith' I mean we must believe it despite the valid, factual evidence that it just DOESN'T work.

      --
      - None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
    153. Re:Obligatory Clarification by toadlife · · Score: 1

      So, what would YOU do in Apple's position?

      1) Educate, Educate, Educate - "You're not in Kansas any more Mac users."

      2) Work on sandboxing userland apps like Safari.

      3) Start a drive to write software that contains fewer flaws - like Microsoft did several years back with their SDL.

      Reactive stuff has its place, but using it as a primary defense is a recipe for disaster.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
    154. Re:Obligatory Clarification by Stone2065 · · Score: 1

      Yep, and Windows has a couple of decades in experience in that field, unlike Apple. Eat shit Steve Jobs...

      --
      Stone
    155. Re:Obligatory Clarification by adamstew · · Score: 1

      Forefront end point protection and MSE are almost exactly the same thing... same user interface, same engine, etc. The only difference is licensing and forefront can be centrally managed. They offer the same exact protection otherwise.

    156. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      Citation needed... seriously.

    157. Re:Obligatory Clarification by Stone2065 · · Score: 1

      Ignorance is bliss...

      --
      Stone
    158. Re:Obligatory Clarification by Stone2065 · · Score: 1

      What color is the sky on YOUR planet?

      --
      Stone
    159. Re:Obligatory Clarification by Stone2065 · · Score: 1

      Morons are morons... regardless of position...

      http://en.wikipedia.org/wiki/Jacob_Zuma

      --
      Stone
    160. Re:Obligatory Clarification by Stone2065 · · Score: 1

      Worse... at least Windows has a few decades of making a stab at security... and it looks like Apple is still in kindergarden regarding security...

      --
      Stone
    161. Re:Obligatory Clarification by macs4all · · Score: 1

      To address your points: 1. User education is important on any platform; so I will agree in theory. However, I hasten to point out that if those users had bought into the "Macs don't get viruses" mantra, they wouldn't have opened their wallets and exposed their credit cards to "eradicate" that which does not exist. It was the ones that DID believe the fake warnings that got infected; not the people who know better. Think about it.

      2. Although I DO wish they'd change that damned default "Open Safe Files..." in Safari, actually, what Apple did with Safari as far as Sandboxing goes, was better than simple Sandboxing. At least for Snow Leopard. For Leopard users, there is a third party haxie, if you're willing to give up some functionality.

      3. Apple hasn't just been sitting around "in Kansas", like most slashdotters seem to think. And as far as OS X itself goes, Apple is now going one better: It turned the soon-to-be-released 10.7 "Lion" over to security researchers and white-hat hackers to pound on for awhile, including the redoubtable Charlie Miller.

    162. Re:Obligatory Clarification by exomondo · · Score: 1

      Especially when users hand the trojan their root password, like what was done with MacDefender.

      Except it didn't take long for them to release a version that doesn't need the admin password.

      But even with that version, the user still has several chances to avoid infection

      What's your point?

    163. Re:Obligatory Clarification by captainproton1971 · · Score: 1

      Citation, please?

      take your pick

      Nice try. But I think you may want to look up the meaning of the word “rooting”.

      My objection isn't that this not-so-clever piece of malware can be installed, with user's privileges, in the user's own directory. That much is clear. Moreover I'm not saying this is harmless, either.

      But you've made a claim of “silent rooting”, in your words “a complete p0wn of the most serious kind”. Can you point to any reference saying that there's any sort of privilege escalation here? Or are you conflating user-level executable privileges with rooting?

    164. Re:Obligatory Clarification by causality · · Score: 1

      Yet you seem to be responding to me questioning this site's integrity by taking a small part of my post in isolation, extrapolating it to a position where you can push your personal politic and adopting an intelectual high ground to create a false position where you can advertise a slippery slope argument as to what will happen ( 'atrophy' ) should I ignore you.

      I was actually agreeing with you/supporting you. If it's "an intellectual high ground" then it looks like you are there with me. High ground is fine. It's the "I have the high ground and you don't because I'm better than you" mentality that causes problems. I reject that latter idea for the BS that it is.

      I also know that an objective discussion of authority must include human beings as an hierarchical animal, and that the cultures we build from this are in large part responsible for us being able to have this conversation. I don't have the time, or expertise, to question the myriad decisions made every day by people in authority which affect my life. Neither do you. A pragmatic response to this may be to choose to which hierarchies I belong.

      I think this hinges on what you call "authority". What I was referring to was not a hierarchy at all, but the well-known logical fallacy of the "appeal to authority" which could also be called "appeal to credentials". A low-UID user is not an authority in the sense that they may tell others what to do. A low-UID user is, in the eyes of some, an "authority" in the sense that they are assumed to be smarter/wiser/more experienced/more knowledgable than other users. It is that usage alone to which the fallacy applies.

      As for me, I view all fellow Slashdotters as equals. That's one reason why I'm not impressed by a low UID. That's also a reason why I am unconcerned with your position in any hierarchy. I strongly prefer to deal with you as an individual. I think that's both more pleasant and more honest than looking for a way to pigeonhole or stereotype you.

      None of this requires questioning absolutely every decision made by absolutely everyone. It merely requires reading a post as though I could not see the poster's UID. That's a lot simpler, you know.

      The authority I'm questioning is this site in general. The signal to noise ratio is getting worse, encouraged by the editors who have a financial interest in the number of ad impressions generated by it. That the majority of posts in a thread about malware ( a problem which affects everyone, especially those in computing, via spam ) spreading to a previous uninfected platform is discussed with schadenfreude based on Apple's marketing that Apple users are 'different' is disappointing. I have both a mac and a PC under my desk and have noticed no change in personality as I move between them.

      Man, you're not kidding about the signal-to-noise ratio. I agree that the editors are at best indifferent to it so long as ad revenue keeps coming in. That's one reason I am occasionally very hard on them when they can't even be bothered to run a spell-checker on submissions. I feel you should at least demonstrate the most basic competency at your job before you start getting greedy. But that again is not "authority" as I originally referenced it.

      There indeed are rabid fanboys on this site who will think you're some kind of radically different person just because you have a Mac. Or because someone else doesn't. This is so important to them that it will color everything you say in their minds. If they don't like your affiliation, they will try very hard to twist your words to make you wrong because they determined that before they read a word you said. The label is that important to them, being petty and small-minded as they are.

      While it's not nearly so bad, caring about someone's UID is just a more benign form of the same process. Both processes are something other than reasonably and objectively evaluating w

      --
      It is a miracle that curiosity survives formal education. - Einstein
    165. Re:Obligatory Clarification by CodeBuster · · Score: 1

      Even if this case didn't include that feature (probably either by luck or because this was merely a proof of concept), it's only a matter of time before someone hooks up the next bug to privilege escalation code. Both the iPhone and mac books have been popular and successful targets at the p0wn to own competitions over the years. Also, the mac users that I have come into contact with over the years have, almost without exception, been smug and dismissive of any sort of virus or trojan on their beloved macs. These people are setting themselves up for some nasty surprises down the line if they don't make some changes to their computing habits.

    166. Re:Obligatory Clarification by palegray.net · · Score: 1

      You have made my evening, my good sir :). I must admit that although I happen to be sitting here typing this response on a Macbook, I wholeheartedly agree with everything you've said. It's bad... really bad... I go to coffee shops and literally hear other Mac users talking wistfully to one another about how people just don't understand how superior the platform is. Meanwhile, I'm sitting a few feet away with a slew of terminal windows open, trying my best to ignore them and just get work done, and hoping nobody will associate me with the aforementioned people. It's bad...

    167. Re:Obligatory Clarification by gumbi+west · · Score: 1

      Nope, I'm thinking of MSE. Mine never stays up to date and auto updating it doesn't work, so MS tells my my AV is out of date... lots of chatter every time I boot.

    168. Re:Obligatory Clarification by oztiks · · Score: 1

      Come on, Mac has been running a true multiuser os just a little longer than PC, so permissions? Really? Nah. Apple has HAD an insignificant market share till now, Apple drives most of it's popularity from it's mobile technology with most of it's revenue coming from the iPhone alone, the rest is iPad/iPod/workstations if you look at the figures Trojans and otherwise making a piece of malware for Mac would be akin to making a virus that only goes after Dell PC's alone.

      I know that the Apple fan base may think otherwise but rationally logically all the above it simply isn't so.

      May I point out that there is currently an attack on happening on Apple's AppStore, what may come of this may be a good indicator of how prepared Apple really is....

      Sent on my iPad (Yes, i don't hate apple) ...

             

    169. Re:Obligatory Clarification by jscotta44 · · Score: 1

      I've heard the market share argument for years and it still doesn't add up. While there are fewer Macs, virtually all of them have been running without any type of malware protection. Add to that Mac aficionados have been rubbing the virus writers nose in the fact that not one successful virus has been released into the wild on the Mac platform all this time. Millions and millions of unprotected Macs to use as bots and not a single successful virus. Not to mention that according to some of the posters on this forum, Mac buyers are people with lots of money and no sense so they obviously wouldn't know what to do if they did get a virus and still no one is successful in attacking the user base. Come on. Please try a new one.

      As to the iOS devices, there are more of them out there than there are Android devices and they are a far more consistent hardware platform. Yet, where have all the successful malware attacks beenAndroid platform.

      What attack is happening on the App Store? I have seen nothing in the news or the net to indicate that there is an attack ongoing against the App Store. Link please.

    170. Re:Obligatory Clarification by oztiks · · Score: 1

      Go look on the official apple discussion forums, it's been hammered with people having their money stolen AS WE SPEAK.

      Apple knows nothing about security, i've been working in the industry for years and it's a common denominator, their lack of practice will finally catch up on them. 1 word Sony .... Nothing separates Apple from any other vendor and for those who think otherwise are just showing their ignorance / arrogance ...so on a so fourth

    171. Re:Obligatory Clarification by Anonymous Coward · · Score: 0

      I think you are at least partially correct about there being a problem on one or more of Apples online stores. However, from what I've been able to glean, we really don't know exactly what is going on. In fact, the behavior I've seen could also be caused by a screwed up billing program - it could also be malicious act. We don't know yet. However your quick conclusion based on so little data speaks to the arrogance you claim for others - not to mention a dose of pure Apple hate.

      What practice of Apple's will catch up with them? I have been "in the industry" since the mid 70's.

      And, yes, you are correct, there is little separating Apple from other companies in terms selling computers and there being ways to get around any security. However, their security policies have done pretty well for then and their users for a long time. And they've been hiring very strong security personnel in obvious moves to continue a secure computing environment.

    172. Re:Obligatory Clarification by oztiks · · Score: 1

      Simple answer is this, Apple tries to run this germ free environment. People who are pro PC hate this because it's restrictive in nature. PCs have always been stung by the fact they are too open.

      In a nutt shell, MS users in particular have been stung but now it's so common place to run AV if you have a windows PC people are aware of security if you have a PC. Apple users don't have this, they assume everything is a ok (just like Linux users) and it's unsuspecting.

      All it takes is one or two reaalllly nasty germs to enter Apple's sanitary environment and thats it .. Game over .... And in a big way.

      hypothetical ...

      You've seen the rsa issue. Imagine if that was too happen to verisign and hackers could make apple friendly ssl certs, a couple of /etc/host files changed on a couple of big name ISPs. Good night Apple.

      Want any examples of possible ways to dismantle? Happy to offer senarios.

  2. And this is surprising why? by jo_ham · · Score: 5, Insightful

    It's a new piece of malware, as far as definitions go. It will be blocked tomorrow when the tool checks for new definitions.

    It still requires that you dismiss the "this file appears to be a file downloaded from the internet from [address], are you sure you want to run it?" dialog box. Plus, with no admin password it's local user only (which is still bad, just not root capable).

    Alas, the arms race begins. At least it's only trojans.

    1. Re:And this is surprising why? by mlts · · Score: 1

      Local user can be mission accomplished very easily. For example, users with admin privs have write access to the /Applications folder. This means that malware can infect programs there with ease.

      At least Apple is one step ahead with the App Store. I can see the "file downloaded" dialog be only available to admins only in a future rev of OS X.

    2. Re:And this is surprising why? by Angostura · · Score: 3, Interesting

      It will be blocked tomorrow when the tool checks for new definitions.

      That's the interesting question, isn't it - the extent to which Apple has committed the resources to block malware effectively on a daily basis. It'll be interesting to see whether they can nip things in the bud sufficiently to dissuade the bad guys.

    3. Re:And this is surprising why? by Anonymous Coward · · Score: 1

      It's not even a trojan. It doesn't "install" anything; doesn't touch any files on your HD; doesn't write to anywhere. It just tricks the user into supplying his/her credit card info, and that's it.

    4. Re:And this is surprising why? by DJRumpy · · Score: 1

      I don't believe so. Looking at random apps in the Applications folder, I don't own any of them. System does. Everyone else has read only access.

    5. Re:And this is surprising why? by DJRumpy · · Score: 1

      Actually looking a bit deeper, some do show me as owner. It appears all of the system apps are owned by System. Most apps by 3rd parties are also owned by system, but those I packaged myself into DMG files for easier backup/installation are owned by me. I suspect my use of this type of backup isn't all that common though.

    6. Re:And this is surprising why? by E+IS+mC(Square) · · Score: 3, Informative

      Not surprising at all. That's how Windows works too.

    7. Re:And this is surprising why? by Bobfrankly1 · · Score: 0

      It's a new piece of malware, as far as definitions go. It will be blocked next month when Apple updates the definitions.

      FTFY

    8. Re:And this is surprising why? by Anonymous Coward · · Score: 0

      Trojans aren't backdoors in the computer sense, they're just generally used that way (or for installing other backdoors/rootkits/etc). A fake program which only transmits stolen CC info is a trojan.

    9. Re:And this is surprising why? by mrrudge · · Score: 1

      Yawn.

    10. Re:And this is surprising why? by Anonymous Coward · · Score: 0

      I believe that anything installed through an installer is owned by System, anything installed by dropping the app bundle into the Applications folder is owned by the user that dropped it.

    11. Re:And this is surprising why? by jo_ham · · Score: 2

      Sigh. Don't you have a bridge to guard?

      The article that is practically on the same page as this one mentions the daily updates to the definitions, and the daily checking by the new tool. Given that it's June 1st at the moment, "next month" is just baseless bashing.

    12. Re:And this is surprising why? by NatasRevol · · Score: 1

      Users with admin privs still require sudo, ie typing in the admin privilege password, to install in the /Applications folder. That's not "with ease". That's security.

      --
      There are two types of people in the world: Those who crave closure
    13. Re:And this is surprising why? by rsborg · · Score: 1

      For example, users with admin privs have write access to the /Applications folder.

      IIRC, on the Mac, it behaves like a sudo permission: you are required for password anytime you touch /Applications (which is why XAMPP for Mac was such a PITA - they put htdocs in /Applications!!! - protip: symlink it or change the php.ini so you can place webroot elsewhere and change content without admin pwd).

      In short, no, local user access won't allow one app to infect others (unless they're in ~/Applications).

      --
      Make sure everyone's vote counts: Verified Voting
    14. Re:And this is surprising why? by Bobfrankly1 · · Score: 2

      Considering how long it took them to even acknowledge the first iteration gives me a little guideline. While there may be "daily updates", that doesn't mean that they develop the resolution in 24 hours. Granted, 30 days is a little excessive, but I'd be surprised if it showed up by the 20th.

      And I don't guard the bridge, I live UNDER it, you insensitive clod =]

    15. Re:And this is surprising why? by exomondo · · Score: 1

      Users with admin privs still require sudo, ie typing in the admin privilege password, to install in the /Applications folder. That's not "with ease". That's security.

      If you read it again his/her 'with ease' comment was regarding what the malware could do once it's installed in that location with those privileges, not the process of getting it installed.

    16. Re:And this is surprising why? by LordLimecat · · Score: 1

      If you think youre not at parity with Windows, youre mistaken. Windows already has software built in and freely downloadable which eliminates threats. The MSRT runs every time updates are done, and apparently is capable of removing significant threats, and MSSE is quite good-- Ive seen it remove bootkits.

      Windows also already has tons of prompts for running files downloaded from the internet (think "executable bit"-- check properties of any exe you download from the internet for the "unblock" button), especially those done from its native browser, and it already has prompts for administrative functions.

      Based on the wording of your post, it sounds like you believe Mac has a leg up here. In what way do you believe that to be the case? Right now, the only way Im aware of to infect a Win7 machine running IE9 is thru an outdated Java or Flash plugin. On Mac, those drive-bys "just work", according to the stories we've been seeing.

    17. Re:And this is surprising why? by NatasRevol · · Score: 1

      If you read it again, the comment was that malware can infect programs in the Applications folder with ease. Which isn't true. It still requires sudo, which means typing in the admin password, even if it's blank (you still have to address the dialog box that pops up).

      --
      There are two types of people in the world: Those who crave closure
    18. Re:And this is surprising why? by jo_ham · · Score: 1

      Because OS X also has those things - files downloaded from the internet have the url embedded and you are warned if you open them (before they execute) and you have to ok that.

      It also has prompts for admin functions, UAC style (except it's done pro-actively - you have to unlock to change, rather than clicking something and having the system pop up a dialog box), as well as the usual admin requirements to install certain things.

      I believe it does have a leg up, but only in the sense that Unix in general has a leg up because the starting point was so different. Unix, Linux and the like have always had a leg up in that respect just by their nature. It's not trolling, it's simply fact. Windows has got much better in recent years - Win 7 is actually really good, and the instances of viruses is going down.

      And these "drive bys" do not just work - if you believe the stories then you're buying the FUD. For any of this malware you work you have to bypass the "this is an application downloaded from the internet - run it? yes/no" and then click again in the installer (and with the first version, give admin password), and then install it. There's no "drive by infection". Have you ever actually used a Mac or are you just going on what you've read in a poorly written article?

      This doesn't diminish security issues - clearly trojans are unpleasant and annoying, but this whole "menacing" malware that's "plaguing" OS X is really just sensationalism at this point.

    19. Re:And this is surprising why? by exomondo · · Score: 1

      If you read it again

      I don't have to read it again, my comment was accurate.
      Your comment: typing in the admin privilege password, to install in the /Applications folder. That's not "with ease". is clearly referencing installing, not the actions of an installed application.

    20. Re:And this is surprising why? by shutdown+-p+now · · Score: 1

      It still requires that you dismiss the "this file appears to be a file downloaded from the internet from [address], are you sure you want to run it?" dialog box. Plus, with no admin password it's local user only (which is still bad, just not root capable).

      This all exists on Vista/7 as well. Unfortunately, experience with those features have shown that enough users will click on "yes damn it I want to run it", and will elevate to admin.

    21. Re:And this is surprising why? by benjymouse · · Score: 2

      I believe it does have a leg up, but only in the sense that Unix in general has a leg up because the starting point was so different. Unix, Linux and the like have always had a leg up in that respect just by their nature. It's not trolling, it's simply fact. Windows has got much better in recent years - Win 7 is actually really good, and the instances of viruses is going down.

      Yes you are trolling. You are repeating unsubstantiated claims based on hyperbole and wishful thinking. You and others are repeating these claims without ever - like you this time - offering any justification for what it factually *is* that gives it a leg up. Like all good FUD it has a little piece of truth on which it can embellish: DOS and the Windows 9x family were very much single-user in the design mindset. But Windows NT was not built upon DOS and neither Windows 9x. Windows NT was developed ground-up as a multi-user networked operating system. Unix was built mainly in a "friendly" academic environment at a time where saving a single could make the difference.

      There is no magical component of Unix or OS X. There is the basic me-us-everyone granularity in access control, with ACLs bolted on as an afterthought. The NSA actually had to develop SELinux for Linux - otherwise it would not be possible to certify Linux for use in sensitive government areas. Windows NT met those requirements from the beginning. Proper ACLs were in Windows NT from the very beginning.

      Unix security model is still centered around the file system. Windows allows all kinds of objects - also in-memory objects to be secured through the use of handles. A process in Windows can create a handle for an object, strip rights from it and then pass it to another process or thread which can then access the same in-memory object but only with the restricted rights. Windows designers actually *thought* about securing individual objects and how to pass them to another process.

      Only with exensions such as SELinux (and only if you actually enable and actually use such an extension) did *nix processes actually gain meaningful tokens - describing what the process is allowed to do. Until then it was always about the user running the process. Windows always had a per-process token which was initialized from the user token but which was always separate from it. Thus restricting what a process can do (sandbox style) came natural to Windows. It is not that the Windows way is superior to the current *nix state when you consider the extensions. But there was nothing inherently more secure about *nix. On the contrary.

      Unix style user and group identification is integer-based. What happens to integers when you go out on the network and meet other systems? The clash. User ID were not designed with wide-scale networks in mind. How are users identified in Windows? With universal unique security identifiers (SIDs). The integer restrictions can (now) be easily overcome. But there never was such a restriction with Windows.

      Unix security model is on the basic level much simpler than Windows. So simple that the concept of privileges beyond rights to access files were not thought of. Accessing certain functionality is considered restricted and only root can access it. Rather than being able to grant such access to individual users (that would require privileges) Unix went for a system with setuid and setgid bits. Basically, if you run a setuid executable (a setuid "server") you are then running as the owner of that executable. Pretty smart, until you realize what will happen when there's a bug in in that executable, e.g. a buffer overflow, an injection vulnerability etc. Then the attacker not only gains the privilege which was the purpose of the setuid server he is running as root with all of root's privileges - i.e. everything. Many vulnerabilities have been found in setuid servers over the years and many systems have fallen because of this. This is a design flaw because a setuid

      --
      Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
    22. Re:And this is surprising why? by Tim+C · · Score: 1

      Plus, with no admin password it's local user only (which is still bad, just not root capable).

      I don't know about you (obviously), but on my computer my user account owns all the files that I care about, and is the account I use while browsing the internet, checking/sending email, checking my bank account online, etc.

    23. Re:And this is surprising why? by AmiMoJo · · Score: 1

      I agree completely but I think it is worth stating why Windows has had some many security issues over the years. When people transitioned from 9x to 2000/XP in order to be backwards compatible the default user is an admin and much of the stuff that could be locked down isn't.

      Vista fixed a lot of that. Programs can no longer write to any random part of the filesystem, system setting registry access requires elevated privileges via a UAC prompt etc. People hated this in Vista, it was slow and they seemed to be bombarded by security warnings. However, after a couple of years applications were updated to stop doing the things that were generating the warnings and put files in the right place. Performance was tuned up and we ended up with Windows 7.

      Sure enough it has proven to be much more resilient to viruses than XP. I used to fix computers for a living and we never saw Vista or 7 machines that were as badly infected as the average XP install.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    24. Re:And this is surprising why? by jo_ham · · Score: 1

      Yes, hence why I said it was still bad - if the thing trashes your home folder then you can hopefully restore from Time Machine or other backup, which you'd likely have to do anyway in the event of nuke and paving your drive if you had something that had local access *and* root.

      It does suggest that perhaps Time Machine is a weakness - a local user can write to their Time Machine folder, and thus can delete files on it (or the whole thing). Perhaps the process of writing to that folder should be restricted to root, and the local user only has read access, thus in the event of a piece of malware (that doesn't have root) hosing your home folder, it can't touch your backups.

      You're right that I ultimately don;t care about anything outside my home folder - I can just reinstall to get all that back.

    25. Re:And this is surprising why? by 0ld_d0g · · Score: 1

      It also has prompts for admin functions, UAC style

      Actually OSX has nothing even close to a UAC prompt. The UAC prompt runs on a separate desktop session (session 0) making it virtually impossible to spoof, bypass or keylog. (without a previous *kernel* level infection, but then you're already screwed). Microsoft did learn their lesson the hard way because of the previous shatter attack vulnerability.

      AFAIK The OSX Authentication dialog UI is easy to fake with a regular UI that looks like the real thing and can be used to keylog the users password. And apparently earlier you could even fake the dialogs to seem as if they came from a different source. Not sure if this has been fixed. I don't currently have access to OSX to test it out.

      http://alastairs-place.net/archives/000079.html

      Unix, Linux and the like have always had a leg up in that respect just by their nature.

      Please explain how the lack of granular security that NT contains by default is an "advantage" of unix design. Hell thats the reason SELinux exists (which admittedly goes beyond what NT has)

      And these "drive bys" do not just work

      Now you're just being delusional. There have been dozens of jailbreaks that can be simple achieved by visiting a website. Any clue on how they work? Hint: A remote code execution vulnerability in safari. AKA - Drive by install. AKA - Pwned.

      http://www.google.com/search?&q=safari+remote+execution+vulnerability

    26. Re:And this is surprising why? by jo_ham · · Score: 1

      You misunderstand me - I'm not talking about the password prompt, I'm talking about the "unlock" feature that is in place of UAC prompts in Windows. So, nothing can be changed unless you click the padlock and then authenticate before you do anything (rather than saying "do this" and then have to respond to a UAC, it's just the other way around). You can't really spoof it, and I think it's a good way to implement it, since you have to decide ahead of time that you are going to change something system related. The Windows UAC method is obviously ok too - anything to increase security is good. I was addressing the claims that OS X simply didn't have anything like this, when it clearly does.

      And with the jailbreak you're now talking about iOS - are there any in-the-wild exploits on OS X? No, I didn't think so. Plenty of holes - but that's to be expected; they get found, and then patched. It's how security is improved.

      No, what I was talking about, far from being "delusional" was addressing the false statement that the Mac Defender trojan is a "drive by install" as claimed. It is not. Not by any stretch of the imagination.

    27. Re:And this is surprising why? by 0ld_d0g · · Score: 1

      You can't really spoof it, and I think it's a good way to implement it, since you have to decide ahead of time that you are going to change something system related.

      Well I mean't you can spoof the enter password dialog. Most users won't notice that its not the system asking for a password and would just enter it.

      And with the jailbreak you're now talking about iOS - are there any in-the-wild exploits on OS X? No, I didn't think so. Plenty of holes - but that's to be expected; they get found, and then patched. It's how security is improved.

      Well I'm talking about safari, not necessarily iOS. Unpatched exploits for browsers/plugins are available for sale on many blackhat forums. I obviously can't show them to you because you need to pay money before anyone will give you details on them. The google search I linked to will give you details on previous safari vulnerabilities which allow an attacking website (often an external JS/Flash/Java ad banner displayed on a legitimate website) to run arbitrary code on the victims osx box.

      No, what I was talking about, far from being "delusional" was addressing the false statement that the Mac Defender trojan is a "drive by install" as claimed. It is not. Not by any stretch of the imagination.

      You're changing the argument. Actually, the person you were replying to was just describing a general mechanism on windows which uses browser or browser plugin security bugs to install software via simply visiting a website. You claimed that its not possible on the OSX. It clearly is.

    28. Re:And this is surprising why? by adamstew · · Score: 1

      Installed applications can only install in to their own domain within the /Applications folder. If they want to roam outside that territory, they still need to sudo which prompts the admin privilege password prompt. They can not infect other applications with out that.

    29. Re:And this is surprising why? by exomondo · · Score: 1

      Installed applications can only install in to their own domain within the /Applications folder. If they want to roam outside that territory, they still need to sudo which prompts the admin privilege password prompt. They can not infect other applications with out that.

      That does assume that all applications store all their data in their own domain in the Applications folder...which they don't.

  3. How long by Synesthes · · Score: 2

    I wonder how long it will take them to patch it this time. It almost seems like the creators of the malware were prepared and had something ready to go even before it was fixed.

    1. Re:How long by toadlife · · Score: 1

      I think having something ready to go ahead of time would be a potential waste of effort, since the new definitions might, by chance, detect it too.

      Most of these malware apps are spread via hacked ad servers, which allows authors to touch millions of potential "customers" in a matter of hours with their new wares, so I suspect the most cost effective thing to do is to wait for a new definition update and then write and test new versions of the malware against the new definitions.

      --
      I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
  4. Any first hand experience? by H0p313ss · · Score: 2

    the menacing MacDefender malware that has plagued users for nearly a month

    My personal laptop is a Macbook pro, and I have only heard of this through the media. Has anyone actually seen this first hand?

    --
    XML is a known as a key material required to create SMD: Software of Mass Destruction
    1. Re:Any first hand experience? by Brett+Buck · · Score: 1

      Yes, actually, from a link on Slashdot (national geographic Area 51 article) I knew enough to get rid of it.

    2. Re:Any first hand experience? by jo_ham · · Score: 3, Informative

      I have seen it attempt to get me to download it - I got hit by a google image search result where it showed me a "Finder" in Safari, with an almost convincing progress bar etc while it "scanned for viruses".

      I didn't click the download button though.

    3. Re:Any first hand experience? by ugen · · Score: 1

      I only heard about this too. I also only heard about Windows viruses and trojans even though I also own a number of Windows machines.
      Bottom line - I don't expect my computers to ever be infected, but it's out there.

    4. Re:Any first hand experience? by Sarten-X · · Score: 0

      My fiancée came across a page that automatically downloaded it two days before I'd heard anything about it in the media..

      --
      You do not have a moral or legal right to do absolutely anything you want.
    5. Re:Any first hand experience? by MightyMartian · · Score: 1, Troll

      Translation: I'm a Mac user, so my head is firmly planted up my ass, and there it will remain, so I don't have to see my precious platform for what it is; as vulnerable as any other.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    6. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      One came into the shop yesterday for this virus. I wasn't the one working on it but I was curious so I took a quick look. I'm not sure if this is the case all the time, but in addition to the scare-ware this mac was also opening or redirecting to adult sites. The overall look of the app is pretty similar to the PC variants, one detail thing i noticed is the little red, yellow, green buttons up top are all grayed out. I don't know how much it limits your ability to use the computer however.

    7. Re:Any first hand experience? by imamac · · Score: 1

      I helped a few people get rid of it (very easy to do).

    8. Re:Any first hand experience? by Niris · · Score: 1

      I've seen probably six or seven come in to Geek Squad with it. Super easy to remove, but it's out there.

    9. Re:Any first hand experience? by jo_ham · · Score: 1, Flamebait

      Translation: I'm a friendless neckbeard living in my mom's basement on Mountain Dew and Cheetos and am jealous of all those "hipster" kids with their friends and "cool" gadgets. Girls don't seem to appreciate I compiled my own kernel!

      See, I can generalise too!

      (seriously, I cannot see how you got to where you were from the OP's question, which had no grandstanding or platform flaming or anything, just a query about an issue that is apparently "widespread" and "menacing" (according to the article) on OS X.

      This style of "FTFY" post is just tiresome and belongs back in high school kid.

    10. Re:Any first hand experience? by Anubis+IV · · Score: 3, Interesting

      Same happened to me (Google image search and all, and not even for anything that would take me to the sort of places on the 'net where I'd expect malware to reside), except that it offered no download button and instead downloaded immediately. I have my Safari set up to not automatically open "safe" files, so that's as far as it got, but it was annoying nonetheless.

    11. Re:Any first hand experience? by DeadCatX2 · · Score: 3, Informative

      Google Image Search is EVIL

      I was looking for a certain type of connector, so I google image'd it. While perusing results for something as totally bland as surface mount connectors, I suddenly got a UAC prompt. Even after canceling it, I got an icon in the taskbar. Thankfully the denied UAC kept it from getting its hooks in, and I promptly found and deleted the offending file.

      Now, I won't even touch Google Image Search through a remote connection to a virtual machine running Chrome in a sandbox on someone else's network.

      --
      :(){ :|:& };:
    12. Re:Any first hand experience? by AstrumPreliator · · Score: 1

      MacDefender tried to install itself on my system a few days ago. Oddly enough another fake anti-virus bit of malware did the same to my Windows machine on the same day. With MacDefender nothing happened as I have the open safe files option disabled in Safari. Of course on Windows it had already installed part of itself and was spamming UAC elevation requests non-stop until I nuked it, at least it looks like I did anyway.

      I suppose it was only a matter of time until OS X became a target. Granted this isn't as bad as what happens on Windows, but the arms race has begun.

    13. Re:Any first hand experience? by MightyMartian · · Score: 0

      Not my fault Mac users are arrogant and useless.

      --
      The world's burning. Moped Jesus spotted on I50. Details at 11.
    14. Re:Any first hand experience? by Dunbal · · Score: 1

      just because you paid more for your gadget doesn't make it "cool". You want cool I invite you to come see my screaming 4+GHz water-cooled rig (pun intended).

      --
      Seven puppies were harmed during the making of this post.
    15. Re:Any first hand experience? by Skuld-Chan · · Score: 1

      I've seen it a couple of times in the university helpdesk I work at ;).

    16. Re:Any first hand experience? by jo_ham · · Score: 1

      Indeed, I should have said what I was searching for - the ORLY owl. A friend and I have been trading more and more outlandish ones back and forth as we both complete various menial day-to-day chores, just to brighten the mood.

      I suspect that the malware authors went for things that people search for a lot - so that would be porn, memes, and popular culture.

    17. Re:Any first hand experience? by jo_ham · · Score: 1

      Oooh, burn!

      So, your response is... to repeat your initial insult?

      Change the record, or pass the ball.

    18. Re:Any first hand experience? by jo_ham · · Score: 1

      You'll note my use of quotes, and the tone of the entire post being one of sarcasm.

      I do think my Apple gadgets are cool, but not because I paid more for them. I also think many of the other computer gadgets I own are cool, all for different reasons. I even throw a little cool factor at "old faithful" running Win 95 that is hooked up to the very old FTIR machine for those days when all the Bruker ones go on the blink.

      I'm not sure how you managed to infer that I found my gadgets (that I didn't even directly refer to - I was speaking in the first person from the OP's PoV about unnamed third party antagonists) that I found them cool purely because I spent more on them.

    19. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      If you use firefox and no script instead if IE your worries will disappear!

    20. Re:Any first hand experience? by wesleyjconnor · · Score: 1

      What browser are you guys using?
      not trolling, curious

    21. Re:Any first hand experience? by jo_ham · · Score: 1

      Safari 5.0.5, also Chrome 11.0.696.71, although I tend not to GIS on Chrome.

    22. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      Only through someone pointing out a website that had it. Came, saw, deleted the .zip file.

    23. Re:Any first hand experience? by Nemyst · · Score: 1

      NoScript.

    24. Re:Any first hand experience? by Anonymous Coward · · Score: 0
    25. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      It's a good point for curiosity.

      This apparently only affects Safari, with the default setting of Open Safe Files (which I hate, but it's "easy"). It also appears to be spread through hacked ad servers. I haven't even had a popup involving this with Chrome and Adblock.

    26. Re:Any first hand experience? by omfgnosis · · Score: 1

      AFAIK (unless NoScript goes much further than its name suggests), many tactics available to poisoned search results won't be hindered by a script blocker; JS/etc. don't have any more power to initiate a download than a plain HTML webpage (with a meta tag) or an HTTP response header (with Location specified).

    27. Re:Any first hand experience? by omfgnosis · · Score: 1

      "Your worries will disappear" is one of the most worrisome things one can say in a discussion about security.

    28. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      You need to look at more porn, son. It pops up after about, oh, ~5 levels of click-throughs.

    29. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      I've seen every version of it. However, it's been only an annoyance, because I've been locked onto the warning-page, every time. A porn site will release you to continue your surfing, if you ask it to. The only way to get away from the latest version of this trojan, IME, is to download it. You can't even quit. Not out of Chrome, at least. IME, you CAN quit out of Safari. I use the FREE version of Sophos, which has been amped up to the point that it recognizes this trivial bit of malware while it's still zipped and erases it. So, I haven't yet had any experience with Apple's security update, since it doesn't kick in, based on what I've been reading, till after the trojan has been unzipped.

      IMO, the "warning"-page is so un-Mac-like that only a total newbie could be tricked into unzipping and installing the trojan, if only because, if Apple had a way of identifying local malware infections from the Web, I seriously doubt that they would be keeping it secret.

    30. Re:Any first hand experience? by Anonymous Coward · · Score: 0

      To be fair, it sounds like a security vulnerability in how your browser handles images. I mean, you could blame that on Google, but I feel the fault lies elsewhere.

    31. Re:Any first hand experience? by gravis777 · · Score: 1

      I don't think Google Image Search is the culprite, but rather malicious websites that host the images. I use Google Image all the time, and have never once got a piece of malware from it, although I have had my antivirus pop up ONCE when I tried clicking through to a malicious site. Google just needs to take their scanning services or whatever it is they use on their websearches (where you get the warning saying that malware has been found on the site) and apply it to Google Images.

    32. Re:Any first hand experience? by DeadCatX2 · · Score: 1

      I didn't blame it directly on Google, but I do blame it on Google Image Search. A lot of people get infected after using it. Whether or not it's Google's fault is irrelevant to whether it is safe or not.

      (bad car analogy warning) If you drive through the ghetto with your windows down and you get carjacked at a red light, is it the fault of the car's manufacturer? No, it would be the driver's own dumbass fault for going somewhere that isn't safe.

      Sure, the vuln is probably in the browser I was using. Or there was an exploit on the page that I visited. But when someone proficient with computers can't even search for something as innocuous as a connector without getting a drive-by, it's an indication that the service is ripe with exploits.

      --
      :(){ :|:& };:
  5. The rabbit... by ugen · · Score: 2, Insightful

    Tommy: What's coursing?
            Turkish: Hare coursing. They set two lurchers – they're dogs, before you ask – on a hare. And the hare has to outrun the dogs.
            Tommy: So, what if it doesn't?
            Turkish: Well, the big rabbit gets fucked, doesn't it?
            Tommy: [pauses and thinks] Proper fucked?
            Turkish: Yeah, Tommy. Before zee Germans get there.

    It's only downhill from here. Apple got itself a critical mass of un-skilled users sufficient to follow in footsteps of Microsoft. The price of popularity is quite well defined.

    1. Re:The rabbit... by TheLandyman · · Score: 1

      You said 2 minutes 5 minutes ago.

    2. Re:The rabbit... by evil_aaronm · · Score: 1

      It was us what wanted a caravan...

  6. Re:Fanbois...3...2....1.. by Anonymous Coward · · Score: 0

    In the infamous words of Nelson:

    "Haaah Haaah"

  7. FROM: PC users by Anonymous Coward · · Score: 0

    Welcome to our world.

  8. Mac users, start crying from nostalgia by xavdeman · · Score: 0, Flamebait

    Mac OS Update Detects, Kills MacDefender Scareware New MacDefender Defeats Apple Security Update ATTN. Mac fanbois, security through the obscurity of your OS, IS OVER. You're going to be facing the same, if not worse problems than Windows users have been battling for years. Worse, because your userbase expects things to "Just Work(tm)". And Apple has been marketing the impenetrability of their OS through the roof. Virus makers have finally risen to the challenge, and Mac users should cower in fear, for their lazy days are over*. *at least concerning OS security. Of course they will still be lazy college drop-outs and pretentious "hipsters".

    1. Re:Mac users, start crying from nostalgia by jo_ham · · Score: 3, Insightful

      What viruses, as a matter of interest? Or do you mean trojans, which are not the same thing at all - which are an issue for any OS, regardless of security since it's a social engineering issue (less so for Linux I would imagine, since the user base tends to be skewed towards people who can spot a trojan from a mile off).

      It's hardly just "security through obscurity" - you make it sound like OS X was designed like a car with the doors and windows unlocked, when it clearly wasn't. It's not perfect, but it is pretty good, and it does receive regular security updates in anticipation of attacks against it, it's just not until now that we've seen anything widespread, and even then it's been pretty limited - an ineffective trojan that is easy to remove (takes about 3 minutes total, or less) that requires you give it your express permission to install (and your admin password). The new one is modified to be local user only, so doesn't even have root.

      It's not great, clearly, since any malware targeting your platform is a pain in the ass, but you're painting it like OS X has been sitting here doing nothing for the 10 years it's been around and only escaped by standing behind Windows - the legions of security updates and software policy on the OS itself would beg to differ.

      Not that even the very best and most secure OS could stop this malware (having never "seen" it before), since it's entirely a social engineering security bypass. The conman tricked his way past your security guards and is stealing your TV.

    2. Re:Mac users, start crying from nostalgia by jimicus · · Score: 3, Insightful

      We know it's not a virus. But whether you like it or not, the word has become a generic term meaning "malware" to the layman.

      Traditional, self-replicating, can-spread-through-no-other-means file-infector viruses on Windows are not particularly common these days. They exist, and there's generally one or two in the "top 10 things to watch for" at any given point in time but pure viruses don't represent the majority of malware and haven't done in some time. Typically, you'll find they also act as trojans and worms.

      This doesn't stop such things causing harm.

    3. Re:Mac users, start crying from nostalgia by Skuld-Chan · · Score: 1

      I too remember when removing malware on the PC was as simple as going into Add/Remove Programs and clicking uninstall...

    4. Re:Mac users, start crying from nostalgia by jo_ham · · Score: 2

      Ah, so it's ok to be fast and loose with the definitions and so on as long as it makes Apple look bad (vulnerability to viruses and worms is a considerably different kettle of fish to being vulnerable to trojans), but when it comes to Android malware, there's a sudden flood of "it's not that bad" and "it's a trojan, it's not *infecting* apps on the Android Market, how can it do that?!".

      Just checking.

      I'll concede the point if you'll go and post the same "it's ok to muddy it up" response to all those Android folks doing damage control over there.

      Specificity is important, especially where security is concerned.

    5. Re:Mac users, start crying from nostalgia by jo_ham · · Score: 1

      Yes, and I'm hoping we don't much beyond that level due to a different culture regarding malware and a different initial start base that is better set up to deal with security problems. Sort of the way that Win 7 has finally started to get it right - OS X is starting about there regarding account setup/access controls/limitation on root user/no need to run as admin etc etc.

    6. Re:Mac users, start crying from nostalgia by MartinSchou · · Score: 1

      We know it's not a virus. But whether you like it or not, the word has become a generic term meaning "malware" to the layman.

      And the fact that those in the know have given up correcting people when they're wrong is why people go nuts and demand penicillin and other anti-bacterial aids in the flu season.

      People think computer viruses spread through no fault of their own, so they can't possibly get a virus by opening this love letter from a porn star.

      When it comes to computer security we, as a society, are at a level where no one has realized that shitting up stream from our drinking water supply is a bad idea.

    7. Re:Mac users, start crying from nostalgia by jimicus · · Score: 1

      Getting pedantic about terminology won't help - that particular horse bolted many years ago.

      I would argue that teaching people won't either - ILOVEYOU was eleven years ago and it was all over the news at the time. Today's 25 year olds were 14 when it came out - they can't claim that "viruses never did stuff like that when I was growing up".

      Known-bad malware detection is a bad idea. It was broadly workable fifteen years ago when everything spread by floppy disk, but it hasn't been suitable ever since the Internet became ubiquitous. You want a half-decent solution to malware that actually works, I fear it looks rather like Trusted Computing.

  9. Re:Mac Defender by Anonymous Coward · · Score: 0, Informative

    Hey retard, Mac Defender is the name of the malware, not Apple's counter to it, which I don't think has a name.

  10. This just in... by girlintraining · · Score: 3, Insightful

    Once an operating system reaches a certain percentage of the market share, it becomes a viable platform for malware. In other news, I have been using computers since the 286 days and I have yet to get a virus of any kind on any of my personal machines. Why? Because I'm careful. Malware only exists because people aren't careful. No operating system can prevent people from doing something dumb, so stop ragging on Apple (or Microsoft, or IBM, or whoever else you want to crucify) -- this is a problem with people, not software. Always has been.

    --
    #fuckbeta #iamslashdot #dicemustdie
    1. Re:This just in... by calmofthestorm · · Score: 5, Insightful

      Visiting a website shouldn't be able to install malware on my computer. Neither should opening an email, Flash applet, Java applet, Word document, etc. These are all the faults of the relevant vendors.

      Installing random unsigned binaries from the internet? That should be able to do absolutely anything -- it needs to be able to for computers to be general purpose tools. And that includes malware.

      TL;DR social engineering is the user's fault, but sec vulns do exist and are not.

      --
      93rd rule of Slashdot: No matter how obvious my sarcasm is, my comment will be taken seriously by someone.
    2. Re:This just in... by ugen · · Score: 0

      mod parent up

    3. Re:This just in... by Kenja · · Score: 1

      There is also a threshold where a significant number of users are willing to type in their password whenever a pop-up dialog asks.

      --

      "Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
    4. Re:This just in... by david_thornley · · Score: 3, Insightful

      Right, people have been careless enough to go to a thoroughly reputable site that sells ads. People have even been so careless as to open email from frequent correspondents. (Both of those bit my wife, who's far from being ignorant or careless.)

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
    5. Re:This just in... by boristdog · · Score: 1

      I have been using computers since the 286 days and I have yet to get a virus of any kind on any of my personal machines

      Obviously you don't surf the web while drunk.

      Not that I ever...uh...er...

    6. Re:This just in... by gman003 · · Score: 1

      Maybe, maybe not. I'm definitely careful, and common sense is always the best first line of defense, but malware still gets through sometimes. Last virus to hurt me would've done the same no matter how careful I'd been. A normally-safe and trustworthy site got hacked (smbc-comics.com, for the record), put a malicious Java applet into the page. I happened to visit in the few hours before the site manager was alerted and fixed the problem. Virus broke through whatever security Firefox and Java (both fully updated at the time) had, and basically hosed my system with scareware and adware. Spent a whole weekend fixing it.

      And there are, actually, some rare bits of malware that don't require human interaction at all. Worms quite often exploit software thoroughly enough to infect unattended servers. Although quite uncommon nowadays, since exploiting users is far easier than exploiting software, it's still completely possible.

    7. Re:This just in... by Anubis+IV · · Score: 1

      Absolutely true, and I couldn't agree more. Remind me again how any of that applies here? None of those things you talk about have anything to do with this particular piece of malware. This malware doesn't install itself, no security vulnerabilities (aside from the user) are at play here, and Apple has responded by adding a daily auto-updating definitions file which will allow them to respond to these new variants in a timely manner without any further inconvenience to the user.

      So...remind me again?

    8. Re:This just in... by cpu6502 · · Score: 1

      >>>I have yet to get a virus of any kind on any of my personal machines

      I don't believe you. Even back in the 68000 days, Boot Sector viruses existed. All you needed to do was copy a floppy from a friend and insert it into your drive. I got my first one in 1988 on my Commodore Amiga.

      And today it's even easier, since javascripts often download payloads via advertising. You probably have a virus right now, and don't even realize it. Try running AdAware or Spybot. I'm sure they'll find at least one malicious program on your machine.

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    9. Re:This just in... by 0123456 · · Score: 1

      Last virus to hurt me would've done the same no matter how careful I'd been. A normally-safe and trustworthy site got hacked (smbc-comics.com, for the record), put a malicious Java applet into the page.

      You run Java? In your web browser? And you're surprised your machine gets remotely pwned?

      I thought everyone who cared about security deleted the Java and PDF plugins from their web browser years ago.

    10. Re:This just in... by Alarash · · Score: 1

      You know what they say. "There's no patch for stupidity" and "The problem most often lies between the chair and the computer." As long as humans will be humans, FUD will work, sex will work and "your children aren't safe" will work.

    11. Re:This just in... by Dunbal · · Score: 1

      Hah, my first virus was given to me on a legitimate shrink wrapped copy of some Borland software. Object-Vision I think it was. This was way back in 1990 or so, when viruses were still fairly new.

      --
      Seven puppies were harmed during the making of this post.
    12. Re:This just in... by Anonymous Coward · · Score: 0

      >>TL;DR social engineering is the user's fault, but sec vulns do exist and are not.

      Could you just write in proper English and complete your sentences? Jesus fucking christ.

      "Or in short, social engineering is the user's fault, but security vulnerabilities do exist and are not [the user's fault].

      How fucking hard was that?

    13. Re:This just in... by StikyPad · · Score: 2

      I have been using computers since the 286 days and I have yet to get a virus of any kind.

      The only people I ever hear say something like that are people who don't install AV software and thus have no idea they're infected. They rely on the fact that their computer works to tell them that everything's honky dory. Not saying you're one of those people, but if you're not, you're the first, and I'd say your success is more attributable to luck than skill, like avoiding STDs by only having sex with people who appear to be upstanding citizens.

    14. Re:This just in... by Anonymous Coward · · Score: 0

      There are certainly a class of infections that require operator assistance to infect one's computer. There are also a large number of exploits out there that do *not* require operator assistance because they exploit a vulnerability in some piece of software running on the computer. So irrespective of how "careful" one is, the second class of attack will infect your system if you are unlucky enough to run into it. So the claim that malware only exists because people are careless is clearly false.

      Even for those attacks that require operator assistance, in many cases the malware exploits the fact that for 90+% of the population computers are 'magic'. The computers routinely pop up errors, warnings and messages that mean *nothing* to the typical user, but *require* them to take a action to make progress. Such an environment is easily exploited by attacks that trick users into letting the infection in.

      I do agree that the mindless bashing of Microsoft vs Macintosh vs Linux is pointless. Microsoft has been, and continues to be, the 500 pound gorilla in terms of a desktop system for general users and as such receives much more attention from the criminal elements of our society. What we are seeing now is that Macs have gained sufficient market share to become worthwhile attacking and that Macs, as with *any* complex system engineered by large teams of people, has security holes. Not only that, but there is a fundamental tension between "ease of use" for a desktop platform vs "security". For example, the need to install/update software causes most Windows users to do their day-to-day work as 'Administrator' (the moral equivalent of running Linux as 'root'). The reason is that most users consider it to be too cumbersome to switch users when they want to apply updates or install software. Anyone who has ever worked in a high security environment knows that they are not particularly user-friendly. Linux has root exploits as well, but typically one does not hear as much about them because Linux systems are predominately server systems that run inside corporate networks and are administered by people with IT training. I have no doubt that should Linux become a prevalent desktop O/S that we would start to see all the same sorts of exploits targeted against not only its security holes, but also against 'ease of use' features.

    15. Re:This just in... by rAiNsT0rm · · Score: 1

      Sorry, but I have to call shenanigans. I also have been a longtime power user and system designer since the 8086 and I have had a number of viruses in that time. A number of them were unavoidable since there were no OS or antivirus defs when they hit and required no action on the user side (careful or not). Also, Google Image search is a major source of malware/attacks currently, again with no warning or real interaction on the user side.

      I don't care how careful you or anyone is, if you use a Windows OS and you use the computer for any real or varied tasks daily, you have had a virus or malware infection. Shit, there have been viruses in boxed legit software...

      --
      http://teasphere.wordpress.com - A little spot of tea
    16. Re:This just in... by Arkham · · Score: 1

      The only people I ever hear say something like that are people who don't install AV software and thus have no idea they're infected. They rely on the fact that their computer works to tell them that everything's honky dory. Not saying you're one of those people, but if you're not, you're the first, and I'd say your success is more attributable to luck than skill, like avoiding STDs by only having sex with people who appear to be upstanding citizens.

      Either that or you avoid Windows. I had a virus on an old Mac IIsi running System 6, but I've never had one since. I've never gotten viruses on Linux or MacOS X, and it's not because I'm oblivious to the threats. It's because I made a conscious decision to avoid an insecure platform.

      --
      - Vincit qui patitur.
    17. Re:This just in... by StikyPad · · Score: 1

      Using computers since "the 286 days" and not running DOS/Windows at some point is a statistical impossibility.

    18. Re:This just in... by elPetak · · Score: 1

      I got virus on DOS and Linux (yes, linux), but never on windows because I use a good antivirus and I'm carefull, but I've seen tons of peopler using free and popular antiviruses like AVG getting infected.
      Having said that, prolly the only reason I never got a virus in a Mac is because I never had one.

    19. Re:This just in... by KagakuNinja · · Score: 1

      OK, I've been using computers since the days of teletypes, and I've yet to get any virus, even on Windows. I used to run Norton AV on my old Windows machines, for about 10 years. Eventually I noticed it was doing nothing, except wasting CPU and harassing me about buying updated virus protection plans.

      I suppose the time at work in the '90s when we got hit by a outlook macro virus might have counted, although I don't think I fell for whatever it wanted me to do. I also had a pirated copy of a game that tested positive for a virus on my Amiga, but I don't think my computer got infected.

    20. Re:This just in... by RyuuzakiTetsuya · · Score: 1

      That's the common wisdom, but how does the truth bear out? What's the precedence?

      --
      Non impediti ratione cogitationus.
    21. Re:This just in... by shutdown+-p+now · · Score: 1

      Once an operating system reaches a certain percentage of the market share, it becomes a viable platform for malware.

      True, but OS X is still not quite there yet (as evident from the fact that all the recent fuss has been about one single trojan).

      So no, it's not 100% safe, but for an archetypal clueless casual user it is still statistically safer than Windows by a fairly big margin.

    22. Re:This just in... by Bacon+Bits · · Score: 1

      I tend to agree. I've been using computers since the 8086 days, and I haven't suffered damage from a virus, per se (when I was naive I didn't use computers for serious work), but I have run them before (generally my AV client caught them). I've also had my AV client catch a virus in an archive I've downloaded, gotten mysterious attachments on emails which my AV client has sometimes deleted, and back in the late 90's I got spyware/malware which installed as part of other software I downloaded which resulted in me learning about Ad-aware and malware in general.

      I don't know everything about computers. Nobody does, anymore. I've made my share of mistakes through the years when I was more trusting and less knowledgeable.

      --
      The road to tyranny has always been paved with claims of necessity.
    23. Re:This just in... by strikethree · · Score: 1

      The ultimate problem is that you are never allowed control by the programs that you use. The software is not designed FOR you, it is designed to be used BY you. The software is designed with purposes other than serving you in mind.

      Look at the permissions for your Android based phone. There are very few apps on the market that can be installed without giving them some pretty nasty permissions. Why were the permissions grouped as they were? To ensure a minimal amount of control by you while allowing the greatest amount of control to the developer. So why implement any permissions at all? So that they (Google) can say that they implemented a permissions system, it is not their fault you gave the app permissions it did not need. Very slick using grouping like that.

      Look at the plugins permissions on IE 9 or Safari. They are set to push you to just "allow all" if you try to control it. The endless nagging to run flash player can not be stopped unless you never want to use flash player anywhere. To see how it SHOULD be done, look at the noscript plugin for Firefox.

      We are not in control of our software. Virus writers take advantage of that lack of control. This will never end because we will never have control over our software. Whoever creates (which is not usually the programmer for commercial software) the software will always be the one in control. It is not human nature to ever relinquish control.

      --
      "Someone needs to talk to the tree of liberty about its ghoulish drinking problem." by ohnocitizen
    24. Re:This just in... by gravis777 · · Score: 1

      I agree. I bit someone's head off the other day for installing a screensaver from a malicious website. This is exactly the same website they went to before and installed a screensaver and I had to charge them to remove all the viruses and crap that came with it. And I TOLD them exactly what it was they downloaded that caused them to get the virus. Worst yet, not only did they go back and do exactly the same thing all over again just a couple of weeks after getting the computer back, this time they had to click through the UAC prompts and the antivirus screens to get it to install. Grrr!!! Well, I guess I will charge them again to remove the virus. Stupid people are really how IT workers make their livings.

    25. Re:This just in... by heathen_01 · · Score: 1

      As this will always be the case perhaps the problem lies with the pop-up dialog.

    26. Re:This just in... by zieroh · · Score: 1

      I have been using computers since the 286 days and I have yet to get a virus of any kind on any of my personal machines. Why? Because I'm careful. Malware only exists because people aren't careful. No operating system can prevent people from doing something dumb, so stop ragging on Apple (or Microsoft, or IBM, or whoever else you want to crucify) -- this is a problem with people, not software. Always has been.

      I've been using computers for a lot longer than that, and I can say with certainty that you're full of shit. An operating system should not be vulnerable to infection through simple everyday tasks like surfing the web. Period.

      --
      People who say "sheeple" have about as much sophistication as an AOL user, and in fact are probably actually AOL users.
  11. Yeah, but .. by n5vb · · Score: 5, Insightful

    .. have they figured out how to install it without asking an admin user for permission?

    Until that happens, it's not really a security issue, it's still a social engineering hack. And no platform is immune to social engineering hacks because there are always end users dumb enough to unlock the front door for whatever puts on a good show and let it walk right in and take over.

    If someone figures out a way to bypass Installer and run unsigned code without at least throwing a warning, then I'll worry ..

    1. Re:Yeah, but .. by recoiledsnake · · Score: 2

      >If someone figures out a way to bypass Installer and run unsigned code without at least throwing a warning, then I'll worry ..

      All it takes is one Flash, PDF or Java exploit. And God knows those are plenty.

      --
      This space for rent.
    2. Re:Yeah, but .. by dave562 · · Score: 1

      It is inevitable at this point. At the last pwn2own competition, security researchers were able to launch an application and write a file once the user visited a webpage. The article does not say whether or not the file was written to a protected directory or not. They just mention that the browser's sandbox feature was defeated.

      http://www.crunchgear.com/2011/03/09/os-x-and-safari-first-casualty-at-pwn2own-hacking-contest/

    3. Re:Yeah, but .. by elPetak · · Score: 1

      Just think about it for a second... do you remember the "jailbreakme" site that could jailbreak an iPhone by just visiting the site?
      What makes you think there arent holes like that in Mac OS X too ?

    4. Re:Yeah, but .. by Anonymous Coward · · Score: 0

      .. have they figured out how to install it without asking an admin user for permission?

      Yes.

      If someone figures out a way to bypass Installer and run unsigned code without at least throwing a warning, then I'll worry ..

      Better start worrying.

    5. Re:Yeah, but .. by stevusmichaels · · Score: 1

      .. have they figured out how to install it without asking an admin user for permission?

      From the second article: "Bott tested Mdinstall.pkg on a Mac running Safari, and the malware installed itself without a password." It seems you don't need a password for at least one of the new variants, although you still get the "This is from the internet, do you trust it?" warning.

    6. Re:Yeah, but .. by gravis777 · · Score: 1

      Maybe part of the issue is that many mac users blindly install stuff because they have been told that Macs can't get viruses. So they haven't got it ingrained in their minds yet like Windows users (well, not all windows users - Stupid Windows users are how I make my living) that their are malicious programs out there. I am sure the thought process goes, "What, I got a virus? I thought Macs can't get viruses. Let me click this screen to remove the virus. Wait a second! Uh oh!"

  12. Re:Mac Defender by NoNonAlphaCharsHere · · Score: 1

    Marketing Speak: there's no genuine advantage in it.

  13. Apple has to step up their game. by CaptainPatent · · Score: 2

    Malware is a numbers game. Windows used to be the main player by a much larger margin and criminals knew that code over a poor or rare windows exploit generally infected far more computers than even some of the worst mac exploits.

    As Mac OS gains more and more users (and similarly any other platform like IOS, Android, and *gasp* Linux) they become more and more vulnerable because rarer and rarer exploits still result in powerful botnets.

    Apple has never been "virus proof," they just never had the numbers to make a lot of exploits worth the coding time.

    --
    Well, back to rejecting software patent applications.
    1. Re:Apple has to step up their game. by Vokkyt · · Score: 2

      Did Apple kind of shoot themselves in the foot with their "No Viruses/Malware" campaign? Yeah. (Nevermind that they never actually claimed you couldn't be infected...)

      Is MacDefender a portend of Malware waves upon OS X? Unlikely, and it really has nothing to do with market share. I know this is a tired argument, but the "You're day is coming OS X, just wait until you're worthwhile to hack!" idea just hasn't played out no matter how many times security researchers shout it from their blogs/websites (often times alongside links to purchase Macintosh AV software).

      A sense of reality is necessary here -- this isn't like Vundo or any of its variants. This Rogue AV is awfully polite and asks you to go through the standard OS X install process in order to get on the system. (Strange how Mr. Bott makes it seem like the program is just suddenly installed and active)

      http://www.youtube.com/watch?v=WoogO_f6DLI&feature=player_embedded

      That's what you get to see when this RogueAV tries to get on the system. There's nothing automatic about it, there is tons of user input, and that's precisely why it's not much to get worried about as a Mac user. That's a helluva lot more work than simply viewing a flash ad, a PDF, or any other drive-by exploit that occurs on the Windows side of the world.

      Now, I cannot stress enough that I'm not suggesting OS X is immune. But to say it's about to have the same level of infections as Windows? Not now, and not until the Malware folk come up with some grand exploit to get their software onto OS X as quickly as they can through Windows. It's not numbers, it's that it's a pain to do.

    2. Re:Apple has to step up their game. by mario_grgic · · Score: 1, Insightful

      To be sure this is not a virus. It requires full user cooperation to get installed on the machine, user has to explicitly download it and run it.

      --
      As the island of our knowledge grows, so does the shore of our ignorance.
    3. Re:Apple has to step up their game. by CaptainPatent · · Score: 3, Insightful

      Is MacDefender a portend of Malware waves upon OS X? Unlikely, and it really has nothing to do with market share. I know this is a tired argument, but the "You're day is coming OS X, just wait until you're worthwhile to hack!" idea just hasn't played out no matter how many times security researchers shout it from their blogs/websites (often times alongside links to purchase Macintosh AV software).

      Of course it hasn't played out. Mac OS still only has a little over 7% of the market pinned down. Windows collectively (between XP, Vista and Windows 7) controls over 80% of the market. That means that besides smaller proof-of-concept exploits programed for fun, there is still very limited utility for mac malware in the wild.

      All I'm saying is that getting from 2% to 8% market share will be much easier than getting from 8% to 32% and now that they're getting to almost an 8% market share, the first signs of malware are popping up.

      I'd also like to say that while the 2nd MacDefender is indeed much more of a social engineering hack than anything, the first version did exploit a major bug which allowed root access without any additional permissions. Mac vulnerabilities are out there - and that one was a huge one so it was exploited, but look at the numbers - right now to get similar processing power or informational exploit pools, you'd have to have a hack that's literally 10 times as rampant on Mac than on PC.

      It is and always will be a numbers game.

      --
      Well, back to rejecting software patent applications.
    4. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      Their system like other Linux and Unix variants are more resilient to to malware based on design, yes I agree they need to do some focus on security now. But do not be blind and listen to the rumors it all about market share. IOS still has huge market share in smart phones and has had less security issues than Android. It is based on the Developer and Apple has a track record of making a more solid system even back in "the old days" with OS 9 etc. I am not happy about whats going on wither but if you are to have an opinion have all the facts as well.

    5. Re:Apple has to step up their game. by makomk · · Score: 1

      That's what you get to see when this RogueAV tries to get on the system. There's nothing automatic about it, there is tons of user input, and that's precisely why it's not much to get worried about as a Mac user.

      Just two clicks required to install malicious software after you've visited a hijacked site, with none of the usual warnings about downloading software from the internet that most platforms have added - with good reason, I might add? That's definitely a problem. Sure, no matter what you do there'll always be someone daft enough to jump through the hoops required to do something nasty, but making it that easy for websites to convince users to install software - and giving them that much control over the messages displayed - is just unwise.

    6. Re:Apple has to step up their game. by CaptainPatent · · Score: 1

      While it is still a virus - I get what you're saying and the later version of MacDefender is only a social engineering exploit (Trojan) and not something that takes advantage of a legitimate exploit.

      While that may be true, the original MacDefender did take advantage of a nasty root vulnerability that Mac OS had.

      Even with that being said, Trojans are still a class of virus which will also become more popular as the market share increases. Trojans are just a phishing attack with code to allow access to the infected computer in some way. It's a class of malware that the computer savvy like most of Slashdot can avoid, but not a lot of people who expect their computer to "just work."

      --
      Well, back to rejecting software patent applications.
    7. Re:Apple has to step up their game. by CaptainPatent · · Score: 1

      I guess the "step up their game" comment was more in response to Apple's denial that MacDefender even existed for almost a month instead of dealing with the problem. The nature of Apple (closed market) does make it harder for malware to exist in the system, but outright denial of the problem for so long and then an admission of a known security flaw is just inexcusable.

      If Apple can't adapt to the problems increased market share will bring, they'll have some major problems getting to the top of the OS market.

      --
      Well, back to rejecting software patent applications.
    8. Re:Apple has to step up their game. by 0123456 · · Score: 3, Insightful

      All I'm saying is that getting from 2% to 8% market share will be much easier than getting from 8% to 32% and now that they're getting to almost an 8% market share, the first signs of malware are popping up.

      But by this defintiion of malware, Unix had malware when it had a 0.001% market share.

      echo 'Hey, dude, forward this email to everyone you know, then type sudo rm -rf /' | mail bozo@idiotsrus.com

      By the definition being used here, that's not just unix malware, it's a unix virus. Yet no-one in their right mind would be worried about it.

    9. Re:Apple has to step up their game. by uglyduckling · · Score: 2

      Thank you. Calling this "malware" is like calling the video of a dog I just shot on my smartphone a feature film. It's a program that asks to be downloaded and installed, then does something different than the user expected. On top of that, a few websites have been designed to make it more likely that the user will download the program. It's essentially the same as those "pages to like" on Facebook that lure people in with a semi-naked picture then post crap all over their profiles. A tax on stupidity collected by the Geek Squad / Genius Bar techs who will fix people boxes when they get 'infected'.

    10. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      While that may be true, the original MacDefender did take advantage of a nasty root vulnerability that Mac OS had.

      [Citation needed] None of the descriptions of any of the variants of MacDefender that I have read have made this claim. I call BS.

      While it is still a virus

      It is not.

      Trojans are still a class of virus

      No they are not. Trojans and viruses are two different classes of malware.

    11. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      ...you'd have to have a hack that's literally 10 times as rampant on Mac than on Windows.

      There, fixed that for you.

    12. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      "Calling this "malware" is like calling the video of a dog I just shot on my smartphone a feature film"

      You sick fuck.

    13. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      Are there any exploits like that for Windows 7? I haven't seen any. There were definately for XP, but I'm not aware of any in the wild right now for 7. Please correct me if I'm wrong. I'm just hearing a lot of generalizations with little supporting facts.

    14. Re:Apple has to step up their game. by LordLimecat · · Score: 1

      But to say it's about to have the same level of infections as Windows?

      Lets look at this year's Pwn2Own. Oh look, Safari and OSX hacked with the ability to run arbitrary code off of a website (which could include fetching a shellscript and running it). What about previous years?

      Really, where the heck do you mac users get this sense of assurance from? For years, people have been telling you that the platform is no protection from 3rd party security vulnerabilities (java, acrobat, flash); and for years we've been saying that no platform is bug free; and for years we've watched as Mac after Mac falls in Pwn2Own to exploits which "just work".

      We've also been saying that "once Mac gets a big enough market share, malware vendors will set their sights on Apple". And guess what, its starting now. Why are you so sure that they wont start using those no-click exploits commercially? And the real question of the day, what security features are you so confident in from OSX that you think Windows 7 and Vista dont have?

    15. Re:Apple has to step up their game. by shutdown+-p+now · · Score: 1

      Calling this "malware" is like calling the video of a dog I just shot on my smartphone a feature film. I

      Calling it malware is calling it what it is - a malicious application. Malware is an umbrella term; are you, per chance, confusing it with more specific ones such as "virus"?

      It's a program that asks to be downloaded and installed, then does something different than the user expected.

      Yeah, so? That's precisely how 99% of Windows computers get infected. Hence it's a real problem.

    16. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      Thank you. Calling this "malware" is like calling the video of a dog I just shot on my smartphone a feature film. It's a program that asks to be downloaded and installed, then does something different than the user expected.

      Malware means "Malicious Software". Which one of those two words means it isn't downloaded by the user and run intentionally? What it DOES mean is that the function of the program was not the intention of the user...

    17. Re:Apple has to step up their game. by justcauseisjustthat · · Score: 1

      New version of malware is blocked already

    18. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      Why did you even bother posting that? Everyone in this entire thread has been saying that you can't protect from stupid, and that this isn't a bug-abusing variant. Then again, most major malware on Windows aren't bug abusing either.

      Your second paragraph is fairly stupid as well. It *IS* a numbers game. Malware writers these days are in it to make money and not to cause damage. How can they make money? Selling a botnet. Show / redirect to ad-laden pages. etc. All of these need a large number of infected machines to be profitable.

      I mean, if you were looking for a botnet, and some dude comes up to you and says "Yo, I have 50,000 (1% of all) machines -- but they're special, since they have a fruit logo on it!" Would you pick that one, or "Yo, I have 1,000,000 (1% of all) machines"? Similarly, 1,000,000 computers will net you 20 times more money than 50,000.

      Assume it's equally time consuming to create said user-run programs or find said bugs (bug finding is much harder), which one would you target if you were the malware writer?

    19. Re:Apple has to step up their game. by chemosh6969 · · Score: 1

      As long as there's Apple users still in denial that this is an issue, it will continue to be one that will only get worse and worse.

    20. Re:Apple has to step up their game. by Anonymous Coward · · Score: 0

      Thank you. Calling this "malware" is like calling the video of a dog I just shot on my smartphone a feature film. It's a program that asks to be downloaded and installed, then does something different than the user expected

      That's the exact fucking textbook definition of a Trojan.
      Then you go on to describe a classic Phishing scam.

      So we'll be fair about this. We'll apply the same criteria to Windows based malware. Oh, suddenly there isn't anything to be worried about. Either this type of attack vector IS a risk, or it is not... stop playing OS fanboys and wake up. Just because it didn't rape your ass this time doesn't mean it won't the next time.

  14. Not for long... by Anonymous Coward · · Score: 0

    Should only be unprotected for a day at most.

    http://support.apple.com/kb/HT4651

    1. Re:Not for long... by sqlrob · · Score: 1

      At most? Apple had exploited Java vulnerabilities that were patched by Sun for more than a year. What makes you think they can update things in a day, even if the capability is there?

    2. Re:Not for long... by Anonymous Coward · · Score: 0

      Why would they need to worry about Java exploits when nobody uses Java.

    3. Re:Not for long... by PIBM · · Score: 1

      At least 2 millions minecraft users beg to differ!

    4. Re:Not for long... by jo_ham · · Score: 1

      People use Java?

    5. Re:Not for long... by sqlrob · · Score: 1

      Malware pages, sure

  15. tempest in a teapot by spirit_fingers · · Score: 1, Insightful

    As far as the OS is concerned, this is just another application installer. It's a cinch to modify the installer to circumvent Apple's so-called security update for this. It really comes down to a user stupidity issue. If you're too stupid to avoid software from questionable sources you deserve what you get. No security update can protect you from yourself.

    1. Re:tempest in a teapot by Anonymous Coward · · Score: 0

      Not sure if the unwashed, stupid masses you're referring to will feel they deserved it. I wonder how long it will be before the first class action lawsuit for false advertising based on Apple's message that only PCs get viruses.

    2. Re:tempest in a teapot by spirit_fingers · · Score: 0

      This isn't a virus.

    3. Re:tempest in a teapot by Anonymous Coward · · Score: 0

      Which is why Mac OS X is going to be turned into iOS - pretty soon, you'll only be allowed to install signed binaries on Mac OS X. It will resolve the issue of people installing software from "untrusted sources," meaning anyone not paying Apple large sums of money.

    4. Re:tempest in a teapot by Anonymous Coward · · Score: 0

      On the other hand, can we really blame them? After all, apple basically trained them to believe osx couldn't be attacked

    5. Re:tempest in a teapot by Amarantine · · Score: 1

      Which is why Mac OS X is going to be turned into iOS - pretty soon, you'll only be allowed to install signed binaries on Mac OS X. It will resolve the issue of people installing software from "untrusted sources," meaning anyone not paying Apple large sums of money.

      How come everybody thinks this is where OSX is heading, while Microsoft runs a 100% closed source desktop OS with rumours of signed code required in the next version, just about invented the appstore-model for an appliance in the form of the Xbox Live Arcade (for the 1st gen Xbox, before it became the Marketplace)? Yet, nobody seems to worry about Microsoft owning >80% of the desktop market while doing exactly the same things Apple did, only years earlier.

  16. Yeah... by denzacar · · Score: 1, Flamebait

    It should have been something like iProtect, iAntivirus or AppleGuard or something.
    What are they coming to when they can't even get their developers to use the proper naming scheme?

    Just another proof that Apple is no longer a proper computer business but a shiny-pocket-widget and things-for-your-shiny-pocket-widgets shop.
    Or was that a shiny-pocket-widget and things-for-your-shiny-pocket-widgets store?

    --
    Mit der Dummheit kämpfen Götter selbst vergebens
  17. And for years Mac Users have been telling me lies by gubers33 · · Score: 0, Troll

    I always found it amusing that Mac Users consistently told how secure their Macs were and how they couldn't get viruses or malware. I found it amusing since I thought Mac OSs has had security holes in them for years, but no one had an interest attacking a small user base. It seems as though those users and Apple are starting to eat their words since when Linux and Windows release patches for security they aren't defeated an hour later. Apple however should have seen this coming with their growing user numbers.

    --
    Just because you are wrong and I called you out on it doesn't mean I am a Troll.
  18. where by dwightk · · Score: 1

    is it?

    --
    Like anyone can even know that
  19. Seen it three times this month by DesScorp · · Score: 3, Interesting

    Usually while doing a Google image search. I was searching for everything from ships to aircraft, so this doesn't appear to be just a porn/warez problem.

    Still, there's a major difference between this and Windows malware. The "Install me now" routine pops up, but you have to voluntarily enter your username and password for it to infect you on the Mac. You can become infected on Windows just by surfing the wrong website. But I suppose it's only a matter of time before the scumbag malware makers of the world find a way around that.

    --
    Life is hard, and the world is cruel
    1. Re:Seen it three times this month by LordLimecat · · Score: 1

      The "Install me now" routine pops up, but you have to voluntarily enter your username and password for it to infect you on the Mac. You can become infected on Windows just by surfing the wrong website.

      Um, just a few days ago we had a story about how Mac Defender no longer required a password. Userland rootkits are very possible, you know, and a spambot doesnt need admin access to do its thing.

      As for "surfing the wrong website", I thought that was the entire scary part of the first 5 articles on this subject-- that the program can autoinstall depending on safari settings. And on windows, the only way to actually get an auto-installed virus is to have out of date plugins; what Mac security feature prevents that sort of exploit again? Oh thats right, none.

      Regardless, arent Macs usually the first platform nailed in the Pwn2Own competitions, where the requirement is a no-user-interaction exploit? What on earth makes you feel so confident in OSX? Does it even have any tools to remove bootkits (windows has Combofix, GMER, mbrcheck, etc)?

    2. Re:Seen it three times this month by Anonymous Coward · · Score: 0

      It's called UAC, and it's on by default. And when you download an executable it warns you that this came from the internet, do you really want to run it. Short of typing your entire password in (which I gotta say is pretty annoying and ultimately won't stop stupid), it's the same thing.

    3. Re:Seen it three times this month by Anonymous Coward · · Score: 1

      You can become infected on Windows just by surfing the wrong website

      I'll just leave this right here: Safari/MacBook First to Fall at pwn2own.

    4. Re:Seen it three times this month by Xest · · Score: 1

      "You can become infected on Windows just by surfing the wrong website."

      Only if you're running an unpatched machine.

      Just like with Apple devices in fact:

      http://www.computerworld.com/s/article/9197184/Apple_patches_critical_drive_by_Safari_bugs

      The reality is there's no difference between this and Windows Malware, it's already been mentioned in the news that there is a version of this that runs in userland and so doesn't actually need to ask for a username and password, just as there is Windows malware that does the same, and Windows malware that doesn't do the same and so also requires authentication to get away with certain things.

      Apple fans can spin it however they want, this is EXACTLY like Windows malware, this is Apple kit suffering exactly the same things Windows has for a long while. This demonstrably dispels the myth that Apple kit is somehow more secure, but to be fair on both Apple, and Microsoft, it also demonstrates that for both vendors, the biggest security threat nowadays is generally the user.

  20. There is no protection against stupidity. by mario_grgic · · Score: 3, Insightful

    No software can protect the user from themselves. If someone is determined to download something and install it, how do you prevent that short of locking the system like iOS? I really don't want to see that happening to OS X.

    --
    As the island of our knowledge grows, so does the shore of our ignorance.
    1. Re:There is no protection against stupidity. by 0123456 · · Score: 1

      No software can protect the user from themselves.

      An OS which doesn't allow the user to download and install random executable files can. Of course it's also not terribly useful for most users.

    2. Re:There is no protection against stupidity. by MikeBabcock · · Score: 1

      Every time you make the system more idiot proof, they invent a better idiot.

      --
      - Michael T. Babcock (Yes, I blog)
    3. Re:There is no protection against stupidity. by itsdapead · · Score: 1

      An OS which doesn't allow the user to download and install random executable files can.

      Apple have an App for that - its called iOS.

      --
      In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
    4. Re:There is no protection against stupidity. by Anonymous Coward · · Score: 0

      No software can protect the user from themselves.

      Nonsense. It's called designing your software for your target audience. Something that far too many third rate programmers do not do.

      If someone is determined to download something and install it,

      So make sure they are not determined. It's called social engineering and that is something that can be done by both vendors and malware writers.

      how do you prevent that short of locking the system like iOS?

      Write real informative, appropriate, targeted messages informing the real user of the real situation and provide the user with tools to resolve the situation such as a good quality ratings site that tells them whether the software is good or bad. Not the meaningless nonsense that usually passes for a system message these days which is mainly about passing the legal and marketing blame.

      I really don't want to see that happening to OS X.

      Neither do I but if it does happen it will be due to crappy, irresponsible vendors just as much as malware authors. Personally I'd like to see a few lawsuits against vendors as well as malware authors. It's about time they were brought to account.

    5. Re:There is no protection against stupidity. by omz13 · · Score: 1

      You can lock OS X, but this works in conjunction with OS X Server as its more for corporate use

    6. Re:There is no protection against stupidity. by ThatsNotPudding · · Score: 1

      ...how do you prevent that short of locking the system like iOS? I really don't want to see that happening to OS X.

      Prepare to be disappointed. And avoid watching anymore Keynotes.

    7. Re:There is no protection against stupidity. by walternate · · Score: 1

      No software can protect the user from themselves. If someone is determined to download something and install it, how do you prevent that short of locking the system like iOS? I really don't want to see that happening to OS X.

      That is not the only solution (and not a complete one, as users will still be surfing the web leaving an attack surface, like how iOS was drive-by rooted and jailbreaked just by visiting a website). It is actually possible to provide users with a significant degree of "protection from themselves", without locking down the platform.

      You can and should be running a full featured always-on anti-malware and anti-virus scanner. Though not stopping all, that helps significantly in preventing infections. In addition you have tactics like IE9s reputation filter, which was just reported to block 95% of all attempted malware downloads by users (!). Again, not 100%, but significantly contributing to reducing the risk and protecting a very significant number of users "from themselves". So it is possible, and needed, for software to address the PEBKAC. This problem won't go away, expect quite the opposite.

    8. Re:There is no protection against stupidity. by rgviza · · Score: 1

      If you think a developer can't hide malware in an app they submit to the AppStore, well, that's like saying Apple computers can't get malware or viruses.

      --
      Don't kid yourself. It's the size of the regexp AND how you use it that counts.
  21. Obligatory (new) Star Wars reference: by Shadyman · · Score: 1

    Begun the Clone Wars have.

  22. Re:And for years Mac Users have been telling me li by mario_grgic · · Score: 3, Interesting

    It is still amusing to watch idiots proclaim "menacing" malware something first of all that requires you to download it and install it on your computer and second even when you do it does nothing menacing to your system :D.

    OS X still has 0 viruses, which what I care about. If someone wrote a virus for OS X, something that installs without my intervention and approval, then I would be alarmed. Otherwise, I don't care about the social engineering attacks. Idiots will always fall prey to those.

    So yes, I still feel infinitely safer using anything but Windows as far as viruses are concerned.

    --
    As the island of our knowledge grows, so does the shore of our ignorance.
  23. Lion Mac App Store by Anonymous Coward · · Score: 0

    Some rumors about the eminent Lion features that will debut on June 6 include OS-level software installs through the Mac App Store. That would go a long way toward fighting the Trojan attacks on ignorant users.

    The current "Software Update..." mechanism checks for updates at odd and unexpected times. So the legitimate demands to enter password credentials, right now under Snow Leopard, are not predictable. On the other hand, if notifying the user of updates is replaced with those little red badges on the Mac App Store app then the user knows that the request for passwords is done only at their request, rather than at seemingly arbitrary times. And if the Mac App Store mechanism is a protected channel, this will be more secure and predictable to an average (and maybe even below-average) user.

    Apple still needs to turn off the Safari "open safe items after download" (or eliminate the option entirely). And it needs to create a mechanism to create a superuser account by default that users don't login and use by default ("Enter the name of your favorite superhero & a password for your super-user account."). Of course, they also need aggressive security testing and bug-finding stipends for white and grey hat researchers.

    But if this game of cat and mouse gets back under control by Lion then there will still be a perception of being in control of the malware situation on the Mac (whether really true or not).

    1. Re:Lion Mac App Store by cheeks5965 · · Score: 1

      And it needs to create a mechanism to create a superuser account by default that users don't login and use by default ("Enter the name of your favorite superhero & a password for your super-user account.").

      Security success! "my favorite superhero is '1234' and my password is 'password'," said 30 million Americans.

      --
      -- Flame me and I will happily flame you back. Bring it!
  24. Welcome to the real world by Anonymous Coward · · Score: 0

    Just wanted to welcome all the Apple fans to what the people in the real world have been dealing with for years.

    It's nice to have you, you have about 20 years of security knowledge and best practices to catch up on but i'm sure a local Windows user can help in that regard.

    1. Re:Welcome to the real world by uglyduckling · · Score: 1

      Yup, it's going to be really hard "dealing with" not downloading dodgy-sounding security apps from obscure websites, and then ignoring the warnings and just running them anyway. How will I STOP MYSELF!!! Better take the hard drive out of my Mac and just use paper and an abacus instead.

    2. Re:Welcome to the real world by makomk · · Score: 1

      Yup, it's going to be really hard "dealing with" not downloading dodgy-sounding security apps from obscure websites, and then ignoring the warnings and just running them anyway.

      It's actually very hard. That's been the biggest security issue on Windows by far for years, and while Microsoft, Mozilla and Google have taken some fairly impressive steps to deal with it, they've only managed to reduce the problem and not eliminate it.

  25. Re:And for years Mac Users have been telling me li by david_thornley · · Score: 1

    While I'm not real impressed with what I know of Apple's security, this is a relatively small threat that relies entirely on social engineering that works or not regardless of OS, and is getting an immediate and effective response. It's too early to gloat yet.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  26. Alternate department titles.... by mark_anon · · Score: 0

    From the "Infinity Loop +1 department."

  27. Wait by Anonymous Coward · · Score: 0

    I thought Apple's Ads told us that Macs didn't have to worry about viruses and malware... WHOOPS! :D

  28. Re:And for years Mac Users have been telling me li by gubers33 · · Score: 1

    Don't act like it isn't possible it most definitely is possible. But no one has put the time in to write anything before because the user base is so small. As it begins to grow so will the number of exploits, however books are beginning to be put out on exploits in Mac OS and obviously the exploits are starting. I agree that this is completely user stupidity, but it slows that exploits are now being created to target Macs.

    --
    Just because you are wrong and I called you out on it doesn't mean I am a Troll.
  29. IQ test by Anonymous Coward · · Score: 0

    This is just an IQ test. It still requires you to explicitly consent to it being installed! There's nothing that any OS vendor can do to prevent user stupidity. No big deal.

    Turning off "open safe files" makes no difference - it still only LAUNCHES the installer - you must consent.

    Running as a non-admin makes little difference - you can still wipe out your own stuff. Still, I make my relatives run as non-admins, so at least the damage is somewhat contained if they do something stupid.

    1. Re:IQ test by Dunbal · · Score: 1

      You do know that Windows malware requires the user to click on something to install it as well, right? Or are you trying to compare today's Apple OS with Windows 95?

      --
      Seven puppies were harmed during the making of this post.
    2. Re:IQ test by Anonymous Coward · · Score: 0

      I'm not comparing it with anything. I did not mention Windows. My point is that this is not worthy of the attention it is receiving because it requires the user's approval to be installed.

    3. Re:IQ test by Dunbal · · Score: 1

      And my point is that Windows malware is then also not worthy of attention, because it also requires the user's approval to be installed. Which makes your point rather silly, since all malware on any OS now requires explicit permission to install.

      --
      Seven puppies were harmed during the making of this post.
  30. Re:And for years Mac Users have been telling me li by cheeks5965 · · Score: 1

    Why would you gloat? I've been very satisfied by security onn my Mac. If that changed and I got a virus, you would get pleasure from that?

    --
    -- Flame me and I will happily flame you back. Bring it!
  31. iDiots and Appletards lack sense of humor. by denzacar · · Score: 1

    Film at eleve... Sorry... Film at iLeven.

    --
    Mit der Dummheit kämpfen Götter selbst vergebens
  32. my story - a VISTA user with this malware by Anonymous Coward · · Score: 0

    I visited a website that ends with .RU .Every time I click on one of the menu buttons ,to move to the following subject, I notice that I moved to the following page PLUS downoading something.Finally I closed the website.Then suddenly a screen poped-up from nowhere and strated to scan my harddisk. Evertime I try to close it another one pops-up from nowhere to continue to scan. It was like a 3 ring circus. NOW, I realized that I picked up something from the .RU website.OK, I went to TASK MANAGER to kill the process. That did not work. I saw that it installed itslef on the TASK BAR. OK, I deleted whatever was there. That did not work. It installed itself again. OK. I made a quick search online. Some FORUMS advised to go under APPDATA/ROAMING and try to delete whatever was there that belonged to the malware. OK, that was not enough. Something was in the cash of the browser. I found many many small ,around 2 or 3, app 19kb each and I assume that their sole purpose was to call mother ship to download fresh copies of the malware to be installed (I COULD BE WRONG).After deleting all that: the ones under ROMAING + CACHE. I found that they planted themselves in other parts of the TASK BAR. That too was deleted. MY MAIN LINE OF DEFENSE was, and since I am working on VISTA as a USER that has no rights. So, when the MALWARE tried at first to install itslef. MALWARE ASKED FOR ADMIN PASSWORD. Of course that did not happen and I think that what really THWARTED THE MAIN ATTACK. I think the attacker in his design of the malware relies on the fact that most users ,on their own PCs/MACs, are SUPER USERS.
    I guess your right as a user on your machine should be adjusted to just
    A USER WITH NO RIGHTS by default. Then there should be a super user account somewhere. I guess this way we could put a dent in this new wave of malwares

  33. No Way, Thats Impossible by Anonymous Coward · · Score: 0

    Hey wait, I own a Mac, I thought we didn't get Malware and Viruses and stuff? Whats going on here? Whats that you say? Its all hardware and software and we are all exposed to the same risks? No Way! I don't believe that. 10 years ago there were no Malware on my Mac, oh wait, I also couldn't find programs for it then. What about Linux? Is that Virus Free??? Workstations are like cars, even if you get a different brand, its all made out of the same stuff, metal, plastic, motor, hardware and software. Unless you use DeepFreeze or SteadyState you'll eventually get malware. Why are Apple users so surprised by this? Its been going on for years. Welcome to the Internet Age. Defend yourself.

  34. Re:And for years Mac Users have been telling me li by jo_ham · · Score: 1

    People have been saying this for the entire life of OS X, and I say "put up or shut up" - the claims are that it's just not worth it, or that no one cares, but that it's really a ripe, low-hanging fruit that is so vulnerable... yet no one has bothered, in 10 years , to even *try*? Not even to "stick Mac users' noses in it" (with the sort of "HAHAHA!" crowing that we've seen from slashdot users over this simple trojan).

    You're telling me that *no one* in over 10 years has decided to prove this supposed "common wisdom" that OS X is virus free solely due to install base? I simply don;t buy it. The security model it uses, the security updates it receives, and the software base that it is based on would suggest otherwise.

    As far as I know there has been a single proof of concept virus that has never been seen in the wild and has a 24 hour self termination feature, and that the bug it exploits is patched.

    Now, I'm not going to claim any OS is immune, but I would say OS X's track record is pretty damn good.

  35. In Radio Terms, It's 1923 All Over Again by cmholm · · Score: 1

    Whenever my wife entertains herself by gripping about the hassles, the bugs, the constant need to update software, I tell her that she (and most users) aren't really the intended users of personal computers. In radio terms, we're still in the early 1920's, when you had to know something about the technology to get more use than frustration out of the device.

    Thus, why most people continue to click through the warnings and admin authentications, and wonder why the work of a moment takes so much effort to undo. Most aren't yet equipped to deal with it any other way.

    As a primarily MacOS user, it's been nice that the OS X platform wasn't worth designing malware for, while occasionally watching those Javascript, WinXP-themed "virus scanners" attempt to upload a *.exe to my system. But, it looks like the first party crasher is here, and now we wait to see how many friends he brought with him.

    --
    Luke, help me take this mask off ... Just for once, let me butterfly kiss you with my own eyes.
    1. Re:In Radio Terms, It's 1923 All Over Again by Wansu · · Score: 1

      But, it looks like the first party crasher is here, and now we wait to see how many friends he brought with him.

      One such "party" site is drudgereport. On 2 occasions recently, drudgereport pushed that crap to my Mac. I promptly trashed it but that's sleazy of Drudge to do such a thing and I ain't goin' back no time soon.

      --
      Wansu, th' chinese sailor
    2. Re:In Radio Terms, It's 1923 All Over Again by cmholm · · Score: 1

      Much as it pains me to defend Drudge, he doesn't have any more control over the 3rd party ad servers than the NYT does. I have NoScript turning back suspected XSS attempts across the board.

      --
      Luke, help me take this mask off ... Just for once, let me butterfly kiss you with my own eyes.
    3. Re:In Radio Terms, It's 1923 All Over Again by Anonymous Coward · · Score: 0

      I can't really agree with this. A radio is basically a simple device in the end, so it should have been simple to operate. A lot of the details that should have been automated, weren't for various reasons.

      Yet people want stuff that *isn't* simple to *be* simple too. It doesn't make sense. Everything has a minimum complexity level beyond which it can't be reduced.

      For instance, if you have a phone, and multiple friends, then you have to have some way to pick which friend you will call. It can be a number, a name, a photo, whatever, but there *has* to be some way to pick who you're going to call if you want to have a choice of who to call.

      It's the same thing with computers - All of the stuff you can do, and all of the flexibility you have, it raises complexity. For example, I want to be able to write and install programs, but that means needing a compiler and write access. I want to be able to talk to my friends on Skype and Google chat, but that means multiple chat programs, etc., etc. Computers enable people to do a lot of amazing things, but they are powerful tools, which means like any power tool, there are dangers. Some stuff can be made simpler for the average user (i.e. iTunes, Picasa, etc.), but some things have been made as simple as they can, so people need to learn that computers are no different than anything else in like - they need to deal with the remaining complexity if they want the power.

      The problem isn't even that people are that dumb most of the time, they are just incredibly lazy, or they don't stop to *think*. A great example is people who don't read the pop-up dialogs. I swear to god, some of the users at my last company, you could pop up a dialog that says *By clicking ok, your computer will be formatted and you will lose all your work, your family will be killed and your dog raped.", and half the people would just click "ok". There is no excuse for that - none.

    4. Re:In Radio Terms, It's 1923 All Over Again by blackpig · · Score: 1

      But, it looks like the first party crasher is here, and now we wait to see how many friends he brought with him.

      One such "party" site is drudgereport. On 2 occasions recently, drudgereport pushed that crap to my Mac. I promptly trashed it but that's sleazy of Drudge to do such a thing and I ain't goin' back no time soon.

      Through ad servers?
      In my recent experience a lot of this crap comes from there... no matter what platform you use.

  36. Welcome to the real world by Anonymous Coward · · Score: 0

    Hey wait, I own a Mac, I thought we didn't get Malware and Viruses and stuff? Whats going on here? Whats that you say? Its all hardware and software and we are all exposed to the same risks? No Way! I don't believe that. 10 years ago there were no Malware on my Mac, oh wait, I also couldn't find programs for it then. What about Linux? Is that Virus Free??? Workstations are like cars, even if you get a different brand, its all made out of the same stuff, metal, plastic, motor, hardware and software. Unless you use DeepFreeze or SteadyState you'll eventually get malware. Why are Apple users so surprised by this? Its been going on for years. Welcome to the Internet Age. Defend yourself.

  37. Re:And for years Mac Users have been telling me li by Anonymous Coward · · Score: 1

    "but it slows that exploits" - I think you mean shows - and no it does not - this is not an exploit! You have to install it.

    I think most people should have a grandma computer - that is one like an iPad that lives in a walled garden - but general purpose machines and OS must exist so those of us who know better can tinker and develop. But the average user shouldn't have their TV need maintenance if they change to the wrong channel - same with visiting the wrong web site. As far as Windows versus Mac - Mac is light years ahead in this area - still most people shouldn't run Windows, Mac OS X or Linux. They should use an iOS like OS.

  38. Re:And for years Mac Users have been telling me li by Dunbal · · Score: 1

    For the same reason people would slow down to try to see your decapitated corpse on the freeway after a car wreck.

    --
    Seven puppies were harmed during the making of this post.
  39. Re:Fanbois...3...2....1.. by uglyduckling · · Score: 2

    How does it actually prove this? It's a trojan, the user is tricked into downloading it, and has to accept a system dialog that tells them that they are running an untested program downloaded from the Internet. The trojan doesn't do any privilege escalation, and it's trivially easy to remove. There's no way to prevent such programs in any OS other than the 'total lockdown' (e.g. iOS approach). I'll believe that the low market share argument holds when we start seeing genuine worms mass infecting OSX boxes in the wild, requiring no user intervention other than connecting the box to a non-firewalled internet connection, or visiting an apparently innocent webpage.

  40. Re:And for years Mac Users have been telling me li by evil_aaronm · · Score: 1

    Schadenfreude! It's what's for dinner...

  41. Re:Fanbois...3...2....1.. by nurb432 · · Score: 1

    Right, it only proves that stupid people also can use a Mac. Blindly hitting 'ok' and installing 'bad stuff' is not a system problem, its a user education problem. It doesn't matter what OS you are running, if it allows any user installation of applications at all this is a risk..

    But then again, its more fun for some to bash than it is to use logic.

    --
    ---- Booth was a patriot ----
  42. Here's an updated Mac vs. PC ad by Anonymous Coward · · Score: 0

    http://www.youtube.com/watch?v=8wSKVTZ4nOw

    Now featuring mac defender! Truth in advertising?

  43. Vulnerability exists between keyboard and chair by itsdapead · · Score: 1

    but making it that easy for websites to convince users to install software - and giving them that much control over the messages displayed

    Looking at the video: the "convincing" is done with images of OS X dialogs on a web page telling users that they have a virus. Heck, it might as well be an animated GIF. From there on, its the standard package installer with standard messages. The user has to voluntarily click two or three times to confirm that, yes, they want to install this software.

    Adding a few more clicks and a couple of yellow triangles (to bring it in line with internet explorer) might deter some, but by this stage the victim has decided that they want to download and install the software: if they're prepared to click "continue" 2 times, they'll be prepared to click 4 times, and they'll be used to clicking 4 times whenever they've installed software before. Plastering warnings over everything just trains people to ignore warnings (the point of sticking a yellow triangle on something is to cover your ass).

    The only solution to this type of VEBKAC attack is to lock down the computer and not tell the user the admin password or they're just as likely to type it in if they get conned into thinking they need to install something. Obviously, that's not something the vendor of a personal computer can arrange to happen.

    --
    In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
    1. Re:Vulnerability exists between keyboard and chair by makomk · · Score: 1

      Looking at the video: the "convincing" is done with images of OS X dialogs on a web page telling users that they have a virus. Heck, it might as well be an animated GIF. From there on, its the standard package installer with standard messages.

      The standard package installer messages are, unfortunately, rather unhelpful. They tell you that you're installing something from somewhere, but the malware creator gets to control both what it says the program is and where the user thinks it came from. (The author of this malware also hasn't customised the package as much as they could've. In theory they could've changed both the background image and the introduction message displayed on the first page of the installer, but those options are badly documented.)

      The user has to voluntarily click two or three times to confirm that, yes, they want to install this software.

      The problem is - which software and from where? There's a big difference between asking someone if they want to install "Some Misleading Name" and asking them if they want to install something claiming to be "Some Misleading Name" from fishysoundingwebsite.com. Apple seems to have unwisely chosen the former.

      Adding a few more clicks and a couple of yellow triangles (to bring it in line with internet explorer) might deter some, but by this stage the victim has decided that they want to download and install the software

      They can change their mind. Giving them doubts about the origin and authenticity of the software is probably the best way of helping them to do so.

    2. Re:Vulnerability exists between keyboard and chair by itsdapead · · Score: 1

      The problem is - which software and from where? There's a big difference between asking someone if they want to install "Some Misleading Name" and asking them if they want to install something claiming to be "Some Misleading Name" from fishysoundingwebsite.com.

      The problem is that a lot of legitimate downloads get directed to mirror sites or services like DigitalRiver that don't necessarily match the name of the provider, so you're back to the "crying wolf" problem again. The typical user wouldn't be able to spot the significant difference between (e.g.) http://somewords.apple.com/ and http://apple.somewords.com/ anyway.

      Having said that, when you download an .app bundle in a .dmg file, you do get a "this package was downloaded from the internet - do you want to check the website" the first time you run it, so it might make sense to apply the same principle for .pkgs

      Its not as if any of these proposals are right or wrong - its where to draw the balance between not giving enough warning and training people to ignore them. The important thing is you still can't run an .app or install a package without having to click something.

      --
      In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
  44. perhaps by ILongForDarkness · · Score: 1

    Some more work for Seal Team 6. Confirmed black hat or spammer? In your left eye.

  45. Re:And for years Mac Users have been telling me li by Colonel+Korn · · Score: 1

    People have been saying this for the entire life of OS X, and I say "put up or shut up" - the claims are that it's just not worth it, or that no one cares, but that it's really a ripe, low-hanging fruit that is so vulnerable... yet no one has bothered, in 10 years , to even *try*? Not even to "stick Mac users' noses in it" (with the sort of "HAHAHA!" crowing that we've seen from slashdot users over this simple trojan).

    You're telling me that *no one* in over 10 years has decided to prove this supposed "common wisdom" that OS X is virus free solely due to install base? I simply don;t buy it. The security model it uses, the security updates it receives, and the software base that it is based on would suggest otherwise.

    As far as I know there has been a single proof of concept virus that has never been seen in the wild and has a 24 hour self termination feature, and that the bug it exploits is patched.

    Now, I'm not going to claim any OS is immune, but I would say OS X's track record is pretty damn good.

    What is this talk of no one? Every year OSX is shown to be the least secure OS on the planet when it loses the pwn2own competition. It's been objectively demonstrated annually to be the least secure OS and you're still drinking the koolaid? Bravo.

    --
    "I zero-index my hamsters" - Willtor (147206)
  46. You can't patch stupid. by bmo · · Score: 2

    Ever.

    You can educate, but you can only put in just so many policies to prevent stupid before you turn the computer into a brick.

    The only way to stop this is for the user to stop clicking on everything in sight, like dumb Windows users have been doing for the past 15 years.

    Some people simply shouldn't have computers at all, for their own safety.

    --
    BMO

    1. Re:You can't patch stupid. by LordLimecat · · Score: 1

      Some people simply shouldn't have computers at all, for their own safety.

      For years, computer geeks and the media alike have been hollering that everyone needs antivirus, and warning them of the dire dire dangers of not being protected. So now that malware is exploiting that by warning users (as their trusted Antivirus program!) that "we have detected these threats, you better act now", you want to call them stupid for trying to follow all those warnings?

      Really, thats a bit much.

    2. Re:You can't patch stupid. by bmo · · Score: 2

      >For years, computer geeks and the media alike have been hollering that everyone needs antivirus, and warning them of the dire dire dangers of not being protected. So now that malware is exploiting that by warning users (as their trusted Antivirus program!) that "we have detected these threats, you better act now", you want to call them stupid for trying to follow all those warnings?

      WE HAVE ALSO BEEN YELLING AT YOU TO STOP CLICKING ON EVERY STUPID THING ON THE INTERBUTT. STOP PUNCHING THE MONKEY. STOP DOING WAREZ. STOP DOWNLOADING THAT MOVIE.REALLY.NOT.FAKE.THIS.TIME.EXE THAT IS 14KB LONG. STOP INSTALLING PURPLE GORILLAS. STOP DOING STUPID SHIT AND GET SOFTWARE FROM LEGITIMATE SOURCES.

      MAC DEFENDER DOES NOT COME FROM ANY LEGITIMATE SOURCE. IT IS STUMBLED UPON BY USERS AND IT IS IMMEDIATELY TRUSTED BECAUSE IT "LOOKS SO REAL." WHY PEOPLE TRUST IT BLOWS MY FUCKING MIND. IT'S LIKE COMING ACROSS A PICKPOCKET ON THE STREET THAT SAYS HE CAN BE YOUR TOUR GUIDE IN AN UNFAMILIAR CITY FOR FREE BECAUSE HE'S WEARING A COAT AND TIE.

      IT SEEMS NO AMOUNT OF CAJOLING AND SHOUTING AND EDUCATING PENETRATES THE THICK SKULLS OF PEOPLE WHO WILL JUMP THROUGH HOOPS AND "CUT AND PASTE THIS INTO YOUR BROWSER BAR AND GET THE NEW FACEBOOK CHAT."

      IF IT'S NOT STUPIDITY, THEN IT'S GREED. GREED IN THINKING THAT YOU CAN GO SOMEWHERE NOT VETTED BY ANYONE YOU HAVE EVEN READ ABOUT AND GET FREE STUFF THAT WILL NOT HARM YOU. IT'S BELIEVING IN THE FREE LUNCH.

      WE HAVE BEEN TELLING YOU THIS FOR YEARS, YET YOU DO NOT LISTEN.

      STOP IT.

      YES, I'M MAD. THIS IS WHY THE ALL CAPS. FUCK YOU FOR IMPLYING THAT I HAVE NOT TRIED ENOUGH IN EDUCATING USERS. GO TO HELL.

      --
      BMO

      Filter error: Don't use so many caps. It's like YELLING

      "Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt explicabo. Nemo enim ipsam voluptatem quia voluptas sit aspernatur aut odit aut fugit, sed quia consequuntur magni dolores eos qui ratione voluptatem sequi nesciunt. Neque porro quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, adipisci velit, sed quia non numquam eius modi tempora incidunt ut labore et dolore magnam aliquam quaerat voluptatem. Ut enim ad minima veniam, quis nostrum exercitationem ullam corporis suscipit laboriosam, nisi ut aliquid ex ea commodi consequatur? Quis autem vel eum iure reprehenderit qui in ea voluptate velit esse quam nihil molestiae consequatur, vel illum qui dolorem eum fugiat quo voluptas nulla pariatur?"

    3. Re:You can't patch stupid. by omz13 · · Score: 1

      If only you could. Many years ago I was sys admin for a small company... first thing I did was chuck out all their old hardware, give the staff new machines, install a server for file sharing... and lock it down... the old machines were full of viruses and the owner got sick of the mess... after I did all this work, within a day one machine was down... over night rebuild to fix it, and the next day it was down again.. the problem: just one user who insisted that she must install some apps from the internet to do her job (which seemed to be surfing the internet all day to plan her forthcoming wedding!). Solution: I locked the machines down so hard and logged all activity to see what was going on. Troublesome user then tried to break into the sever to disable the locks... silly woman didn't realize all this was logged. As the owner wouldn't do anything about this, I soon parted company. Yeah, users, especially those with a little knowledge, they're the worst.

    4. Re:You can't patch stupid. by Anonymous Coward · · Score: 0

      Those 'Dumb users' are the ones that now proudly proclaim "I have a Mac now so I can't get viruses!"

      No wonder the scammers are seeing this as a nice opportunity.

      PS : Stop linking dumb users to a particular platform ; dumb users are dumb whether they are on Mac, Windows, *nix or even on their phone.

  47. Apple is dead! Long Live Apple! by alphatel · · Score: 1

    Welcome to the horror that is the IT administrators' life in Windows. Best of luck to you all.

    --
    When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
  48. Yeah but MICROSOFT SUCKS MAN by Anonymous Coward · · Score: 0

    I hope Apple users become less smug due to this. Sure this is only one of a small handful of security issues, but I feel more are coming. I have to say, computers are complex machines (including the code) - security issues are always going to pop up no matter how good a system is. I'm sure someone will have something to say about my comments, but at the end of the day, there are really bright folks working for companies like Google, Microsoft, Apple, etc and these things will happen to the best of them. The only reason I see this latest issue as 'news worthy' is because how rare this happens on the Apple platform.

  49. Re:And for years Mac Users have been telling me li by jo_ham · · Score: 1

    We're talking viruses and malware here, not the sort of security compromises that happen at pwn2own (although both are clearly important).

    And I challenge "shown to be least secure" when all the headlines are about how it's "first to fall" because either people want to win the Mac (possibly, possibly not) or simply because the schedule puts it up for attack first (the Linux box isn;t even available until the second day).

    There's no "koolaid drinking" here, just examination of the current state of affairs. The ten year track record of OS X and Unix in general is pretty good. Windows' track record is getting better. No OS is immune.

    Bu you just keep Apple bashing, don't let inconvenient facts get in the way of a good rant.

  50. Re:Antitrust ended2-3 weeks ago by TaoPhoenix · · Score: 2

    Then the next story out of Redmond was "Yay. Now we can try to restrict chipmakers to one model of computer maker!"

    --
    My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
  51. Well there's no complete protection by Sycraft-fu · · Score: 1

    But a good virus scanner can help. You train the user "When this pops up and says something is bad, it is, don't try to get around it." When the virus scanner is programmed to scan things as they are downloaded, and before they can execute, it can be fairly effective.

    Not 100%, of course, nothing catches everything, but it can help a lot.

    Proactive defense goes a long way. Block the shit before it can get on the system.

  52. OS/2 user obviously ... by perpenso · · Score: 3, Funny

    Fuck Windows too. This is Slashdot. I have a four digit user ID. What operating system do you think I use, dipshit?

    Given the 90s timeframe and your level of anger I'd say you are obviously a very disappointed OS/2 user. ;-)

    1. Re:OS/2 user obviously ... by Stone2065 · · Score: 1

      Awww... give the guy/gal the benefit of the doubt... OS/2 WARP... :)

      --
      Stone
  53. Re:And for years Mac Users have been telling me li by RyuuzakiTetsuya · · Score: 1

    nmap a Windows machine and nmap a OSX machine, then let's talk. :)

    --
    Non impediti ratione cogitationus.
  54. Re:And for years Mac Users have been telling me li by cheeks5965 · · Score: 1

    you're just a jeliz h8er

    --
    -- Flame me and I will happily flame you back. Bring it!
  55. Re:And for years Mac Users have been telling me li by evil_aaronm · · Score: 1

    Jealous of what - my MBP, my wife's MBP, my son's MBP, my iPad, the two iMacs somewhere in the house and the Mac Cube in storage, waiting for prices to go insane as a collector's item?

  56. MacDefender by Anonymous Coward · · Score: 0

    Media driven nonsense. I spend many hours every single day on my Macbook Pro and have never come across this piece of malware. I also work as a pc/mac troubleshooter and I haven't had a single client come across this problem. I'm not saying it doesn't exist. I am saying that it is way overblown by the media and the solution is unbelievably simple. Others have said it and it's true. Go into safari preferences and de-select "open safe files after downloading". End of risk. I actually have left it checked on, and have not had any exposure to date. I want anyone in the media who is promoting this fear to give us some verifiable, hard data, on the number of infected machines.

  57. Then arm yourself for the upcoming battle by Deathlizard · · Score: 1

    Sophos For Mac Home Edition: (free for home use)
    http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition.aspx

    Haven't used the home version yet, but we use Sophos Endpoint Security on campus here and so far it's been working well on our PC and Macs. We've already seen MacDefender show up on a few student macs and it's cleaned them up so far.

  58. Re:Linux is insecure (ever heard of ANDROID?) by Stupendoussteve · · Score: 1

    You have an interesting definition of rampant.

    I would not call the malware situation on OS X anywhere near rampant. Rampantly reported, maybe.

  59. Just the same as modern Windows by Sits · · Score: 1

    It is no more sensational than what modern (lets say Vista and above) Windows faces and if that's fair game then why not OS X? Apple made a big play about not getting viruses - well this is a step on the path towards viruses so people are going to talk.

    You can point out that it requires user intervention but people are conditioned to click on bouncing icons in the dock and if you ever use 3rd party apps (e.g. Skype) you become conditioned to click past "this program comes from web" dialogs. I can see this being combined with a browser exploit in the future to automate things further.

    These incidents show that malware is not limited to Windows - other non-locked down platforms can face the same issue.

  60. What's that sound? by Khyber · · Score: 1

    Sounds like a billion people with half a brain going 'DUH' to me.

    Man can make it, man can break it. If you think otherwise, you're an idiot.

    --
    Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
    1. Re:What's that sound? by rgviza · · Score: 1

      "Man can make it, man can break it". I've been saying this since 1995, when someone told me their systems and network were bulletproof and couldn't be hacked. The day you stop telling yourself this is the day your career is done if you are even remotely involved in networking or systems security.

      --
      Don't kid yourself. It's the size of the regexp AND how you use it that counts.
  61. It's all a plot, I tell ya.. by cheros · · Score: 1

    to:

    - sell the next version of Windows (that's why the new amount of fiber throughtput is important - otherwise you'd never keep up with patching)
    - sell the *next* version of Mac OSX :-)

    I run both Windows and OSX, and OSX only since about a year. Both are not perfect (nothing is), but if I have to recommend a platform to someone it's going to b OSX. If not for its robustness, then for the fact you can actually get some work done without the interruption-a-minute you have on [NEW ADOBE UPDATE AVAILABLE. INSTALL NOW (reboot required)? (YES/YES)]

    Sigh, Back later..

    --
    Insert .sig here. Send no money now. Owner may sue, contents will settle. Batteries not included.
  62. Grandparent is right by Kamiza+Ikioi · · Score: 1

    Even Apple must abide by the law of pick two out of three In this case, it's secure, easy, and cheap. The Apple Mac and mobile app stores must abide by this as well.

    It doesn't "just works" if its circumvented so soon. To be exact, "it just works... like any other anti-virus." And until Apple charges for it, it must fund the effort completely on its own. The same goes for it's walled garden. That comes at an expense to them. It lowers their offerings, and costs them to monitor everything.

    It is also a case of secure, easy, and private. If it is invisible, automatic, and self-updating, the user loses privacy so long as Apple can reach out and destroy any piece of software on your Mac that it deems bad. After all, if there is no user interaction, it is not asking your permission to do whatever it wants.

    So grandparent is right. Windows has built in malware protection and third party virus and malware protection. And just like windows, it will continually be broken. From my perspective as a Network Administrator, this is exactly like corporate windows. In this case, the sysadmin is Steve Jobs, and he decides what is malware and what is not. Simply by running a Mac, you are under his control, as though Apple were simply leasing the machine to you. In a corporation, it is the company's machine, and they retain total control, even to spy on all activities there. So a move by Apple to make unilateral decisions on equipment you own really means you no longer own it in the traditional sense.

    And while Windows licensing says that MS has many options, how many people remember the uproar about MS shutting down what it deemed were pirated copies of Windows? MS backed away from that very quickly, and changed it's methods (though not its goal). But, that was MS and that was their Windows license. This is Apple, and the application is on software that it DOESN'T legally own. This idea that companies perpetually own devices you "buy" is troubling to me. They have enforced it on iPhone/Pad/Pod. This looks like they are creeping this control to the Mac. No, they let you run outside of any Mac walled garden... so far. But this level of automatic/invisible control can be just as affective in limiting what they think you should or should not be running.

    --
    I8-D
  63. Re:Linux is insecure (ever heard of ANDROID?) by Anonymous Coward · · Score: 0

    Now if only I could use a HOSTS file on my Android phone.

  64. Wait a minute! by ThatsNotPudding · · Score: 1

    Don't Macs fall within seconds of the start of the yearly Pwn to Own contests, merely by browsing to a web page crafted for just such ownage?

  65. Apple by koan · · Score: 1

    I worked for them for years, I started in their phone support area and routinely heard techs tell customers "If you get a Mac you don't have to worry about malware" which is utter bullshit, This is one area Apple can't compete with M$ because they are just getting into the war, it's going to get much worse for Apple and I think with 10.7 and the tie ins with the App store we should see even more exploits cropping up.

    But after all the talking on the phones I have to say, at least for this article, the main difference between Apple and Windows is that Windows users seem battle hardened in comparison to the ignorance of the average Apple user, having worked for PC support and then Apple support I can honestly say most people are stupid about everything much less computers (this is a long story) and Mac users seem particularly stupid,
    Their attitude reminds of people that think the police are here to protect them

    I predict an Apple bubble burst, first Apple's market saturation is deep, too deep, and when Job's croaks in the next 2 to 3 years investor confidence will drop, then there is pricing that is high for what you get and we are still going slow mo into a giant economic depression.

    --
    "If any question why we died, Tell them because our fathers lied."
    1. Re:Apple by divemaster · · Score: 1

      Not utter bullshit - I'll have operated a Mac since in one model or another without AV since the early OS X days. The earlier Macs did have a few - not many virus issues - generally solved with an extension that was freely available.

      I believe the Unix based OS was somewhat more secure in the ME-95-XP days. The bigger benefit was way magnified by relative numbers - i.e. if you work 25% harder to find the chink in Mac armor your payout in infected machines was 1/50th the payback of a Wintel virus or trojan. I would now say the Windows side has at least parity having a lot of MS hardening requiring great expertise to write exploits. That and the ratio being more like 5 to 1 with a more affluent base is definitely changing the game.

      Apples' big advantage, with the smaller threat base and higher margin, they have always been willing to bundle the protection into OS system updates. MS does some of this but requires additional cost subscriptions to AV and Adware tools just to run online. I use a Wintel box too and I can tell you the free variants of AV generally do not work as well. Finally Apple is also working on improving at pawn2own - they came with updates just before the contest but were not allowed to install them the day before (which is fair - a week before would simulate the average time users get the auto updates). I really expect the two browsers that fell on day 1 2011 ( Apple's Safari and MS I.E. ) to make a better showing next year. I've always surfed with Firefox on Mac for just that reason - less popular attack vector made even better with noscript. I've started using Chrome too so I have an alternative depending to what's in the news.

      Apples' big disadvantage is a large majority are open to social engineering as the most they understand in IT Security is doing their updates. What is great is ( after a misstep or two - I fully agree the initial response deserved a beat down... ) they are creating an auto updating monitor for those attacks too - no charge. The top brass at Apple understand they are only as good as the seamless user experience when they charge premium pricing.

      If Apple can continue to save me time and money on AV tools and subscriptions (razor blades) and provide the nicest interface on top of a Unix engine I'm in. Even at a premium. There is no doubt things will get bumpy as most of the world trains their sights on a new target market. Still I have yet to have an issue - cross fingers....

    2. Re:Apple by koan · · Score: 1

      Well yes "utter bullshit" is the correct term, as you yourself pointed out in your very first sentence "The earlier Macs did have a few".
      I didn't go into severity or frequency rates I said that telling a customer "Mac's don't get malware" is absolutely utter bullshit, and it is.
      Windows 7 is more secure out of the box than 10.5 and perhaps 10.6, in addition M$ now gives away antivirus for free, all of my anti malware, rootkit detectors and virus scanners are free, cost me nothing and are simple to maintain.

      If you truly want to be free of AV subscriptions and malware worries as you said you felt with OS X, try using a Linux variant.

      --
      "If any question why we died, Tell them because our fathers lied."
  66. You can use HOSTS files on ANDROID OS Phones by Anonymous Coward · · Score: 0

    Per my subject-line above, & this quote from you:

    "Now if only I could use a HOSTS file on my Android phone." - by Anonymous Coward on Thursday June 02, @08:39AM

    DO THE FOLLOWING (after obtaining a good reputable solid HOSTS file, like mvps' -> http://www.mvps.org/winhelp2002/hosts.htm )

    ---

    1.) Get ahold of the "Android Debugging Bridge" (ADB) & install it

    2.) Mount your system mountpoint as READ + WRITE (as powerful of priveleges as you need is this)

    3.) Using the PULL command, copy the file over from your PC (or even on your ANDROID if its there already) using PULL & overwrite the etc. folder's copy of HOSTS

    ---

    DONE!

    APK

    P.S.=> And, there you are... though I suspect you are trying to "harass & troll me" here, because the AC stalker/troller always does on my ideas on HOSTS files? This time, you're going to "eat your words" & actually GAIN by it though... apk

    1. Re:You can use HOSTS files on ANDROID OS Phones by Anonymous Coward · · Score: 0

      But of course I was trolling you. The only question left is: who am I?

      BTW, kudos to your shrink. Whatever cocktail of drugs he has you on seems to be working MUCH better than whatever you were taking the last time you showed up.

    2. Re:You can use HOSTS files on ANDROID OS Phones by Anonymous Coward · · Score: 0

      You sound like the voice of experience with shrinks troll.

  67. What's Google doing about it? by EvilStein · · Score: 1

    Since nearly all of the reports came from people that were doing Google image searches, I'm wondering what steps Google is taking to help ensure their own results aren't feeding malware directly to end users. Especially since they offer a "Safe Browsing" API - http://code.google.com/apis/safebrowsing/

  68. Evidences of malware on MacOS X & sec. vulns by Anonymous Coward · · Score: 0

    See subject-line, & this quote from yourself:

    "I would not call the malware situation on OS X anywhere near rampant. Rampantly reported, maybe." - by Stupendoussteve (891822) on Wednesday June 01, @10:49PM (#36315642)

    OK Then - Refer to this list of malware related incidents, + security flaws on MacOS X then (over 50++ of them easily & I have more than this IF you would like them as well):

    ---

    MacOS X - Techworld.com - Third worm hits Mac OS X:

    http://www.techworld.com/security/news/index.cfm?NewsID=5429

    MacOS X - Slashdot Apple Story | Apple Quietly Goes After Mac Trojan With Update:

    http://apple.slashdot.org/story/10/06/19/1811203/Apple-Quietly-Goes-After-Mac-Trojan-With-Update

    MacOS X - Slashdot | Worm Threat Forces Apple to Disable Software?:

    http://it.slashdot.org/it/07/08/03/1451217.shtml

    MacOS X - Slashdot | Two Trojans For Mac OS X:

    http://it.slashdot.org/it/08/06/25/0032226.shtml

    MacOS X - Slashdot | Mac OS X Root Escalation Through AppleScript:

    http://it.slashdot.org/article.pl?sid=08/06/18/1919224

    MacOS X - First Rogue Cleaning Tool for Mac - F-Secure Weblog : News from the Lab:

    http://www.f-secure.com/weblog/archives/00001362.html

    MacOS X - Mac malware authors release a new, more dangerous version | ZDNet:

    http://www.zdnet.com/blog/bott/mac-malware-authors-release-a-new-more-dangerous-version/3385

    MacOS X - Mac OS X backdoor Trojan, now in beta? | Naked Security:

    http://nakedsecurity.sophos.com/2011/02/26/mac-os-x-backdoor-trojan-now-in-beta/

    MacOS X - Mac Malware Evolves - No Install Password Required - Slashdot:

    http://it.slashdot.org/story/11/05/26/1355243/Mac-Malware-Evolves---No-Install-Password-Required

    MacOS X - New 'MACDefender' Malware Threat for Mac OS X - Mac Rumors:

    http://www.macrumors.com/2011/05/02/new-macdefender-malware-threat-for-mac-os-x/

    MacOS X - New Backdoor Mac OS X Trojan Surfaces - Slashdot:

    http://slashdot.org/submission/1485038/New-Backdoor-Mac-OS-X-Trojan-Surfaces

    MacOS X - New Mac fake-defenders similar to Windows scareware â The Register:

    http://www.theregister.co.uk/2011/05/20/mac_scareware_win_rogue_similarities/

    MacOS X - OS X Crimeware Kit Emerges MacDEFENDER- Slashdot:

    http://apple.slashdot.org/story/11/05/02/2120203/OS-X-Crimeware-Kit-Emerges

    MacOS X - OSX/Pinhead-B Trojan (OSX_HELLRTS.A, OSX/HellRTS.D) - Sophos security analysis:

    http://www.sophos.com/security/analyses/viruses-and-spyware/osxpinheadb.html

    MacOS X - Fake security software catches out Apple owners:

    htt

  69. Re:And for years Mac Users have been telling me li by cheeks5965 · · Score: 1

    Then why would you gloat if all your computers became susceptible to viruses? You truly are evil, Aaron M.

    --
    -- Flame me and I will happily flame you back. Bring it!
  70. But....! by rgviza · · Score: 1

    "OSX doesn't get malware and viruses" -smug mac user 2009 Linux you are next. Don't get me wrong, I develop on linux systems professionally and am an ios/osx user. I'm a huge UNIX fan, philosophically and operationally, but that is some misguided and shit to say.

    --
    Don't kid yourself. It's the size of the regexp AND how you use it that counts.
  71. Talking of security... by itsdapead · · Score: 1

    Yikes! When did slashdot start automatically turning URLs into lickable clinks? Nooo...

    --
    In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
  72. Re:And for years Mac Users have been telling me li by gubers33 · · Score: 1

    Amusing how my comment starts an interesting debate and points out facts, but it gets a Troll tag they obviously did not notice the sig.

    --
    Just because you are wrong and I called you out on it doesn't mean I am a Troll.
  73. Re:And for years Mac Users have been telling me li by gubers33 · · Score: 1

    You are aware that nmap is a network scanner, meaning it depends on what the user has set up in the firewalls in terms of open ports and what services are running on those ports. Also nmap works off of known exploits, no one will argue that Windows has more exploits written for it than Mac OS X. There are definite holes in both operating systems, but Windows is exploited more because of the usage. In the business world, very few companies have their employees running Macs.

    --
    Just because you are wrong and I called you out on it doesn't mean I am a Troll.
  74. You can't be that dense... by Stone2065 · · Score: 1

    Wow... and it's video chat? I assume you're smart enough to base your "hot" description on SEEING the (hopefully) female tech. If not, YOU must have been one of the morons that kept the 1-900 numbers alive for so long...

    --
    Stone
  75. Re:And for years Mac Users have been telling me li by RyuuzakiTetsuya · · Score: 1

    Yes, and my point is, stuff like Conficker spread not because of browser exploits, but because Windows' implementation of NetBIOS sucks rocks.

    --
    Non impediti ratione cogitationus.