New Targeted Mac OS X Trojan Requires No User Interaction

An anonymous reader writes "Another Mac OS X Trojan has been spotted in the wild; this one exploits Java vulnerabilities just like the Flashback Trojan. Also just like Flashback, this new Trojan requires no user interaction to infect your Apple Mac. Kaspersky refers to it as 'Backdoor.OSX.SabPub.a' while Sophos calls it at 'SX/Sabpab-A.'"

Comments

No user interaction

[Anonymous Coward]

So, what you're saying is, It Just Works?

Re:No user interaction

[firex726]

It Just Gets Infected!

Re:No user interaction

[buchner.johannes]

Isn't a Trojan that requires no user interaction by definition a Virus?

Re:No user interaction

[Mitchell314]

Oh come on slashdot, I'm a mac fan and even I found this funny. No need to mod down.

Re:No user interaction

[Anonymous Coward]

No, because you still have to navigate to a web site. It is a trojan because they need to entice you to do so.

Re:No user interaction

[Anonymous Coward]

No, viruses self-propagate

Re:No user interaction

[ninetyninebottles]

Isn't a Trojan that requires no user interaction by definition a Virus?

Not really.

Trojan - malware posing as legitimate software.

Virus - malware that copies itself either replacing or attaching to legitimate software.

Worm - malware that copies itself from system to system automatically without user interaction.

This software seems to be automatically installed when the user follows a link in their Web browser, but there is no indication that it in any way sends more links to people. So this malware does not fit neatly into any of the common categories. "Virus" seems to be a catch all term these days so you might as well call it that.

Re:No user interaction

[Anonymous Coward]

No, viruses propagate. Worms self-propagate.

Re:No user interaction

[nuckfuts]

If you have to click on a link, that's interaction.

Re:No user interaction

[Altieres Rohr]

The definition of worm is not "malware that copies itself from system to system automatically without user interaction". Worm is self-replicating code that uses a network, by some defintions, and, by others, a worm is any malware that spreads by itself but does not parasite legitimate software (thus why "USB worms").

Although the Morris worm did not require user interaction, this is not true of all future malware that would be considered a worm. Malware that copies itself to network drives, P2P software shared folders, or attaches itself to or sends e-mail, IM or IRC messages are all worms.

As for trojans, any malware that does not replicate is a trojan. Back in the day, and even today, the only way to convince a user to run such software is by advertising it as another piece of software - thus why the trojan horse definition. Exploit code changed that, but they're all still trojans, and most still fallback to advertising themselves as a Flash player plugin or video codec when the exploit doesn't work. In any case, this new malware doesn't replicate, so it is a trojan.

There is no malware category to describe code that requires no user interaction to run. Exploits, worms and viruses and trojans all can do it, but that's not required by their definitions.

Reference: http://www.f-secure.com/en/web/labs_global/threat-types

Re:No user interaction

[ninetyninebottles]

The definition of worm is not "malware that copies itself from system to system automatically without user interaction". Worm is self-replicating code that uses a network, by some defintions, and, by others, a worm is any malware that spreads by itself but does not parasite legitimate software (thus why "USB worms").

I worked in the security industry for many years and never heard anyone call something a "usb worm". If it is copying itself as the result of user interaction, we always called it a virus. If it spread on its own, it was a worm. The definition of "worm" you provide does not seem to differentiate itself from a virus in any way. Something that copies itself via shared disks is almost the classic poster child for a virus. The term originated talking about malware spread on floppies.

Darn you kids and your newfangled definitions!

Re:No user interaction

[Anonymous Coward]

Fair enough. Viruses "self-propagate" within a system, but not between.

Re:No user interaction

[Altieres Rohr]

Mass-mailers requiring user interaction are called worms since forever. But many older worms used some form of exploit code, and Melissa was called a virus because it was actually an Office file infector (a macro virus). It's easy to see the reason for confusion.

Love Letter was already being called a worm without exploiting any flaws back in 2000, though*, so was Sircam in 2001 and Bugbear/Thanatos in 2002. By the time Netsky, Beagle and Mimail were around, it was pretty clear a worm was any malware that replicated itself completely over a network and without the use of a host file. When USB drives became common, the term was used for those as well. Floppy viruses infected the boot sector ("infected" being the keyword); malware that spreads over USB just use the Windows autorun function.

Any malware parasite can infect a program that will end up in a USB drive, in the same way that the Parite virus ended up spreading over e-mail when it infected a copy of Beagle (IIRC). A USB worm specifically looks for connected USB drives and copies itself to them. There's a difference.

* http://www.cert.org/advisories/CA-2000-04.html

Re:No user interaction

[Anonymous Coward]

Whoosh!!!

Re:No user interaction

[Anonymous Coward]

It's perfect for Apple. It's even easier for the user than Windows!

Re:No user interaction

[Anonymous Coward]

Splitting hairs, it would be more a drive-by download than anything else.

Trojan means that an active executable has to be run. A drive-by download is the chief infection vector on Windows due to ad companies doing the wink-wink-nudge-nudge with malware writers, so even legit sites will have users stung by this.

Re:No user interaction

[kefkahax]

Fucking thank you.

Re:No user interaction

[matunos]

Or a worm.

Re:No user interaction

[Anonymous Coward]

well they didn't seem to care about any of that with there ima pc /mac ad's so don't think they get play Symantec now.. or are u using selective memory?

Re:No user interaction

[Kalriath]

Perhaps, but if that link is to "ad.doubleclick.net" or "ad.yieldmanager.net" then no conscious interaction is required, a legitimate site can infect you just as easily.

Re:No user interaction

[mcneely.mike]

JUST LIKE MY MOMMA!!!

wait.... ahh, that came out all wrong.
damn.

Re:No user interaction

[Anonymous Coward]

English, motherfucker?

Re:No user interaction

[utkonos]

"There is no malware category to describe code that requires no user interaction to run."

Really? You must be new. It's called a drive-by download.

Re:No user interaction

[ILongForDarkness]

Despite what marketing classes might tell you that line won't work with your girlfriend.

Re:No user interaction

[ILongForDarkness]

I think the only Trojans that don't require user intervention are those made for teenagers.

Re:No user interaction

[Gr8Apes]

haven't we all blacklisted those ad sites already?

Re:No user interaction

[Altieres Rohr]

First, a drive-by download is not a malware category. It's an attack type. Viruses, trojans, worms can all be spread by a drive-by download, though trojans are the most common these days; spywares were the first to use it heavily, however.

Second, from your own link, drive-by downloads can be "downloads which a person authorized but without understanding the consequences". I remeber the term first being used to describe ActiveX and elevation of Java applets, both which require user interaction. See this, from 2004, using the term in this way:
http://www.benedelman.org/news/112904-1.html

If you check the Wikipedia's page history, you will see it was created with this very definition, too.

In other words, if you call something a "drive-by download" it does not necessarily mean that the user played no part in the attack.

Re:No user interaction

[noodler]

That's a different categorisation than mine:
virus: uses an exploit in an executable to get runtime, reproduces to other files when executed. Cannot execute by itself.
worm: uses an exploit in the OS to get runtime, reproduces directly from OS to OS and can use networks to infect other OSes.
trojan: virus or worm arranging for a backdoor (for human or machine consumption).

But this type of classification is archaic at best.
Today's malwares are much more clever and use any vector/vulnerability to get the job done.
Basicly, there are several stages to a malware.
You get the infection (get runtime), payload (do something, like install a server or drop more malwares) and reproduction (infect others) stages.
Each can be designed with a different goal in mind and sometimes categories collapse.
For instance a worms reproduction can be it's infection if everything can be done over a network and the reproduction can be seen as the payload.
So you get a worm mechanism also infecting files like a virus.
Or a worm used to open a hole (acting as a trojan) for more complex attacks and then goes on to infect other machines.
That's what botnets do.
It's becomming increasingly more difficult to classify computer malwares in these simplistic terms.

Re:No user interaction

[Anonymous Coward]

Cue the hosts file guy in 3.. 2.. 1..

Re:No user interaction

[webnut77]

Darn you kids and your newfangled definitions!

Alas for the time when gay meant happy.

Re:No user interaction

[cusco]

Thanks for the blast from the past. A co-worker looking for some very old documentation ran into Love Letter just last year on a floppy disk her predecessor left. I was kind of surprised that anti-virus software still checks for it.

Re:No user interaction

[CheerfulMacFanboy]

So, what you're saying is, It Just Works?

Unless you have run the recent Java update, then it just won' workt - because it uses the same fixed exploit as Flashback.H.

Re:No user interaction

[CheerfulMacFanboy]

Mass-mailers requiring user interaction are called worms since forever. But many older worms used some form of exploit code, and Melissa was called a virus because it was actually an Office file infector (a macro virus). It's easy to see the reason for confusion.

Love Letter was already being called a worm without exploiting any flaws back in 2000, though*, so was Sircam in 2001 and Bugbear/Thanatos in 2002.

Not quite true IIRC - they all could be activated without further user action when having the auto-preview or preview pane active in Outlook.

Missing from summary

[dr2chase]

from TFA: "if you’ve downloaded and installed the latest software updates from Apple that patch the Java vulnerabilities (or disabled Java), you’re safe" (for now).

But it looks like the good times are over.

Re:Missing from summary

[slashmydots]

I didn't consider mac users lording their "super advanced security and magical virus immunity" as "good times." It's about time someone reminded them that Windows is far more secure, it's just targetted more. This is going to be the beginning of a long line of taking them down a notch.

Re:Missing from summary

[buchner.johannes]

Is that Java security hole that we heard about over the last weeks Mac-specific or cross-platform? Any reason to worry or to have our belief in Java security shattered? Or just a conspiracy of several factors in the Mac environment?

Re:Missing from summary

[Anonymous Coward]

yeh seems mac have now gained the interest of the bad boys, there may come a time when we'll see that the security of windows isn't worse than anything else out there, so far they have just been the only one interesting enough to be fired at from all sides by "millions" of bad guys

Re:Missing from summary

[Anonymous Coward]

I didn't consider mac users lording their "super advanced security and magical virus immunity" as "good times."

But we sure did!

Re:Missing from summary

[pushing-robot]

But it looks like the good times are over.

At least until you remove Java (and preferably Flash and Acrobat Reader), or set plugins to click-to-run, or they finally implement signed apps and sandboxing (which Apple keeps delaying since developers keep screaming about it).

It's ridiculous that all browsers don't require you to approve plugins, at least on a per-site level, but it's true there are still quite a few sites out there that break in strange ways if some hidden java or flash element fails to load. Still, I'd rather live with that than trust my computers' security to Adobe and Oracle.

Re:Missing from summary

[Anonymous Coward]

Any reason to worry or to have our belief in Java security shattered?

Java has security?

Re:Missing from summary

[Anonymous Coward]

At least until you remove Java (and preferably Flash and Acrobat Reader)

Java has always been a joke.

Re:Missing from summary

[errandum]

Well, the general idea is that they were very secure. Not too long ago I was modded into oblivion because I said windows is, by design, more secure that Mac OS. So obviously, I dropped the subject and never posted about it again.

If no one is allowed to talk about it, the general impression will be that they are, indeed, more secure (at least here).

Re:Missing from summary

[Anonymous Coward]

Who ever claimed immunity? The claim that OS X is immune to viruses is just a big fat straw man. It's about as retarded as "I heard your BMW broke down, so what they say about superior German engineering is a lie!".

It takes a special kind of ignorance to go there with any kind of seriousness, an inability to separate fantasy from reality as bad as those you attempt to attack.

It's a far cry from not needing to be concerned about viruses, which has actually held up in comparison to windows for example.

Re:Missing from summary

[Anonymous Coward]

Many BMW owners will freely admit that they break more often and are harder/more expensive to work on. The "German Engineering" isn't about it not breaking, but about how well it works when it does ;)

Re:Missing from summary

[Anonymous Coward]

Blaaaaaah blah blah blah blah blah blah.

Who gives a fucking rancid toss? Windows has malware targeted at it. OSX now has successful malware targeted at it. UNIX used to have malware targeted at it and for all I know still does. Users of each of them should be protecting against malware. Other than that, who fucking cares? They're operating systems. If you're making them your religion you've got a fucking empty life.

Then again, we're posting on Slashdot, so who the fuck am I to talk?

Re:Missing from summary

[Anonymous Coward]

Is that Java security hole that we heard about over the last weeks Mac-specific or cross-platform? Any reason to worry or to have our belief in Java security shattered? Or just a conspiracy of several factors in the Mac environment?

The malware writers could in theory do the same thing to Linux distros. However the openjdk and java on Linux is essentially different in as much as the methods to run and install to a user home directory a downloaded .so the way this malware does cannot happen on Linux distros in as much as the user is the only one on Linux who can direct which binaries run from within a user profile at login.

I know this is a mouthful for those who do not understand but I would highly recommend looking into how exactly this malware works. Here is how the default set-up of OS X can be subverted to install a binary to a hidden user directory without user permission or knowledge. Then download a binary which is really smart that will try to get user permission to install system wide and if it does not receive this permission it just does it to the ill informed Mac user without permission. With Linux the system would not allow a .so to be loaded to a user /home directory and then set it to run at login. This is the problem with Mac security there is also a huge hole in the way binaries can run from within a /home at login without permission!

Here is a run-down of how it works and why it will only work on Mac because its method of infection does not require user interaction to install the payload to a users home directory with Mac OS. However I have the feeling that this security nightmare will be addressed by the Apple coders simply by doing things the way most Linux distros do!

From a CNET article:

How does it work?

The Flashback malware injects code into applications (specifically Web browsers) that will be executed when they run, and which then send screenshots and other personal information to remote servers.

First step: Exploiting Java
When you encounter the malicious Web page containing the malware and have an unpatched version of Java running on your system, it will first execute a small Java applet that when run will break the Java security and write a small installer program to the user's account. The program is named something like .jupdate, .mkeeper, .flserv, .null or .rserv, and the period in front of it makes it appear hidden in the default Finder view.

In addition, the Java applet will write a launcher file named something like "com.java.update.plist", "com.adobe.reader.plist", "com.adobe.flp.plist" or even "null.plist" to the current user's ~/Library/LaunchAgents/ folder, which will continually launch the .jupdate program whenever the user is logged in.

In order to avoid detection, the installer will first look for the presence of some antivirus tools and other utilities that might be present on a power user's system, which according to F-Secure include the following: /Library/Little Snitch /Developer/Applications/Xcode.app/Contents/MacOS/Xcode /Applications/VirusBarrier X6.app /Applications/iAntiVirus/iAntiVirus.app /Applications/avast!.app /Applications/ClamXav.app /Applications/HTTPScoop.app /Applications/Packet Peeper.app

If these tools are found, then the malware deletes itself in an attempt to prevent detection by those who have the means and capability to do so. Many malware programs use this behavior, as was seen in others such as the Tsunami malware bot.

Second step: Downloading the payload
When the jupdate program executes, it will connect to a remote server and download a payload program that is the

Re:Missing from summary

[H0p313ss]

Java has always been a joke.

I would certainly agree that applets have always been a joke:

• Virus magnets/security nightmare
• Rarely worked as designed
• Rarely worked with default configurations
• Rarely worked with the JVM that people had installed

Yes there are exceptions, but I'm yet to see an applet whose customers were deliriously happy about. Usually the exact opposite.

Re:Missing from summary

[dr2chase]

It WAS cross-platform (in theory). Apple was slow to release a patch, everyone else (who was up to the latest rev of Java) is fine, because non-Apple Java had a patch for this before the Trojans were deployed.

Java has a better in-theory story than most things exposed to the web because it is (by design) invulnerable to buffer overruns. In practice, however, it uses native libraries for some important stuff, and those have the buffer overrun problem. I don't know the details of this bug, however. I find the seemingly neverending stream of vulnerabilities in everything to be more than a little depressing.

Re:Missing from summary

[ninetyninebottles]

Is that Java security hole that we heard about over the last weeks Mac-specific or cross-platform? Any reason to worry or to have our belief in Java security shattered?

It was cross platform. Oracle seems to have fixed it in the Windows version of Java quite a while ago, then more recently in the Mac version, although that last point seems to be a matter of contention between Apple and Oracle.

Re:Missing from summary

[Anonymous Coward]

or set plugins to click-to-run

Unfortunately that doesn't help for Java applets due to a webkit limitation.

Re:Missing from summary

[ColdWetDog]

Group hug for the unhappy, disaffected AC!

We love you!

Re:Missing from summary

[Anonymous Coward]

Honestly and without asbestos, are you kidding? I only mean that the typical Mac (or any computer) user is in no way competent to approve plugins. That would change nothing.

It's why they bought a Mac -- they want savvy people making good choices for them.

(Necessary humbling disclaimer -- I run Ubuntu mostly because I can sit back and let Canonical take care of things. I started in 1978 with the PET; I'm not much interested in staying ahead of the gory details anymore. I've got to admit my daily attitude isn't too different from Mac users.)

Re:Missing from summary

[Anonymous Coward]

As of Lion, Macs do not come installed with Java. So its a non issue.

Re:Missing from summary

[Billly Gates]

I have said this before here and will say this again.

For the Tech Support pros reading this
1. Use FoxitPDF or Summutra PDF. They will at least prompt you before blindly opening a PDF from a website and executing it in no sandbox with full javascript unlike Adobe Reader.
2. If you must support Java for corporate users create a GPO that enforces Java in Intranet only! No internet zone java if you must use crappy Kronos or ADP apps. If the users need Java in IE for an external site add it to a special custom security zone.
3. Use Chrome. It has its own PDF reader, does not support Java, and updates flash automatically without user interaction
4. Use Flashblock and keep it for sites like Pandora or youtube if you support home users or need training sessions in youtube for work.
5. Use antivirus software. THey are getting much better and no longer slow your whole computer down so much. Even the latest Norton is as light as MSE which is shocking! If you are one of the smirk users who are proud that you are virus free I have to say your an idiot and infected. How? Last week malware was hosted right here on slasdhot in an ad! If you came to slashdot last weekend or before you are infected. Avast! and MSE are both free and pretty decent and only add a few seconds more of boot time.

Java is not going away and neither is flash nor pdfs. Follow the above steps and you take care of 85% of all security issues unless you run unpatched Windows. I use Java for Eclipse and have Java disabled in all my browsers. Disable it in IE even if you do not use it. Some exploits may call to IE helper ojbects to execute so its a good idea anyway.

If you do IT and do not follow all of these procedures you are lazy and so many are as many get constant support calls for fake virus scans and slow computers through constant infection from running unpatched old versions of flash, java, and Windows. If you must run insecure old java then do it right and disable it from all sites except Kronos and ADP. That is it! Your infects will drop to near zero

Re:Missing from summary

[Anonymous Coward]

20-30 new viruses a day for windows 1 virus for the mac in 10 years shows windows is more secure?

Re:Missing from summary

[nashv]

A lot of things look ridiculous in hindsight. It's all a work in progress, always will be.

Re:Missing from summary

[am 2k]

At least until [...] they finally implement signed apps and sandboxing (which Apple keeps delaying since developers keep screaming about it).

No, sandboxing is there and working fine (actually too fine, that's why the devs keep screaming), it's just not mandatory for apps in the MAS yet. You can enable a sandbox column in the activity monitor to check which apps are already using it.

Re:Missing from summary

[Anonymous Coward]

This is going to be the beginning of a long line of taking them down a notch.

What? really? So just because someone uses a Mac instead of Windows means they somehow think they are superior to you? I'm sure there are some people that use Mac that think they are superior but that doesn't mean that everyone using a Mac thinks that. So how about you get off your high horse and stop condemning people based on what OS they choose. I personally prefer Mac OS to Windows. I grew up on Windows from Windows 3.1 to Windows Vista. For me, Mac OS is far more intuitive and streamlined. When I think of Windows I think of Menus and Folders. When I think of Mac I think of Apps and Documents. But I saw the preview of Windows 8 and it looks like they're really working on fixing that. I may switch back one day. But I don't think Mac is inherently better. Just different. I do think its more secure though. Simply because they're far more locked down in their hardware. Windows is designed to work with almost anything which leaves a lot more room for errors to exploit.

Re:Missing from summary

[wmbetts]

All current versions of OSX are 100% UNIX. It received it's certification in 07 if I remember correctly.

Re:Missing from summary

[wmbetts]

Blah, I should have looked it up before posting. OSX version 10.5 and higher running on Intel processors are UNIX 03 certified.

http://en.wikipedia.org/wiki/Single_UNIX_Specification#OS_X

Re:Missing from summary

[Anonymous Coward]

It's called the beginning of the Bell Curve. There's a sweet spot coming up. A real white knuckle ride.

Re:Missing from summary

[Centurix]

Two ints and a float are in a bar. They spot an attractive double on her own.
The first int walks up to her. “Hey, baby”, he says, “my VM or yours”. She slaps him and he walks back dejected.
The second int walks over. “Hey, cute-stuff, can I lick your Bean?”. After a quick slapping, he too walks back.
The float then ambles over casually. “Were those two primitive types bothering you?”, he remarks.
“Yes. I’m so glad you’re here”, she says. “They just had no Class!”

Borrowed from somewhere else...

Re:Missing from summary

[mario_grgic]

Funny thing is this Java Runtime vulnerability is also present in the Windows version of Java, and it can be exploited just as easily.

Re:Missing from summary

[JDG1980]

Java is not going away and neither is flash nor pdfs.

One of these things is not like the others.

PDFs and Flash objects are an integral part of modern Web browsing. Java is not. If you tried browsing with no Flash plugin or PDF viewer, you'd quickly run across a bunch of sites where you got a severely degraded experience and/or couldn't view the content. But I haven't had a Java plugin installed on my PC for years, and guess how many sites I've run across that need one? Zero. Not a single one. The only reason you need Java in your browser is if you are using one of the poorly-written business sites that still requires it. In that case, it should at least be possible to whitelist Java to only those specific sites. Or you could use IE+Java for only work related websites, and Firefox Portable or Chrome for all your other web browsing.

If you're a home user, there is no reason to ever install Java at all. It's nothing but a needless security risk.

Re:Missing from summary

[jedidiah]

The malware writers could in theory do the same thing to Linux
distros. However the openjdk and java on Linux is essentially
different in as much as the methods to run and install to a user
home directory a downloaded .so the way this malware does
cannot happen on Linux distros in as much as the user is the
only one on Linux who can direct which binaries run from within
a user profile at login.

If you are able to alter the user's files, then you can pretty much do anything you want with their account. The trick is just figuring out how to do so based what ever GUI they happen to be running. For Macs there just happens to be a single approach. There's no reason this approach couldn't be tailored to Linux and sort itself out with GNOME and KDE. If there's a similar autostart mechanism, then the virus can just manipulate that.

At the very least, it could install itself at the end of .login or .bashrc.

Re:Missing from summary

[Atzanteol]

And it was patched much faster by Oracle and pushed out quicker by the Java install because Microsoft doesn't have insane control issues like Apple does.

Re:Missing from summary

[SiMac]

I'm not sure what you're talking about here. If you have access to a user's account, you can set a binary to run when a user logs in on Linux without administrator privileges. You can call gksudo to put up a dialog asking for administrative privileges so you can modify other users' files as well, or just put up the dialog yourself and hope the user enters their password. This is exactly the same level of security as on OS X. If there's a reason this doesn't work on Linux, you have not communicated it.

It's unclear to me where the .so comes in, as opposed to a regular binary, but you are aware that you can set LD_PRELOAD and LD_LIBRARY_PATH to whatever you want, right?

Re:Missing from summary

[Anonymous Coward]

Oh man you're funny. Mac users having always looked down on window users.
Bitch slapping them with viruses, malware, trojans is going to bring them back to earth hopefully. ^_^

Re:Missing from summary

[Billly Gates]

If your a home user Chrome will take care of a lot of that.

Unfortunately, Java is needed at work and some people who run Eclipse as my example also enabled Java in FF and IE without knowing it. I always remember to backtrack to disable it. Java applets are dead yes, but java client software is not. Both Netbeans and Eclipse are good products for those who want a free ide that is not crippled unlike VS express editions that are multiplatform. They are java based as much as I hate Oracle and unfortunately. Worse if you use Andriod or Google apis you will be stuck with Java 6 as they are not Java 7 compatible that is more secure. Oracle needs to give up JavaFX and install java just as a JRE without browser support unless the user wants it.

My other gripe was about corporate users whose IT departments just install java without a GPO to restrict for whitelists. They use Java for old software because businesses still use IE 6 and need flash/java so they do not look like crap. Java should be intranet or whitelist only and I have never seen a single business EVER set it up that way.

  Most IT administrators are lazy or do not know that its insecure to enable it sitewide on all sites. FLash too is bad at work and I wish you could setup IE to use flash for only youtube training videos like you can with Java applets? Flash is problematic as well. IT is too busy to keep track and update all of these plugins so they are almost always waaay out of date.

For Mac users its time to get a good anti virus product. Avast is going beta for it and hopefully will have a free version. Adobe products are insecure but at least if you go to www.filehippo.com you can get Foxit if you must view pdfs. I am a fan of it and it eliminates another vector. Thankfully mac users have their own pdf viewer.

Re:Missing from summary

[Anonymous Coward]

Putting an @reboot entry in the user's crontab would start anything you want when the machine boots, without the user even logging in.

Re:Missing from summary

[Cinder6]

And Windows users look down at Mac users. And Linux users look down at both (Windows users look at Linux users in bafflement, mostly). Everyone looks down at everyone else, if they view it as some sort of "war".

Re:Missing from summary

[Jeremi]

It's about time someone reminded them that Windows is far more secure, it's just targetted more.

... so using Windows is like living in the Green Zone in Baghdad? Sounds appealing!

Re:Missing from summary

[Anonymous Coward]

When 0-day exploits are found in the pdf subsystem is Aple going to nuke pdf from Os X ?
The correct strategy is to patch things on time automatically (like windows) or make sure the idiots using Macs actually patch the fucking software they use.
See its not difficult at all.

The fault for compromised Macs is 100% with Apple since they don't give a crap about updating critical software their users employ. And Java is critical, many many banking websites require Java. What are you going to do ? Apple needs to learn how to secure things and should take inspiration from yeah Microsoft.

Re:Missing from summary

[rubycodez]

Windows is not more secure, it is in fact the least secure of all networked operating systems. the exploits are due to long known bad programming practices. Here we are talking about that bloated cruft known as Java weakening the far superior BSD OS that mac uses, along with that cruft known as flash. but windows is rotten and insecure from the foundation up.

Re:Missing from summary

[rubycodez]

you can it severely degraded, I call it more usable without unnecessary cruft. Java and Flash are doomed, for similar reasons.

Re:Missing from summary

[Anonymous Coward]

No, but a vast majority do.

Off the top of my head:
- All the fanboys who lorded the "virus immunity" (I personally know of several).
- APL just does things better (despite it may be a hardware thing, like high DPI screens everyone has)
- How many cases for other devices do you know have a gaping hole in the middle for the exclusive purpose to show the company logo?
- How many facebook / social media bloggers dispute industry-titans (Elcomsoft's review of password keepers comes to mind) research because it "doesn't affect them"?
- How many facebook users trashtalk "should have gotten an I*" or "why didn't you get an i*" or "it's just better" without backing themselves up. I only have about 30-35 people as friends on my Facebook, and I - off the top of my head - personally responded to at least 3-4 people. That's a huge number considering nobody else lords over other people's product choices.

I'm also at a loss how Windows focuses on Folders and Menus compared to Apps and Documents. Both have icons on the desktop to launch programs and documents. Both have a menuing system to do stuff (although Office uses the Ribbon, largely hiding the menu). They're largely the same general UI paradigm (sure, in Windows, each window could have it's own menu instead of just one, but that's not really all that different)

So yeah. From my perspective? They needed to be taken down a notch.

Re:Missing from summary

[SplashMyBandit]

Mate, the computing ecosystem is not only what the user sees through their desktop or web browser. Java is mostly used on servers (in fact, according to Tiobe's Programming Index metric it is *the* language of choice for development - mostly for enterprises where it is part of the secret sauce that makes the company money, which is why desktop-oriented folks never learn of it). Saying Java is going away is as daft as saying C++ is going away (and we all know how many security holes there are to be had in the implementations of that language). Java is no more a security risk than any other technology (Javascript, .NET, ActiveX, C++, PHP etc all have their own security vulnerabilities), so you advice to 'just not use' is kinda out of the 90's.

Re:Missing from summary

[thestuckmud]

I think about Apple's insane control issues every time I have to re-install OS X (which I did once for testing purposes). My outrage at not being required to type long registration codes and then have the OS phone home for validation is unspeakable.

Re:Missing from summary

[SplashMyBandit]

Funny thing is, these exploits are not 0-day. Oracle patched the Java they control. It was Apple (as you correctly pointed out) who dropped the ball (both the hole in the Mac OS user abilities *and* not patching Java).

It is a real shame Apple hate Java with a passion. It makes sense since Java can and does run well everywhere it is permitted to - but Steve Jobs wanted to silo Apple, so he could make more money (didn't extend his life though [too soon?]). As a developer that attitude really pissed me off, I can write software in Java that runs wonderfully in Windows and Linux, but I'm limited to older officially-supported versions of Java (eg 6 rather than 7) on my (otherwise wonderful) MacBook Pro and not at all on my iPhone.

Apple are wankers in this regard. Tidbit: IIRC the earlier iPhones had JVMs in hardware (part of the chipset the phones used - as did many Java enabled phones a few years ago). Apple had to spend development effort to block the Java capabilities on the phones. They cited Java as being insecure (same with Flash) when this example clearly shows that the security problem is Apple's (since Oracle could repair Java vulnerabilities very quickly for Windows and Linux).

Re:Missing from summary

[mbadolato]

Not to mention that horrendous experience of connecting a backup hard drive, waiting 30 minutes then have the new OS installation reboot and be exactly how I had everything before doing a reinstall. That moronic process forces me to not waste 10 hours reinstalling everything, every time. Bastards.

Re:Missing from summary

[Guy Harris]

Blah, I should have looked it up before posting. OSX version 10.5 and higher running on Intel processors are UNIX 03 certified.

http://en.wikipedia.org/wiki/Single_UNIX_Specification#OS_X

Actually, OS X 10.5 and 10.6 running on Intel processors are UNIX 03 certified, but 10.7 isn't.

But you were probably responding to the poster distinguishing between "OS X" and "UNIX". The problem is that "UNIX" can either mean "an operating system from AT&T^WNovell^WSCO with "UNIX" in its name" or "a specification for operating system APIs and commands". The UNIX trademark refers to the latter, and, in that sense, "UNIX" is not an operating system, it's a specification, and it's not clear what it would mean to have malware targeted at it, unless the malware is portable malware that only uses Single UNIX Specification APIs.

Re:Missing from summary

[symbolset]

The bad guys are definitely after Apple and Android now. They had better not get caught with corporate sponsorship or things will go very badly.

Re:Missing from summary

[Guy Harris]

Putting an @reboot entry in the user's crontab would start anything you want when the machine boots, without the user even logging in.

...and would do so not only on OS X, but on many Linux distributions and FreeBSD and NetBSD and OpenBSD and....

Re:Missing from summary

[symbolset]

Windows is the only one of the set with a multibillion dollar malware ecosystem that makes every browser click and received email a perilous adventure. To the rest, malware is a rare and infrequent nuisance at worst.

And if you need antivirus on your computer, you're doing it wrong.

Re:Missing from summary

[kestasjk]

Here, or here. They qualify it a bit more accurately now, for obvious reasons, but people really did claim immunity.

Re:Missing from summary

[bryan1945]

I look down, and realize my dong is long enough not to care about anyone else's insecurities.

Re:Missing from summary

[Glarimore]

I reformat my PC once a year on the off chance there is something going on I'm not aware of... and it never takes me more than an hour and a half to do so.

Re:Missing from summary

[bryan1945]

And the 2nd mode (no password supplied, is...?

Re:Missing from summary

[Stormwatch]

Then you were correct the first time: 10.7.3 is the only "current" version, and it only runs on Intel processors (unless you do an AMD-based hackintosh).

Re:Missing from summary

[Anonymous Coward]

Sun/Oracle had no interest in developing for Mac OS X, 10 years ago so Apple worked with them to get the code (unlike MS going off to create their own) and make sure it was the best implementation of all the platforms. Java One conference was a sea of Mac Powerbook Ti's. Now that OS X has enough of a installed base they would like Oracle to take their code back but install they have settle on OpenJDK getting the Mac code and maintaining it. While this switchover is still happening Apple will continue to maintain their version of Java with the Oracle fixes as they get them.

"This Trojan further underlines the importance of protecting Macs against malware with an updated anti-virus program" Can't stop laughing. I recommend using LittleSnitch. Also don't enter your password at every dialog that pops up especially if you are not in the middle of an install.

Re:Missing from summary

[Anonymous Coward]

Already solved this as of Lion by not having Java installed in the first space. Java is not critical none of my banks require it. So again this is a huge non issue.

Re:Missing from summary

[Anonymous Coward]

Android, definitely. There has yet to be any type of significant exploit for iOS. Yes, there are exploits used for jailbreaking, and probes for the default root PW with an open sshd, but for all intents and purposes, iOS has been 100% secure going on five years.

Re:Missing from summary

[mevets]

There is a reason MS has to use snoracles java:
http://news.cnet.com/2100-1001-251401.html

Re:Missing from summary

[MobileTatsu-NJG]

Oh man you're funny. A handful of Mac users having always looked down on window users.

Bitch slapping them with a news story about malware is going to keep this war pointlessly perpetuated by giving me a very-long-awaited piece of ammo. ^_^

FTFY.

Re:Missing from summary

[errandum]

I assume you are talking about Time Machine. I've lost more than one "whole install" to corrupt time machine backups. Worse, one of the computers wouldn't even boot after it It was a new computer, changed it for a another, same thing - just ended up restoring my documents only and loosing a shitload of things in the process.

And FYI, windows also does the time machine thing, they just don't call it "time machine" and don't make it a default option. It's a tool that you need to decide to use and it'll freeze your current computer state into an external hard drive or dvd's.

The idea of the Time Machine is good, but it's not well executed. From deleting old backups automatically for space (I might want to save some of those old things) to using a nth degree differential backups that depend on the root and the entire backup tree to work... Each time it runs you risk corrupting something so bad the backups will be worthless. I'd rather apple would let me chose folders and just do full zipped/encrypted copies of those I choose. Time Machine just lulls most into a false sense of security

Re:Missing from summary

[Anonymous Coward]

Yep. Ever heard of LD_PRELOAD? Flashback uses the Mac variant of that, called DYLD_INSERT_LIBRARIES.

Re:Missing from summary

[zippthorne]

How would you patch a hardware JVM?

Re:Missing from summary

[Anonymous Coward]

IE: OSX is about to enter its Win98 era.

Poor bastards.

Re:Missing from summary

[Anonymous Coward]

If you came to slashdot last weekend or before you are infected.

I do use AV, but even if I didn't, I also run NoScript, AdBlock Plus, and other excellent browser plug-ins. Those ads never loaded.

Re:Missing from summary

[R3d M3rcury]

Never used Mac OS X Server, I take it...

Re:Missing from summary

[Anonymous Coward]

Damn! If only there were some way, a piece of software perhaps, that could copy or backup my OS and drives just the way they are. A "clone" if you will. It's really a shame that Windows doesn't come with something like a "Backup and Restore" and that there aren't dozens of applications available that will do anything like that. You Mac users sure got it made!

Re:Missing from summary

[Anonymous Coward]

And it was patched much faster by Oracle and pushed out quicker by the Java install because Microsoft doesn't have insane control issues like Apple does.

Insane control issues? Microsoft deliberately poisoned Java on Windows, forcing Oracle to release and maintain its own port (and prompting a lawsuit.)

Oracle's initial Java release for MacOS (Classic) was so awful that Apple cut a deal to do future ports on its own dime just so Mac users wouldn't get shut out, until it finally got sick of that and pawned the whole thing off on the OpenJDK project.

Re:Missing from summary

[Anonymous Coward]

Actually, replace "Oracle" with "Sun" everytime it appears in my post. All of that happened before Sun got assimilated.

Re:Missing from summary

[symbolset]

Nothing is 100% secure. Not even FreeBSD, which is not known to have had a remotely exploitable vulnerability in the current version ever. The only way to make a computer completely secure is to slag it into a ball of molten uselessness.

I don't mean to deny here that some are better than others at security. There are good, bad and best practices. But for absolutes? Don't digitize it and put it in a computer if you expect or need it to remain private forever.

Re:Missing from summary

[symbolset]

Go ahead and mod me down Y'all. I can afford it. It'll teach others about your presence here.

Re:Missing from summary

[Anonymous Coward]

IE: OSX is about to enter its Win98 era.

I wouldn't believe anything you hear from Internet Explorer.

Re:Missing from summary

[Anonymous Coward]

Using your own opinion as "fact".. you have no kernel design knowledge or experience. Stop faking.. its obvious you are just a non-technical retarded apple fanbot. Apple must love useful idiots like you who do their marketing for free. Unless you get paid, they you're a good whore... get paid son !

Re:Missing from summary

[drkstr1]

Buffer Overflow is so 1990. It's all about injection these days.

Re:Missing from summary

[toriver]

Flash is an integral part of Zynga's Facebook games. Little else should require it.

My bank, however, considers Java to be integral when logging in to it.

Re:Missing from summary

[toriver]

I got the impression 80% of Slashdot also hated Java with a passion. :)

Re:Missing from summary

[Anonymous Coward]

Given that most languages treat floats as primitives (hell, IEEE float support is baked into most CPUs, just like integer math), perhaps you may wish to change the protagonist to be "an object" instead of a float...

Re:Missing from summary

[Angostura]

You poor, delicate snowflake.

Re:Missing from summary

[makomk]

You're safe for now so long as you didn't get infected prior to installing the latest update. Apple tried to remove Flashback, but there's no evidence they were aware this trojan was in the wild and it appears to predate the Flash update.

Re:Missing from summary

[Tom]

I said windows is, by design, more secure that Mac OS

Comparing apples and oranges. Different approaches in security seldom compare naively along one axis. There are many good approaches in windows, and many good approaches in OS X (it hasn't been called Mac OS for a decade now, maybe if you'd get up to speed...)

The issue is more often implementation, where both MS and Apple blunder. But don't forget that it took a decade of heavy fire from pretty much everyone before MS finally woke up and put a focus on security. Before that, their crap contained the most shoody fuck-ups you can imagine and more. I sincerely hope that Apple doesn't require that kind of wake-up call. But they definitely need one, given that they don't even use, say, sandboxing on all of their own applications.

Re:Missing from summary

[Tom]

"To install this virus, run ./configure && make & make install" :-)

Re:Missing from summary

[shutdown -p now]

You forgot to mention adding it to /etc/rc.d to auto-start.

That, and it depends on libvirii of version no less than 0.1.3 (but be sure to not confuse it with libvirii2, which is an ABI-incompatible side-by-side version). Also, if you're using a DE, don't forget to use --with-kde or --with-gnome with configure, as appropriate, for better integration.

Re:Missing from summary

[Anonymous Coward]

real men just use zfs and snapshots.

Re:Missing from summary

[Anonymous Coward]

Hardly. The only reason this trojan is news is that trojans are still very rare on OS X.

Re:Missing from summary

[Richard_at_work]

Really, they don't need a wake up call?

In security update 2012-001 there are 36 patched issues, almost all of which are labelled "may lead to the disclosure of sensitive information", including one TimeMachine issue where a remote attacker could gain access to backups...

And I'm a Mac user and Apple liker!

Re:Missing from summary

[mario_grgic]

Sure, I never said patch for Windows version was not released. But not everyone has patched it. Esp. since I know a lot of people that turn automatic java updates off.

Re:Missing from summary

[pankkake]

You could get root access to any iOS device from a web page, by redirecting it to a special PDF file. It was unpatched for weeks.
That's pretty significant.

Re:Missing from summary

[TheRaven64]

It is a real shame Apple hate Java with a passion. It makes sense since Java can and does run well everywhere it is permitted to - but Steve Jobs wanted to silo Apple, so he could make more money

Wow, someone doesn't remember history very well. NeXT rewrote some of their core products (e.g. WebObjects) in Java, replacing the Objective-C version. When OS X launched, Java was one of three first-class development environments (ObjC/Cocoa and C/Carbon being the other two), including a set of Cocoa bindings for better integration with the host environment. It had a few tricks that weren't present in other JVMs at the time, such as the ability to have only one copy of the standard classes in memory even if you had multiple Java applications running. This code was eventually contributed upstream by Apple and is now present in the official JRE.

The Cocoa/Java ('Mocha') bindings were eventually deprecated because no one was using them.

IIRC the earlier iPhones had JVMs in hardware

The original iPhone had an ARM11 core with Jazelle, but even that doesn't mean 'JVM in hardware' that they had to'spend development effort to block'. It means that it had hardware that executed a subset of Java bytecodes directly and trapped to a VM for the rest. To support it they would have had to:

• Pay a license to ARM and Sun for every iPhone (the Jazelle stuff is disabled by default and must be licensed separately
• Port the Jazelle VM to iOS.

They spent effort in not doing this in the same way that I spent effort in not porting Java to BeOS.

The later iPhones have a Cortex A8 processor. The Jazelle mode in all of these chips does not exist. If you try to enter Jazelle mode, you get an error and return to ARM or Thumb mode. Thumb-2EE mode is supported, but that's just a few small extensions to Thumb-2 mode to make it a slightly more useful target for JIT compilers for Java-like languages. If they had originally supported Java, then they would have needed to spend more time and money porting a different VM to iOS for the newer devices and a lot more time testing that the pure software VM worked the same way as the hardware one.

Oh, and on devices with more than about 32MB of RAM, the hotspot JIT actually runs faster than the Jazelle VM, so using Jazelle on the iPhone would have been entirely pointless.

Re:Missing from summary

[chrisgeleven]

Last time I knew (granted, couple years old knowledge), the Windows version of Java didn't install updates automatically. Has that changed?

Seems like every time I use a Windows computer, there is the Java update icon in the system tray.

Re:Missing from summary

[drinkypoo]

Well, the general idea is that they were very secure. Not too long ago I was modded into oblivion because I said windows is, by design, more secure that Mac OS.

I tend to get modded down every time I point out that Windows has the best implementation of ASLR, Linux a not-so-good one, and MacOS the worst of the three. Let's see if it happens again.

Re:Missing from summary

[Anonymous Coward]

You know, TimeMachine let's you choose not to delete old backups automatically as well as any folder or volume you wish to exclude. Also, it's not like TimeMachine is on by default or cannot be run manually. TimeMachine saved my ass several times. Backing up and restoring are completely painless and you can even use some other system that runs netatalk as a target for backups. Seriously, I don't understand the problem some people seem to be having with a piece of software that they might as well not use in favour of backing up with some other software (like rsync or bup or git or whatever).

Re:Missing from summary

[Tom]

I am writing english, don't I? Quote: "don't need that kind of wake-up call".

Re:Missing from summary

[Anonymous Coward]

and that's exactly what I meant. I was talking about Linux per the OP, dumbass

Re:Missing from summary

[kybred]

The idea of the Time Machine is good, but it's not well executed. From deleting old backups automatically for space (I might want to save some of those old things)

If you have something you want to keep, keep it. Don't depend on TM to know that you want it. The deleting old backups is a tradeoff; would you rather it fail to run a new backup due to lack of space?

to using a nth degree differential backups that depend on the root and the entire backup tree to work...

That's not the way TM works. No diffs are involved at all. It creates hards links to files/folders that didn't change since the last backup. You can delete older backups and files in it that have hard links from newer backups will be retained.

Each time it runs you risk corrupting something so bad the backups will be worthless. I'd rather apple would let me chose folders and just do full zipped/encrypted copies of those I choose. Time Machine just lulls most into a false sense of security

I won't dispute that TM can get corrupted. But you certainly can set up your own backup mechanism of files of your choice.

Re:Missing from summary

[Anonymous Coward]

Comparing apples and oranges. Different approaches in security seldom compare naively along one axis. There are many good approaches in windows, and many good approaches in OS X (it hasn't been called Mac OS for a decade now, maybe if you'd get up to speed...)

Alice: What's that? About this Mac shows the legend "Mac OS X", and the support site category for OS X is named "Mac OS". How can this be? Tom on the Internet says that it hasn't been called Mac OS for nearly decade now.
Bob: Well Alice, The advent of iOS has led to a de-emphasis on the "Mac OS" term, in favour of "OS X", Tom is mistaken in claiming the term to be out of use for nearly 10 years. Checking in About This Mac shows the legend "Mac OS X", and over at apple.com/support, "Mac OS" is the category for Mac OS X related topics. Generally in marketing materials there's less of an emphasis on "Mac OS", yet nowhere near what Tom claims.
Alice: So, he's wrong, and a terrorist?
Bob: Correct, on both counts. His assertion is demonstrably false. As a computer owner he's almost certainly engaging in the theft of copyright protected materials.

Re:Missing from summary

[GizmoToy]

it hasn't been called Mac OS for a decade now
Apple Menu -> About this Mac...

Yup, that's what I thought. Mac OS X. Mac OS is the name, X is the major version number.

He was "up to speed" just fine.

Re:Missing from summary

[GizmoToy]

Well, to be fiar the claims were that they were immune to Windows viruses. "A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers." This is accurate.

However, I agree that the intent was to deceive customers that Mac OS was completely immune to viruses using some deliberate wordsmithing.

Re:Missing from summary

[Gr8Apes]

You should always make snapshot backups. This is easily accomplished with the asr command. You can even boot the duplicated backup to verify. TimeMachine's incremental backup feature for me is a way to recover something I deleted by accident just a day or two ago, at most. I have regular cleanings of TM as well, starting them out fresh to ensure the least amount of corruption possible. This does not take long, because the vast portion of my data is not on TM being relatively static and backed up in other ways. My real system disk backups are duped disks. I once lost a laptop drive, and my total downtime was 5 minutes - grab the latest external, boot up, and grab the differentials from TM. Off I went. Yes, I do keep more than 1 system disk backup, and yes, my data is also duped across multiple systems, depending upon the type of data. I'm just glad I got hold of 8 2TB disks before the flooding happened.

Re:Missing from summary

[Gr8Apes]

And wow - if windows doesn't make you reinstall the OS first, and the upgrades, and the backup/restore software of choice, and its upgrades, before you can start the restore process in most cases. Unless, of course, you went with some real backup software, such as dd and cloned your drive via Linux. But in that case, why are you running windows as the main OS anyways?

Re:Missing from summary

[rubycodez]

been doing kernel and systems work for decades, sonny. Mac OSX is NOT my favorite OS either, however with my experience in over a dozen networked general purpose OS over the years Microsoft Windows is the least well designed and maintained.

Re:Missing from summary

[Anonymous Coward]

Windows 7 maybe be decently secure but by no definition of the word was XP or earlier windows versions ever secure let alone at the release dates and that is when windows got most of it's bad rep, and microsoft often took weeks and months to plug holes.

Re:Missing from summary

[Anonymous Coward]

What do you mean you don't want to have to call microsoft when you operating system says the serial on your box is not valid anymore cause you decided to change out your system hard drive and that was you 5th install?

Re:Missing from summary

[man_of_mr_e]

I have pretty much one thing to say:

http://www.youtube.com/watch?v=GQb_Q8WRL_g

Re:Missing from summary

[Tom]

X is part of the name and has always been. The official name used to be "Mac OS X" until recently, and the upcoming version is officially named just "OS X":

http://www.theverge.com/2012/2/16/2802281/apple-officially-renames-mac-os-x-to-os-x-drops-the-mac

Re:Missing from summary

[Anonymous Coward]

Because "designed to be more secure than OS X" is a silly claim to make. That's not how any microsofty would see it.

Re:Missing from summary

[Anonymous Coward]

And it was patched much faster by Oracle and pushed out quicker by the Java install because Microsoft doesn't have insane control issues like Apple does.

It was made clear before Lion was released that it is the last OS X release to bundle Java. Also, Sun wanted Java bundled with every OS install you moron, it's not like Apple fought for it.

Re:Missing from summary

[Anonymous Coward]

Hey, IE speaks from experience.

Re:Missing from summary

[ToasterMonkey]

I know this is a mouthful for those who do not understand but I would highly recommend looking into how exactly this malware works. Here is how the default set-up of OS X can be subverted to install a binary to a hidden user directory without user permission or knowledge. Then download a binary which is really smart that will try to get user permission to install system wide and if it does not receive this permission it just does it to the ill informed Mac user without permission. With Linux the system would not allow a .so to be loaded to a user /home directory and then set it to run at login. This is the problem with Mac security there is also a huge hole in the way binaries can run from within a /home at login without permission!

Here is a run-down of how it works and why it will only work on Mac because its method of infection does not require user interaction to install the payload to a users home directory with Mac OS. However I have the feeling that this security nightmare will be addressed by the Apple coders simply by doing things the way most Linux distros do!

This is such an obvious troll, you retarded "+1 too long to read" moderators.

echo "export PATH="~/.gnome2/.hackersbins:$PATH" >> ~/.bash_profile
or
echo "export LB_LIBRARY_PATH="~/.gnome2/.hackerslibs" >> ~/.bash_profile

That's just scratching the surface of how a Linux user account can be compromised.
With a teensy bit of effort, any user processes that open ~/.bash_profile could get ~/.your_original_one too.
Then we could go down into what gets started with your X session and some convincing gksu prompts.
It doesn't even have to be that complex, because I bet most of you don't fully qualify the path to sudo when you run it.

And I'm tackling just the clever Linux users. _Forget_ about casual users.

There is no fundamental mechanism or behavior in UNIX or Linux systems that protects a user and his/her processes from themselves. It is not designed that way. You can be reasonably sure that SUID binaries run unmolested, but that's about it.

Re:Missing from summary

[Anonymous Coward]

"it hasn't been called Mac OS for a decade now, maybe if you'd get up to speed..."

Actually, Apple only officially changed the name from "Mac OS X" to "OS X" with the Mountain Lion release this very year. So much for a decade...

Before getting accusing someone of needing to get up to speed, check the "About this Mac" page on a Mac running Lion...

http://www.macrumors.com/2012/02/16/apple-officially-drops-mac-name-from-os-x-mountain-lion/

Re:Missing from summary

[GizmoToy]

The X has only been applicable since Mac OS has been on version 10. The X certainly wasn't part of the name when it was Mac OS 7, Mac OS 8, or Mac OS 9. Apple's been using Mac OS as the operating system name, followed by a version identifier, for over 15 years.

It does look like you're right in that Apple's not using the Mac part going forward, though, probably in preparation for further merging of iOS and OS X.

Re:Missing from summary

[SplashMyBandit]

Thanks for your comments and expansion of the topic.

> The Cocoa/Java ('Mocha') bindings were eventually deprecated because no one was using them.
Why would they? If you are going to use Java you use Swing or AWT or SWT. Using Apple-specific bindings makes zero sense if you are going to use Java (kinda defeats the purpose of "write once, run anywhere" which actually does work if you know what you are doing).

> Oh, and on devices with more than about 32MB of RAM, the hotspot JIT actually runs faster than the Jazelle VM, so using Jazelle on the iPhone would have been entirely pointless.
Two things: first, plenty of people still have devices with less than 32 MB of RAM and this was certainly the case when early devices are used. Secondly, Apple in its egocentricity decided to support neither. The idea of coding for a specific platform hasn't made sense for a long time (one of the reasons C was invented, and certainly why Java was invented) and is wasteful of developer time, yet the big corps are *still* trying to silo consumer cattle into their corral. This suits the big corps but not the customer. The corps then then bullshit about "the freedom to innovate" and "a superior experience on their platform" but that is not the strongest reason why they do it 'their way' (ego) and 'lock you to their platform and tools' (greed). Universal cross-platform was slowly becoming a reality but thanks to Apple (iOS) and Microsoft (XBox) they are trying to silo again. For *users* is a step backwards, not forwards. Too bad so many users are "ooooh, teh new shiny" that they are perfectly willing to get shafted again and again for basically the same functionality but re-packaged since the platform owner shifts the sands each version.

Re:Missing from summary

[TheRaven64]

Why would they? If you are going to use Java you use Swing or AWT or SWT. Using Apple-specific bindings makes zero sense if you are going to use Java (kinda defeats the purpose of "write once, run anywhere" which actually does work if you know what you are doing).

And that's how you end up with crap applications. Good cross-platform applications are MVC with a different UI for each platform. Even the Swing documentation agrees with this, and recommends that you use a native look and feel. If you've got a Java application then you could add a Mac GUI that would use native widgets and behaviours everywhere (you could even get your Mac UI specialist to draw it in Interface Builder), but still reuse the same model code that you used on other platforms.

Two things: first, plenty of people still have devices with less than 32 MB of RAM and this was certainly the case when early devices are used

Irrelevant. No one has an iPhone with under 32MB of RAM. The existence of devices under 32MB has no baring on the

Secondly, Apple in its egocentricity decided to support neither

They also chose not to port Mono. Or any other VM environments. They let you run binaries (although they did restrict this in the developer license for a while), so as long as your language of choice can generate ARM assembly it will run. The egocentricity seems to be more on your part, deciding that Apple needs to pay to have the runtime for your favourite language ported to their platform.

Universal cross-platform was slowly becoming a reality but thanks to Apple (iOS) and Microsoft (XBox) they are trying to silo again. For *users* is a step backwards, not forwards

No, for users cross-platform applications that had a non-native look and feel were a step backwards. Java applications on OS X often can't even get text boxes right - the shortcut keys for navigating in a text field are different to every other application that the user uses on the platform - and things like menu layouts are also unconventional. How is that good for the user? Users benefit from good ports, not from half-arsed recompile-and-ship jobs. Or, in the case of Java, skipping even the recompile step.

Re:Missing from summary

[SplashMyBandit]

> And that's how you end up with crap applications.
Bullshit. I thought this 'native look n feel' myth had been thoroughly debunked by now by developers in the know. There are plenty of applications with a native look-n-feel that are crap. There are plenty of applications (more, in fact, as time goes by) that don't have native look-n-feel that are thoroughly excellent. Self-consistency and meeting expectations for application type matters far more niceness of integration that just using native widgets.

> Irrelevant. No one has an iPhone with under 32MB of RAM. The existence of devices under 32MB has no baring on the
Totally relevant when the decision was made. And if I accept your argument, then there was no real reason not to allow someone to port Java to the iPad (and later iPhone) except for Apple's corporate politics. Instead Apple have decided to take a totalitarian route (which, incidentally seems to be abused to stop competition more than any supposed benefits of the iron fist). I'm a Apple user and I love their gear but hate their attitude.

> Java applications on OS X often can't even get text boxes right - the shortcut keys for navigating in a text field are different to every other application that the user uses on the platform - and things like menu layouts are also unconventional.
This I agree with. However, don't throw the baby out with the bathwater, Apple did have the leeway over their own VM to fix it - after all, they insisted on maintaining their own VM than letting Sun (and now the community with OpenJDK) sort it out. What I'm trying to point out was that it is Apple's policies that are preventing Java from working on iOS (and Java could be made to be great on that platform - the problem is not the technology, it is the evil gatekeeper).

With regard to Mono. That's a non-argument since the .NET libraries are not intended to be cross-platform. What I'm trying to say is that Apple is against cross-platform, and cross-platform is good. Disagree?

> The egocentricity seems to be more on your part, deciding that Apple needs to pay to have the runtime for your favourite language ported to their platform.
Apple don't have to pay for anything - that is just the apologies of a fanboi. All they would have to do is get out of the way and let the community sort it out (OpenJDK manages to get a lot of places without Microsoft or Linus funding anything). iOS is not really that much different to OS X after all. Do you really think that if Apple got out of the way that the community would have the inability to make a good Java version for iOS?

Re:Missing from summary

[omfgnosis]

You know, TimeMachine let's you choose not to delete old backups automatically

If that's true, it's not a user-facing option (it may be a defaults write hack?). There is no such option under "Options", and this language is hard-coded into the prefpane:

Time Machine keeps local snapshots as space permits, and:
  Hourly backups for the past 24 hours
  Daily backups for the past month
  Weekly backups for all previous months
The oldest backups are deleted when your disk becomes full.

None of these destructive limitations are user-configurable.

Re:Missing from summary

[omfgnosis]

Also don't enter your password at every dialog that pops up especially if you are not in the middle of an install.

Fat lot of good that does when there's no dialog.

Re:Missing from summary

[omfgnosis]

And while Little Snitch is a great tool for paranoid nerds, it's hardly something I'd propose to secure the Macs of most of the people I know, and I doubt Apple would either.

Re:Missing from summary

[omfgnosis]

it hasn't been called Mac OS for a decade now, maybe if you'd get up to speed...

It's called Mac OS X in the current bloody release, you condescending asshole. http://2.bp.blogspot.com/-S-5N0lndtfM/TyBBKqVHULI/AAAAAAAAAq0/DrQkcTSgcys/s1600/1073.png

Re:Missing from summary

[Anonymous Coward]

If you have something you want to keep, keep it. Don't depend on TM to know that you want it.

Well why even bother with time machine at all, if you know what you want then you won't ever have to rollback files.

The deleting old backups is a tradeoff; would you rather it fail to run a new backup due to lack of space?

No, i'd rather the solution obvious to anyone that's not a time machine apologist: That it ask me which backups to delete if it runs out space. Or to at least give me the option to do such a thing, it doesn't even have to be the default.

I won't dispute that TM can get corrupted. But you certainly can set up your own backup mechanism of files of your choice.

Then why use time machine? You expect the user to know what they want to keep and then you suggest an alternative means of full backup, so time machine offers no advantage. The file rollback is its main feature but you've already said 'If you have something you want to keep, keep it. Don't depend on TM to know that you want it' so why bother.

Re:Missing from summary

[exomondo]

Well, to be fiar the claims were that they were immune to Windows viruses.

That's like saying Macs can't run Windows software like, Photoshop, which is true, they can't, but they can run the Mac version of Photoshop.

In the second link they state 'Mac OS X isn’t plagued by constant attacks from PC viruses and malware.' and given that even Apple say that a Mac is a PC that is indeed untrue. It certainly lulls many (not all) Mac users into a false sense of security.

Re:Missing from summary

[Anonymous Coward]

As someone who works with Mac nonsense all day long, I am absolutely fascinated: how are these Time Machine stores being corrupted? And what would you rather have happen when a backup volume runs out of space?

Re:Missing from summary

[justforgetme]

Ok, so they are trying to go the route of IBM wit their OS/2? Does that mean that in a couple of years nobody will want to have anythign to do with it?

</ill_humor>

Seriously I think that naming your OS "OS <number>" as in Operating System <number> without applying a descriptive qualifier (Windows, Mac) is so egotistic egotists will be ashamed of themselves.

Re:Missing from summary

[justforgetme]

ASLR, that's one (1) security factor. An OS has to be better in security across the field in order to be able to seriously claim being the best.

Re:Missing from summary

[Anonymous Coward]

And wow - if windows doesn't make you reinstall the OS first, and the upgrades, and the backup/restore software of choice, and its upgrades, before you can start the restore process in most cases.

It doesn't. Boot off of your install disc, choose to repair, point it at your backup image and off it goes.

Unless, of course, you went with some real backup software, such as dd and cloned

"Real" backup software is something like Acronis or Paragon, not some unreliable hodge-podge of scripts and a chain of commandline utilities that have a 50/50 chance of actually working.

via Linux. But in that case, why are you running windows as the main OS anyways?

Because Linux does run the software that I use and because I don't want an OS that I have to spend a lot of time coaxing and configuring every time I want to get a new piece of hardware or software working. Windows just works with everything that matters to me.

Re:Missing from summary

[Gr8Apes]

And wow - if windows doesn't make you reinstall the OS first, and the upgrades, and the backup/restore software of choice, and its upgrades, before you can start the restore process in most cases.

It doesn't. Boot off of your install disc, choose to repair, point it at your backup image and off it goes.

You know, I've worked on actual NT server systems. We had full backup solutions, tested several, from Veritas et al. ALL of them required a base windows system to recover a server from. The windows backup/restore is a less than 50% crapshoot that is far less reliable than TimeMachine to boot should it happen to "complete". Granted, it's been a few years since I've had the displeasure to deal with this personally and the software could have gotten a little better.

Unless, of course, you went with some real backup software, such as dd and cloned

"Real" backup software is something like Acronis or Paragon, not some unreliable hodge-podge of scripts and a chain of commandline utilities that have a 50/50 chance of actually working.

dd (or, for Apple, asr) are block based copying utilities. They tend to have the extremely difficult format of

<cmd> <source> <target>

and tend to be as reliable as a file copy command. (Yes, there might be one or two options for each, but you can discover which you'd like to use in seconds on Google.)

Now, if you want some 3rd party backup solution, that's fine as well, and recommended naturally for server systems. For your home system, that isn't usually necessary. People that tend to rely on those pieces of software mentioned generally have never tested the backups personally and blindly rely on them.

via Linux. But in that case, why are you running windows as the main OS anyways?

Because Linux does run the software that I use and because I don't want an OS that I have to spend a lot of time coaxing and configuring every time I want to get a new piece of hardware or software working. Windows just works with everything that matters to me.

So run it in a VM, unless, of course, you're looking to run the latest specialized graphics cards and playing the latest windows games.

Re:Missing from summary

[Bobfrankly1]

I said windows is, by design, more secure that Mac OS

Comparing apples and oranges. Different approaches in security seldom compare naively along one axis. There are many good approaches in windows, and many good approaches in OS X (it hasn't been called Mac OS for a decade now, maybe if you'd get up to speed...)

The issue is more often implementation, where both MS and Apple blunder. But don't forget that it took a decade of heavy fire from pretty much everyone before MS finally woke up and put a focus on security. Before that, their crap contained the most shoody fuck-ups you can imagine and more. I sincerely hope that Apple doesn't require that kind of wake-up call. But they definitely need one, given that they don't even use, say, sandboxing on all of their own applications.

...and thus began the age of Apple "stealing" from Microsoft's OS. Things that had been common in Windows now started to show up in the Mac OS, much to the chagrin of many a Microsoft fan boy. (Yes, they do exist)

Re:Missing from summary

[Bobfrankly1]

You know a Time Machine isn't good when even Doctor Emmett Brown won't use it...

Re:Missing from summary

[Anonymous Coward]

And it was patched much faster by Oracle and pushed out quicker by the Java install because Microsoft doesn't have insane control issues like Apple does.

The difference is that Apple has fixed the vulnerability 2 weeks ago, so everybody using auto-update even with the "once a week" setting should have it fixed already. While there simply is no auto-update for Java on Windows. Case in point: I had to check by hand that I'm still running 1.6.0.26. Better update now. Also by hand.

Re:Missing from summary

[Anonymous Coward]

It's ridiculous that all browsers don't require you to approve plugins...

As a note, Internet Explorer has some of that functionality, although not by default. If you go to "Manage Add-Ons", you'll see them under "Toolbars and Extensions". You can enable and disable there, but if you click on the little "More Information" label with a plugin like Flash selected, it'll have a box with the label "You have approved this add-on to run on the following websites:".

Normally, there's just an asterix, meaning all sites are allowed. If you click "Remove All Sites", then it'll block the plugin by default. You'll get the yellow "Do you want to use this plugin" on every site that wants to use it, but it won't load at first. If you DO use the plugin at a site, it will be added to the list of sites, and will be allowed by default. However, this won't affect other sites.

It's not the best implementation, but it does allow a little more defense than blindly allowing all sites to use plugins.

Re:Missing from summary

[Anonymous Coward]

Differential backups are not what you think they are

Re:Missing from summary

[Anonymous Coward]

I didn't consider mac users lording their "super advanced security and magical virus immunity" as "good times." It's about time someone reminded them that Windows is far more secure, it's just targetted more. This is going to be the beginning of a long line of taking them down a notch.

Now that Jobs is gone, the reality distortion field is finally collapsing.

Re:Missing from summary

[StikyPad]

I was under the impression that Apple does their own Java implementation because they don't want anyone else's grubby fingers in their OS or browser. As a result, and since Java isn't exactly Apple's top priority, they're usually at least one step behind in implementing the latest changes.

Re:Missing from summary

[StikyPad]

the shortcut keys for navigating in a text field are different to every other application that the user uses on the platform

I'm not saying the shortcuts for OS X are better or worse than any other, but I will say that standardization is a good thing, and OS X is the odd man out at this point. Apple have benefited greatly from standardization of hardware on the x86 and ARM architectures, and I think they'd benefit just as much by transitioning to the de facto shortcut standards. This is particularly true for people and shops that use a mixture of environments rather than OS X exclusively (which probably describes more Mac users than not) so that motor memory can take over instead of consciously remembering which shortcut maps to which platform.

And yes, you can change most shortcuts manually to get a close approximation, but not entirely.

Re:Missing from summary

[Anonymous Coward]

You know, I've worked on actual NT server systems. We had full backup solutions, tested several, from Veritas et al. ALL of them required a base windows system to recover a server from. The windows backup/restore is a less than 50% crapshoot that is far less reliable than TimeMachine to boot should it happen to "complete". Granted, it's been a few years since I've had the displeasure to deal with this personally and the software could have gotten a little better.

So have I, but times have changed since the days when Windows carried the "NT" moniker. The backup and restore functionality that comes with Windows 7 works very well and does not require Windows to be installed in order to restore from a disk image.

dd (or, for Apple, asr) are block based copying utilities. They tend to have the extremely difficult format of

<cmd> <source> <target>

and tend to be as reliable as a file copy command. (Yes, there might be one or two options for each, but you can discover which you'd like to use in seconds on Google.)

A good GUI based backup software can be easily understood and used without the need to look up anything. I just set my options and let it go at it. I also have peace of mind that they will work correctly with the file systems that I use most (NTFS and exFAT) because they were specifically designed for them.

Now, if you want some 3rd party backup solution, that's fine as well, and recommended naturally for server systems. For your home system, that isn't usually necessary. People that tend to rely on those pieces of software mentioned generally have never tested the backups personally and blindly rely on them.

For home use, the Windows 7 backup and restore is perfectly fine. For business systems, it's worth it to buy good backup software.

So run it in a VM, unless, of course, you're looking to run the latest specialized graphics cards and playing the latest windows games.

What would be the point? I would spend 99% of my time in the VM and incur a severe performance penalty in the process. I do a lot of graphics editing, video editing and 3D modeling work, all of which utilize the hardware in my PC to its limits. Most of the major pieces of software that I use has no real equivalent for Linux. The smaller applications might have replacements but I'm not going to rework my entire workflow and relearn how to use something else to do the things that I can already do very well.

It also doesn't address my issues with having to wrestle with a Linux OS to get it to do something that in Windows probably only takes a couple of clicks. You can say that Linux doesn't have those problems, but in my experience I always seem to run into something that is more hassle than it's worth, whether it be setting up a piece of hardware/software or just being able to use the software that _I_ want to use and not having to settle for something that isn't as good. I don't have any of those problems using Windows.

Re:Missing from summary

[errandum]

How, I have no idea. Just really needed my system and a couple of virtual machines (separated in a lot of tiny files) and they were not there. The problem was, Time Machine only updates or re-writes what was changed, so if he thinks he still has the right version of a file that got corrupted (have no idea how that happens), there will be no further backing up and from there you can have the whole virtual machine not booting.

I wanted it to ask me WHAT I wanted to delete. In the case of the virtual machines, I didn't need 10 copies of it, just the most recent working copy. If I had downloaded a CentOS image with a few gb's, I don't want to have that taking space, nor do I want it to save the 30gb of uncompressed HD movie clips I was editing. Or the (very legitimate) torrent file I'm on the process of downloading)

On the other hand, if my original backup had this snapshot of my Documents folder 10 months ago, I tend to only keep what I'm really working at the moment. I'd love it... If only it would, at the very least, let me move those files somewhere in the computer before deciding they are to be deleted, that'd be great.

You were asking "what other way do you proposed besides deleting the older one", well, Most companies after a few years will only keep the full backups done every other week or so, deleting the incremental and differential backups that would let you recover any day of a specific month. They assume that it won't be necessary to know the exact state of a system on any given day after that time (nor will the law force them in a common business). The Time Machine system won't allow you to do this, but it'd be a start. Delete old versions of a document it knows there are new ones (same name, same place, start by deleting the original versions of those). Prioritize large sized old media (I don't really think the 4.7gb mkv will do much good on a backup). But well, that'd be an intelligent way to do it - I guess the gurus at apple prefer to keep things "simple and dumb"

Also, all these answers proposing I do backups to account for my backups failing. Redundancy it's all nice and dandy, but if a backup system is not reliable, it is no backup system at all. I know disks fail and shit happens, but I've heard more than one horror story about time machine (and I didn't care for them - until it happened to me).

Re:Missing from summary

[Gr8Apes]

So have I, but times have changed since the days when Windows carried the "NT" moniker. The backup and restore functionality that comes with Windows 7 works very well and does not require Windows to be installed in order to restore from a disk image.

I suppose I deserve that. I still think of 2008R2 as an "NT" server.... because it suffers from many of the same core architectural failures that NT did, because it's the same fundamental core. I will also admit that I installed W7 (in a VM) looked at it a few times, and have only used it for IE9 debugging. Restoring the system is as easy as copying the original backup VM for me.

A good GUI based backup software can be easily understood and used without the need to look up anything. I just set my options and let it go at it. I also have peace of mind that they will work correctly with the file systems that I use most (NTFS and exFAT) because they were specifically designed for them.

There's also GUI front ends to at least the asr piece, that make it as simple as 2 or 3 clicks. File systems are irrelevant with these tools. In fact, asr is about as good as it gets since it allows cloning your system while its running and does so very efficiently, because it is fully integrated with the OS.

...People that tend to rely on those pieces of software mentioned generally have never tested the backups personally and blindly rely on them.

For home use, the Windows 7 backup and restore is perfectly fine. For business systems, it's worth it to buy good backup software.

I note you gloss over the piece about people blindly relying on them.

So run it in a VM, unless, of course, you're looking to run the latest specialized graphics cards and playing the latest windows games.

What would be the point? I would spend 99% of my time in the VM and incur a severe performance penalty in the process. I do a lot of graphics editing, video editing and 3D modeling work, all of which utilize the hardware in my PC to its limits. Most of the major pieces of software that I use has no real equivalent for Linux. The smaller applications might have replacements but I'm not going to rework my entire workflow and relearn how to use something else to do the things that I can already do very well.

Very well, you have a suite of software that is specific to Windows and you like it. You disparage Linux for this field, which I won't argue, as I agree that for that use, Linux still has a ways to go. However, Apple has some of the premier software available in these fields between them and Adobe. (While Adobe ran better on Windows with v4-5.0 due to their failure to migrate to Cocoa for those versions, they completed the migration in 5.5.)

Re:Missing from summary

[Anonymous Coward]

I note you gloss over the piece about people blindly relying on them.

I didn't gloss over that, I said that Windows backup and restore works very well. The ultimate test, I suppose, is to actually restore from an image and that isn't something I've had any problems with. If you're doing regular backups, the chance that all of them will be corrupt is pretty slim. You can mount backup images and perform file comparisons if you need to verify, however.

Very well, you have a suite of software that is specific to Windows and you like it. You disparage Linux for this field, which I won't argue, as I agree that for that use, Linux still has a ways to go. However, Apple has some of the premier software available in these fields between them and Adobe. (While Adobe ran better on Windows with v4-5.0 due to their failure to migrate to Cocoa for those versions, they completed the migration in 5.5.)

Linux is great for certain fields. I run it on my phone (Android) and if I were running a server, I would go to Linux first. In fact, one of the pieces of software that I use heavily is Inkscape, which is open source and cross platform, but I rely upon a lot more than that. Going with a Mac is out too, for several reasons. First is compatibility, since I do graphics work that is intended for specific applications that run on Windows. In this regard, a Mac is not really any more useful to me than a Linux desktop OS would be. The second issue is cost. I am not willing to pay literally double for a Mac that has lower specs across the board than my PC has. The last issue is that vastly more hardware and peripherals are produced and available for Windows PCs than for Macs.

Re:Missing from summary

[Gr8Apes]

I didn't gloss over that, I said that Windows backup and restore works very well.

I've had 0 succes with windows backup and restore. (we used 2008 R2 for creating a loadable image - it failed, wound up using a dd clone operation) But that was another story.

Going with a Mac is out too, for several reasons. First is compatibility, since I do graphics work that is intended for specific applications that run on Windows. In this regard, a Mac is not really any more useful to me than a Linux desktop OS would be. The second issue is cost. I am not willing to pay literally double for a Mac that has lower specs across the board than my PC has. The last issue is that vastly more hardware and peripherals are produced and available for Windows PCs than for Macs.

I'm curious - what graphics formats are you using that are windows applications only? I was under the impression that the WMF and like formats were quickly disappearing from common use.

I used to think that Apple was more expensive too. Until I tried to get a matching PC. Depending upon what hardware you're needing, some accessories can seem to be a little more on the surface, but when you actually try to match specs, Apple isn't usually too much more, and in some cases cheaper - the Mac Air is one prime example.

flashback to first post

[Anonymous Coward]

First post!!

Contradiction

[Hercules Peanut]

I understand the purpose and value of malware protection but from the article we first read:

The Java exploits appear to be pretty standard, but have been obfuscated using ZelixKlassMaster to avoid detection by anti-malware products.

then

This Trojan further underlines the importance of protecting Macs against malware with an updated anti-virus program as well as the latest security updates.

Doesn't that seem to come off as a slightly counter-intuitive statement? Is it unreasonable to come away from this article asking yourself "Why buy anti-virus when the malware just avoids it anyway?"

Re:Contradiction

[ninetyninebottles]

This Trojan further underlines the importance of protecting Macs against malware with an updated anti-virus program as well as the latest security updates.

Doesn't that seem to come off as a slightly counter-intuitive statement? Is it unreasonable to come away from this article asking yourself "Why buy anti-virus when the malware just avoids it anyway?"

It is trying to hide its similarity to other malware so that a new signature is needed to detect this specific variant. So while anti-virus programs may not detect this now, within a few days they probably will, at least until there is yet another variant. Apple is, of course, including their own signatures right in the OS so that makes antivirus less attractive as well, although Apple's response time has been hit and miss.

Re:Contradiction

[Billly Gates]

A good anti virus software package will look for apps with strange behaviors and sandbox or block them.

For shit and kicks I weird download happened automatically from the PirateBay yesterday. I ran it through a VirtualBox and even though Avast! did not pick up the malware signature it did flag it and immediately sandboxed it as it said its behavior was typical of tojans and malware. I was impressed.

I know some slashdoters with very outdated 1990s knowledge think you are fine without any anti virus package as long as you do not click attachments are in a rude awakening. Even slashdot hosted malware in an ad about 2 weekends ago!

Anyway Norton is available for macs and Avast has a beta for IOS and MacOSX. I would recommend any mac user to use either one. You need more than a scanner to remain secure today and no platform that can execute data and use ram can ever be secure.

Re:Contradiction

[Anonymous Coward]

Don't use shitty browsers. Disable scripts. I scan for viruses every so often, but have no constant protection from them. Of course, this computer has nothing of value on it. On the ones that do, I protect them further, of course.

But seriously, despite me using this computer all the time, I haven't gotten a virus in years.

Re:Contradiction

[phantomfive]

Even slashdot hosted malware in an ad about 2 weekends ago!

What? I know Flash has problems, but.....

Re:Contradiction

[Billly Gates]

Go run malwarebytes? It was a fake virgin mobile ad

Re:Contradiction

[suprem1ty]

I see where your coming from, but I guess the keyword is *updated* antivirus program. By a similar token why bother with any security at all if malware can exploit it anyway.

Re:Contradiction

[suprem1ty]

I see where your coming from, but I guess the keyword is *updated* antivirus program. By a similar token why bother with any security at all if malware can exploit it anyway.

Re:Contradiction

[Bobfrankly1]

I know some slashdoters with very outdated 1990s knowledge think you are fine without any anti virus package as long as you do not click attachments are in a rude awakening.

The good old days of common sense avoidance have been over for quite awhile. Used to be that you'd have to go looking for a virus, but now they find you. I almost feel sorry for new Mac adopters, in the coming years they're going to be in same virus situation many of them switched to get away from.

Remotely controlled first post

[Anonymous Coward]

Sent from my MAC Mini

Re:Remotely controlled first post

[rthille]

Shouldn't that be: "Sent from _your_ Mac Mini"?

Re:Remotely controlled first post

[TheRaven64]

It was yours...

Apple Culture

[ninetyninebottles]

I hope the recent rash of Malware for the Mac will serve to change the culture of security at Apple. They have a lot of really good technology in that regard and many very good coders who work with security as a priority (they have a lot of oldschool UNIX guys these days). The problem is, it is not a priority for Apple or part of their culture. Some Apple software ships with what looks like no security review at all and no real consideration, while other software clearly was architected with that as a design goal.

They have some very nice sandboxing, but they don't apply it very widely within OS X, even when there is no pain to the user or developer. It is like they just don't want to spend money and resources on that sort of hardening. You send a security hole to Apple and sometimes you hear back the next day and it is fixed in short order. Other times you hear nothing or malware is known and spreading for weeks before Apple bothers to issue a filtering signature.

Hey Apple! Wake up and smell the coffee. Dump some of your cash reserves into expanding work in security and having some experts paying attention and getting things done. "Think Different" about security and listen to the people you already have that have created groundbreaking security systems elsewhere.

Re:Apple Culture

[Anonymous Coward]

You now, a paranoid man would say this is an Apple conspiracy to push the Mac community toward the walled garden approach that their iOS devices are stuck in. Imagine if in OS X 10.9 you cannot install any third-party applications unless they come digitally signed from the Mac App Store. Want to run your own open source code? You need a $99/year "developer" license and digital certificate to compile and sign your binaries.

I know, it's a stretch, but I never thought it would happen on their mobile devices either. We went from a culture of anyone can develop and install apps on your device (PalmOS, Windows Mobile, etc.) to the locked-down walled garden of iOS.

Re:Apple Culture

[ninetyninebottles]

You now, a paranoid man would say this is an Apple conspiracy to push the Mac community toward the walled garden approach that their iOS devices are stuck in. Imagine if in OS X 10.9 you cannot install any third-party applications unless they come digitally signed from the Mac App Store.

Why? Why would Apple want to do this, aside from some insane take over the world theory? They are certainly pushing for signed applications running in nice sandboxes and they're using the Mac store as one way to do it, but why would they want to disable other applications entirely? The whole corporate development market, the software developer market for both iOS and MacOS would be horribly inconvenienced potentially to the point of walking away from the platform. Legacy software would prevent huge numbers of users from ever upgrading. I could go on listing reasons why Apple wouldn't want to do this, but I still haven't heard one good reason why they would want to do this. Apple doesn't make money on the iOS app store, nor really on the Mac app store. Where's the motive?

I know, it's a stretch, but I never thought it would happen on their mobile devices either.

On mobile devices they got to start fresh and they had a huge problem to solve... battery life. Phones live or die in the market based on battery life and user perception thereof. Locking down software on iOS was primarily about preventing apps that did not use battery efficient threading, push notifications, and system services so that users would be happy about their battery usage. Google is still trying to crack that nut and if you ever get a chance to talk to their devs, they know it.

Re:Apple Culture

[wmbetts]

If they ever did that I'd stop buying Apple computers. I buy them because it's a UNIX OS that has native applications I want to run. If they start doing that I'll go back to Linux and dual booting Windows for those applications. I doubt I'm the only person that would stop buying them either.

Re:Apple Culture

[MtViewGuy]

In short, Mac users now realize that if order to be safe from malware attack, you need software on your local computer to intercept and stop the attack in the first place.

Windows users already have multiple choices for such protection, and even Microsoft offers a free one: Microsoft Security Essentials, which is a surprisingly good Internet security program (it's highly recommended especially for Windows 7 users, since it works closely with Windows 7's own security features).

Re:Apple Culture

[TrekkieGod]

Why? Why would Apple want to do this, aside from some insane take over the world theory? They are certainly pushing for signed applications running in nice sandboxes and they're using the Mac store as one way to do it, but why would they want to disable other applications entirely?

To charge their customary 30% for every Mac OS X application?

I don't think Apple is using malware to push for the walled garden (It's bad PR, it's more likely to push people away from the OS entirely. They'd much rather continue their "You don't have to worry about viruses with our super-secure OS!" marketing approach. That said, I do believe they'd love to have Mac OS X as controlled as iOS, if they could figure out how to get away with it.

Re:Apple Culture

[ninetyninebottles]

Why? Why would Apple want to do this, aside from some insane take over the world theory? They are certainly pushing for signed applications running in nice sandboxes and they're using the Mac store as one way to do it, but why would they want to disable other applications entirely?

To charge their customary 30% for every Mac OS X application?

If money is the motive, you should know they make so little on both stores put together (including music and movie sales) that it is barely a blip on their radar. Apple is a razor not a blade business model. The stores are purely there as ways to make hardware more attractive and increase hardware sales.

Re:Apple Culture

[Daniel Phillips]

Hey Apple! Wake up and smell the coffee. Dump some of your cash reserves into expanding work in security and having some experts paying attention and getting things done.

Apple is run by a bean counter now. What does that suggest to you?

Re:Apple Culture

[toriver]

... and if you buy an "application" in any other store, do you think the store does not take a cut? They could have made Mac OS into a controlled OS years ago if that was their goal. But they are probably getting pissed at these third-party runtimes (slow Flash, buggy Java) that screw things up.

Re:Apple Culture

[gl4ss]

If money is the motive, you should know they make so little on both stores put together (including music and movie sales) that it is barely a blip on their radar. Apple is a razor not a blade business model. The stores are purely there as ways to make hardware more attractive and increase hardware sales.

time to attack the messenger, because that's just stupid. it's a long term plan on making money year on year with very little in the way of expenses. hundreds of millions of dollars is a bit more than just a blip.

but you're right sort of. the main motive is actually control.

Re:Apple Culture

[Anonymous Coward]

In short, Mac users now realize that if order to be safe from malware attack, you need software on your local computer to intercept and stop the attack in the first place.

"Software on your local computer" will not make users safe from attacks. At best, it may prevent non zero-day exploits from worms. Turf it up, sweetheart.

Re:Apple Culture

[cbope]

Security is neither sexy nor cool, so Apple will never put too much effort in it. They are more concerned to make things easy for the user, and the problem is that sometimes good security makes things harder for the user. Apple's decision will always fall on the easier-for-the-user side, if given a choice.

Re:Apple Culture

[Cro Magnon]

Security is neither sexy nor cool, so Apple will never put too much effort in it. They are more concerned to make things easy for the user, and the problem is that sometimes good security makes things harder for the user. Apple's decision will always fall on the easier-for-the-user side, if given a choice.

Microsoft made that mistake, and that's why it got its much deserved reputation for crappy security. Hopefully, Apple will wise up.

Re:Apple Culture

[Bobfrankly1]

Why? Why would Apple want to do this, aside from some insane take over the world theory? They are certainly pushing for signed applications running in nice sandboxes and they're using the Mac store as one way to do it, but why would they want to disable other applications entirely?

To charge their customary 30% for every Mac OS X application?

If money is the motive, you should know they make so little on both stores put together (including music and movie sales) that it is barely a blip on their radar. Apple is a razor not a blade business model. The stores are purely there as ways to make hardware more attractive and increase hardware sales.

and I'm sure you've got the citations to back this up? I seriously doubt that Apple make as little on the App Store as you'd like us to believe.

Here we go...

[cffrost]

Cue the corporation-worshiping consumers willing to abandon human dignity in defense of a non-living multinational corporate person.

Re:Here we go...

[Anonymous Coward]

Cue the "comedy".

Re:Here we go...

[Anonymous Coward]

Cue the high-horses and hypocrisy.

Re:Here we go...

[rolfwind]

Hey, I agree, I would never worship a non-living multinational-corporation.

Apple has been going downhill ever since Jobs died. While He was around, He would never have allowed this to happen.

Re:Here we go...

[Anonymous Coward]

Apple has been going downhill ever since Jobs died.

AAPL closed @ 356.03 on 2011-08-19 (Friday before Jobs announced resignation).
AAPL closed @ 605.23 on 2012-04-13 (last Friday).

Re:Here we go...

[Anonymous Coward]

I love slashdot's comment ranking (and my sarcasm will probably get this comment modded to hell). How is this comment worthy of "4 insightful"? There's plenty to critique and lambast Apple for specifically, but generic self-righteous drivel doesn't seem insightful to me.

Re:Here we go...

[rolfwind]

I guess my humor was missed. I was hoping capitalizing "He" instead of inserting one of those dreary sarcasm tags would have been clue enough.

Re:Here we go...

[Bobfrankly1]

Hey, I agree, I would never worship a non-living multinational-corporation.

Apple has been going downhill ever since Jobs died. While He was around, the reality distortion field would have never allowed all this bad press.

FTFY

Disable Java

[sqrt(2)]

Unless you know you need Java, disable it. Also, install something like Noscript for whatever browser you use. You'll be safe then, at least against the types of attacks we've been seeing.

I don't recall there ever being a self-replicating worm for a *nix platform that could infect you just by being unpatched and connected to the network; please correct me if I'm wrong. You have to actually navigate to an infected site for these trojans to get you.

Re:Disable Java

[Anonymous Coward]

http://en.wikipedia.org/wiki/Morris_worm

Re:Disable Java

[Anonymous Coward]

Or, use Firefox nightlies. They have a form of noscript available, which will be later on enabled by default for all.

Re:Disable Java

[Anonymous Coward]

Unless you know you need Java, disable it.

No one NEEDS Java.

Re:Disable Java

[H0p313ss]

No one NEEDS Java enabled in a web browser in 2012

Corrected that for you.

Re:Disable Java

[Billly Gates]

People do need Java.

Any Computer Science student typically learns Java. Eclipse is huge and so are Aptana, bit torrent clients (forgot the popular one written in Java), and corporations use banking, Kronos, and ADP sites that use java applets to make up for the fact they use IE 6 still. Java is another crappy workaround just like Flash to give a false sense of modern browsing with graphical effects.

However even slashdot nerds never once think about disabling java in the browsers. I see this at work too when they complain their users are keeping them busy cleaning infections on a daily basis. Disable java in all web browsers except through a whitelist via a GPO duh!

I agree the Java applet html tag was depreciated in 1999. It died on the web browser front many many years ago. IT and all of us need a refresher that you can still use java and just not use it in the browser. Chrome doesn't even support it.

Re:Disable Java

[wmbetts]

http://www.securelist.com/en/descriptions/old23854

ADM wrote a worm that spread through bind. I recall a few others, but I don't remember their names so I can't google them.

Re:Disable Java

[Anonymous Coward]

Why was this modded down?

Java is heavily used in most corporate sites, enterprise software, and is the most taught langauge in any university today. Not everyone is a simple home user who just checks email, runs word, and browses the internet and nothing else.

To say its not needed and disabling it in the web browser is very relevent. Eclipse has millions of users and Andriod is built on top of the Linux kernel and a java environment.

Re:Disable Java

[SplashMyBandit]

Azureus (now called Vuze) is the very popular bitorrent client written in Java. Minecraft is a popular game written in Java. However, these don't run in a browser. I myself wrote a Java Webstart client for displaying pilot statistics for the Lockon Modern Air Combat game (with the Flaming Cliffs 2 expansion). When I run the client in a browser it is dog slow. If I run the same client from the desktop (Webstart is pretty nifty you can do this) it is a factor of 10 faster and I get the same benefits that the web offers (that is automatic updating of the client when needed - just like the web). So, while some folks do use and need Java, doing it in a browser is not really a good idea. Note: I actually wrote my client using Google Web Toolkit (GWT) first but found that even this did not give me the interactivity I wanted in my user interface - the web really sucks for user interaction (even though GWT is one of the most powerful AJAX web interfaces out there).

Re:Disable Java

[Anonymous Coward]

Unless you know you need Java, disable it. Also, install something like Noscript for whatever browser you use. You'll be safe then, at least against the types of attacks we've been seeing.

I don't recall there ever being a self-replicating worm for a *nix platform that could infect you just by being unpatched and connected to the network; please correct me if I'm wrong. You have to actually navigate to an infected site for these trojans to get you.

since java is a main part of html 5 specification wouldn't it be better just to not use a browser.. So lets see no flash or java on mac n your safe.. lol whats the point of having a browser on the mac again? n yes that sarcasm.

Re:Disable Java

[Anonymous Coward]

Unless you know you need your computer, just don't turn it on.

See what I did there? I offered a 100% fix. Just like your suggestion, it was 100% useless.

Re:Disable Java

[toriver]

(insert standard "Java is not Javascript" explanation here)

Re:Disable Java

[Anonymous Coward]

"I agree the Java applet html tag was depreciated in 1999."

    Thank you. Thank you. Thank you.

    You used the word depreciated properly, instead of that abomination "Deprecated". Although I sometimes have difficulty parsing your posts, and may not agree with your conclusions, your heart, and spell-checker, are in the right place.
    Especially in regards to Java, where this whole deprecated nonsense started with in the first place.

Re:Disable Java

[sqrt(2)]

You're an idiot. Turning off an unneeded and insecure service is not equivalent to giving up on computing entirely. Shut the fuck up.

Re:Disable Java

[jones_supa]

Why was this modded down?

Unfortunately I have lately seen comments being modded down with no apparent reason. There's a bit of some kind of vandal modding going on around here. I hope it's a passing fad though.

Re:Disable Java

[toddestan]

However, these don't run in a browser.

Actually, Minecraft does run in a browser. I know there's an .exe client for Windows, but the browser version is the easiest to get going on Linux.

Re:Disable Java

[Bobfrankly1]

Unless you know you need Java, disable it. Also, install something like Noscript for whatever browser you use.

This, regardless of your OS. I work in both Win and OSX environments, little things like noscript will hold off many common attacks, as well as suppressing the unwanted behavior of some obnoxious but commonly used (or needed) websites.

Fri5jt stop

[Anonymous Coward]

serves to reinfo/rce long term survival

"Trojan Requires No User Interaction"

[Anonymous Coward]

So... rape condom?

Market share

[devleopard]

This is inevitable, and will continue. OSX have gone from 2% to an estimated 14% market share since 2003

Android has something like a 47% share in the smartphone space.. and there's a report of malware weekly.

I think it's fair to say that it's easier to find a hole (ugh, here comes the 12 year-old humor) than to imagine all the ways people might come up with. You simply need a large enough target to make it worth their while.

Re:Market share

[ModernGeek]

Mac OS 9 had a smaller install base than current Mac OS X and was constantly riddled with viruses. I don't think that market share alone determines whether or not something ends up riddled with viruses. That being said, Apple has been particularity lax about security these last three years.

Re:Market share

[Anonymous Coward]

Riddled? From memory, there were only a few dozen for the classic Mac OS, in all the years it was out, and I saw one in 15 years. See the 2003 article http://www.macobserver.com/tmo/article/Mac_Viruses_By_The_Numbers_-_Word_Macro_553_Classic_Mac_26_OS_X_Zero/ where it compares a count of 26 versus the 71,000 Windows viruses at that date. Also, Vista had viruses even before it was released http://www.theregister.co.uk/2005/08/04/vista_virus/ so I agree, installed base is no indication ;-) My risk assessment says it's way less likely that I will be troubled with malware on the Mac OS.

Re:Market share

[Anonymous Coward]

Mac OS 9 had a smaller install base than current Mac OS X and was constantly riddled with viruses.

Mac OS 9 did have a significant number of viruses (and other malware), but saying it “was constantly riddled with viruses” is a gross exaggeration. From System 6 to Mac OS 9, malware for Macs was so infrequent that one man, John Norstad, kept abreast of all Mac malware in his spare time. He gave away Disinfectant for free.

Re:Market share

[j-beda]

Mac OS 9 had a smaller install base than current Mac OS X and was constantly riddled with viruses. I don't think that market share alone determines whether or not something ends up riddled with viruses. That being said, Apple has been particularity lax about security these last three years.

I don't know that "constantly riddled with viruses" is particularly accurate. Were there more than even a dozen? Were any widespread? Wikipedia only seem to list a half dozen (not that that is a definitive proof of anything): http://en.wikipedia.org/wiki/Category:Macintosh_viruses

While malware was not a large issue for Mac OS pre-X, that was mostly a function of the ecosystem - I don't know of any technical reasons making the Mac difficult to target. I did once hear a talk that a lot of malware from the 1980s and 1990s was produced by disaffected youth from Eastern Europe, who had access and experience with Winel machines rather than Apple/Motorola systems, and thus used what they knew. Perhaps if cheap Mac clones were used in the Eastern Block regions more extensively the situation would have been different.

Re:Market share

[Divebus]

It doesn't exist anymore on the Internet, but recall reading a piece on the Norton web site that stated there were 40 viruses for the Mac (OS 9). That was in 1998 or so.

Re:Market share

[Tom]

I am skeptical of the causal relation between marketshare and malware share. It has been thrown around as an argument for more than a decade, but there is little evidence for it. At the very least, the correlation is weak, as the rise in malware seems to come at arbitrary times in arbitrary bursts. Unless you postulate that somehow 14% is a magical number, plotting the curves would show they demonstrate no similarities.

I am not saying that market share is not a factor - few malware targets NetBSD or BeOS or any of the other obscure OS with a market share barely visible under a microscope. However, market share is at best one of many interacting factors. The most important consequence is that you can not predict the future trend from market share alone, not even broadly. If the OS X market share doubles over the next two years, the amount of malware could stay almost equal, it could double, tripple or explode by several orders of magnitude.

Re:Market share

[Anonymous Coward]

"Mac OS 9 had a smaller install base than current Mac OS X and was constantly riddled with viruses."

    Liar.
    Rather than the NVIR virus that percolated through the OS 7 and 8 universe, there were _no_ significant virus infections in the Mac ecosystem.
    And NVIR was primarily distributed by infected physical media. There were no significant, or maybe _any_ infections, downloaded from the Internet.

Re:Market share

[Anonymous Coward]

I don't know a single person who got any of those reported viruses/worms/malware for OS9, and non that i know have this java one either, flash and java are useless crap anyway stear clear of it imo.

Rubbish names.

[mr_lizard13]

Kaspersky refers to it as 'Backdoor.OSX.SabPub.a' while Sophos calls it at 'SX/Sabpab-A.'

Those names are very un-Apple. How about just 'iTrojan'.

Or, to avoid confusion with the previous trojan...

'The New iTrojan.'

Re:Rubbish names.

[Anonymous Coward]

Rubbish Troll, Rubbish attempt at humour

Re:Rubbish names.

[Anonymous Coward]

Awww, looks like some Apple cum guzzler got their feelings hurt....... poooooooor baby

Re:Rubbish names.

[Anonymous Coward]

Awwww, looks like some eight year old logged in on dad's Winbox and had to post something "funny" bashing Apple.

Re:Rubbish names.

[pbjones]

iTrojan? because it's not an iOS bug, it should be MacTrojan...

Re:Rubbish names.

[Guy Harris]

iTrojan? because it's not an iOS bug, it should be MacTrojan...

Yeah, I wonder when Apple are going to port iTunes, iPhoto, iMovie, and the iWork suite to OS X from iOS, so they can run on an iMac....

Re:Rubbish names.

[Anonymous Coward]

"Awwww, looks like some eight year old logged in on dad's Winbox and had to post something "funny" bashing Apple."

    And with his command of language, I'd be very cautious about letting him take my daughter out on a date, in a decade or so.
    On the other hand, he may now actually be 28, and not eight.

    In which case, I would be very, very cautious.

Re:Rubbish names.

[ghmh]

Surveys have recently shown that 67% of people would install the new version of iTrojan without checking how or why it's different from the current iTrojan. Furthermore 43% of users said they were such Apple fans that they would likely install the new version of iTrojan without even being aware that they would do so.

BotOxAss-A

[G3ckoG33k]

"Kaspersky refers to it as 'Backdoor.OSX.SabPub.a' while Sophos calls it at 'SX/Sabpab-A.'""

G3ckoG33k calls it BotOxAss-A.

Re:BotOxAss-A

[Anonymous Coward]

Not really a nice name for your sex pet.

Funny pattern

[Anonymous Coward]

The only companies finding this "trojans" are RUSSIAN.

And BTW, Kaspersky is known for creating viruses, releasing them and then claiming to be the best at finding them.

My semi-regular Mac accounts post

[93 Escort Wagon]

Mac users need to stop running their day-to-day stuff under Administrator accounts. Create a new account (if your account is "joe", call this new one "joe_admin"); give it admin permissions; make sure you can log in with it; then (and ONLY then!) remove the admin permissions from your personal account. And then... keep using the same account you've always been using.

On those rare occasions you need to use admin permissions - such as when you are installing software - you'll be prompted to authenticate as an admin, just like you already are. The only difference is you'll need to type that new admin account's ("joe_admin") into the authentication window rather than use your own account. It's brain-dead simple.

The reason for this (in case you're saying "but the Mac already warns you to authenticate, why bother?") is, when your account is an admin account, you're in the "admin" group (duh). The "admin" group has write permissions into the /Applications and /Library folders. All a bad guy needs to do to get around those authentication warnings is to invoke a bash script (or Applescript or whatever) that makes the necessary changes outside of the GUI.

If you're not running as an admin, a malicious script can still theoretically mess with your personal files and folders; but not the system-level ones.

Re:My semi-regular Mac accounts post

[Billly Gates]

This can be installed with just a user account too. Its a memory corruption bug so it simply injects itself to processes already running as admin through local priveldges. However the last malware would still run under a user account but the malware could be easily deleted by deleting the account. Still with more code it can infect key system files.

User privledges only add another step and are not foolproof.

Re:My semi-regular Mac accounts post

[wmbetts]

The only stuff you have access to in either directory is your own stuff. I can't write to anything else even via the command line. I can't access /etc/master.passwd or any other sensitive file unless I use sudo. I might be wrong, but I think OSX more or less uses same security model as Linux.

Re:My semi-regular Mac accounts post

[Anonymous Coward]

Or hey, they could defer to Apple for all their administrative needs. Run as user and install only from the approved walled-garden, just like having your own IT staff. But then you'd all whine about that.

Re:My semi-regular Mac accounts post

[93 Escort Wagon]

No, the Linux model is closer to what I described - you're not in any privileged group, and you have to be explicitly added to /etc/sudoers before you can use sudo. OS X adds admin accounts to sudoers by default (not really a big deal, in all likelihood; but it'd be better to make that an explicit option).

One example: Look at /Library - anything in there that's writeable to group "admin", you can get into without any confirmation. /Library/Fonts, for example - you can silently add files in there, at least in 10.6.8 (try it - if you're an admin, just use "touch" to create a file in there, then delete it - e.g. "touch foobar"). And remember, font engine exploits have happened in the real world (Duqu). You might have to sequence a couple exploits together; but that's a pretty common practice nowadays.

BTW you can manually add your non-privileged account to /etc/sudoers without it getting overwritten as other accounts come and go - it's what I've done for years on my various Mac laptops.

Re:My semi-regular Mac accounts post

[mjwx]

Mac users need to stop running their day-to-day stuff under Administrator accounts. Create a new account (if your account is "joe", call this new one "joe_admin"); give it admin permissions; make sure you can log in with it; then (and ONLY then!) remove the admin permissions from your personal account. And then... keep using the same account you've always been using.

Mac Users put things like this in the "too hard" basket, Macs are simple, easy to use and Automagically Secure(TM) and how dare you suggest they do something as complex and take responsibility for themselves. Who do you think they are, Windows users.

Re:My semi-regular Mac accounts post

[zippthorne]

BTW you can manually add your non-privileged account to /etc/sudoers without it getting overwritten as other accounts come and go - it's what I've done for years on my various Mac laptops.

I do the same.

But how do you trick the update utility not to be stupid?

I may be setting something incorrectly, but as far as I can tell, if you're not logged in as an admin, it doesn't automatically check for updates and download them in the background, or even alert you as to the *possibility* of new updates, you have to manually run the utility, and it is not a speedy process.

Re:My semi-regular Mac accounts post

[shutdown -p now]

Given that you can run binaries from ~, I don't see how it'd give you much protection against this kind of thing - it can still install itself there, and add itself to your own (rather than system-wide) autorun scripts. That's good enough for a worm, especially if its sole reason for existence is to make your machine part of a botnet.

Re:My semi-regular Mac accounts post

[Anonymous Coward]

This post is a joke, right? In 2012, when even grand-mothers buying a PC knowingly nod when reminded to make an extra account?

Re:My semi-regular Mac accounts post

[Anonymous Coward]

Yes, because Windows users are so much better. That's why we've had an equally hard time convincing users of all three platforms (Mac, Windows and Linux) that this is a basic, simple concept at the university I work at...

Users are user and users are stupid. That's platform independent!

Re:My semi-regular Mac accounts post

[ToasterMonkey]

If you're not running as an admin, a malicious script can still theoretically mess with your personal files and folders; but not the system-level ones.

What does this matter on a single user system?

Everything of value is owned by that user anyway.

On a multiuser system, for protection, yes, all user accounts should be isolated from each other as much as possible, but most macs are single user I imagine.

Re:My semi-regular Mac accounts post

[Anonymous Coward]

BTW you can manually add your non-privileged account to /etc/sudoers without it getting overwritten as other accounts come and go - it's what I've done for years on my various Mac laptops.

I do the same.

But how do you trick the update utility not to be stupid?

I may be setting something incorrectly, but as far as I can tell, if you're not logged in as an admin, it doesn't automatically check for updates and download them in the background, or even alert you as to the *possibility* of new updates, you have to manually run the utility, and it is not a speedy process.

You can set up a cron job to run
softwareupdate -a -i
regularly, but it's better to just log in to your admin account once a day to run updates (not just OS updates, but also third party software updates like microsoft, adobe, and mozilla). It's not nearly as smart as package managers in Linux or wuauclt in Windows; softwareupdate won't GUI prompt for a reboot if one is needed to finalize a patch installation, and sometimes it will install software and leave the computer in an unstable state (I've had a machine cut off SSH before), so I tend to do a
softwareupdate -a -i && sleep 3600 && /bin/bash /path/to/scripts/RebootifNoOneLocallyLoggedin.sh
these days for remote machines. The sleep is needed because for some reason, softwareupdate doesn't always seem to prevent the rest of the command line from occurring, so I've had machines reboot while softwareupdate was running.

Re:My semi-regular Mac accounts post

[Anonymous Coward]

that would suck, we hate passwords

Use Chrome and "Click to play" for plugins

[oberhaus]

This attack is done by taking advantage of an exploit in the Java plugin. There are also lots of exploits in Flash (unless they have all been found and fixed...) You should try using Chrome and Click to Play: https://plus.google.com/118187272963262049674/posts/Mmgbr3BcYWb

Those idiots at Microsoft

[Anonymous Coward]

If they hadn't written this crappy code and had used *nix instead, this wouldn't have happened.

Re:Those idiots at Microsoft

[sqrt(2)]

This is a flaw in Java, which isn't an Apple or "Unix" product. Apple is only responsible for it insofar that they bundle Java with their OS, which is going to end with their next major release of OS X.

Re:Those idiots at Microsoft

[Anonymous Coward]

Wrong. Apple maintains the Mac port of Java. It's very much their fault for sitting on their asses and not getting the patch out sooner, which had been available on other platforms for some time now.

Re:Those idiots at Microsoft

[sqrt(2)]

You're the wrong one. Apple was late with the patch to the version of Java that they maintain but it's still not an Apple product, it's from Oracle. This is a flaw in Oracle's Java, and starting with 10.8 Java will no longer be part of Apple's OS.

Re:Those idiots at Microsoft

[Bobfrankly1]

This is a flaw in Java, which isn't an Apple or "Unix" product. Apple is only responsible for it insofar that they bundle Java with their OS, which is going to end with their next major release of OS X.

Not quite. Apple has been porting their own implementation of Java. Updates for java are delivered through the "Software Update" functionality of OS X. The flaw was fixed well in advance of it being exploited on the Mac, putting the responsibility square on Apple. This was outside the control of Oracle, whom had already resolved the issue, and made a patch available to anyone not using OS X.

If Apple didn't insist on this level of control, I would be inclined to agree with you, but they took responsibility when they chose to port their own Java.

Just be sure not to panic & delete the wrong f

[Kenja]

You are looking for com.apple.PubSabAgent.pfile & com.apple.PubSabAGent.plist and NOT com.PubSubAgent.plist or com.PubSubAgent.pfile.

Sorry, this can't possibly be true.

[rudy_wayne]

There are no viruses / trojans that affect Macs

Even if there were, it wouldn't matter because Macs are immune due to their inherent superiority.

After all, the Mac fanboys have been telling us this for more than 10 years now,. they couldn't possibly be wrong.

Fix Available

[Frankie70]

Fix available here.

Re:Fix Available

[Anonymous Coward]

pfft, out of the frying pan, into the blazing inferno of thrown chairs.

Better fix here.

Re:Fix Available

[Anonymous Coward]

Good point, a Mac user is already used to not being able to use any of the software his friends do.

Re:Fix Available

[Anonymous Coward]

True...
    Two decades ago. _All_ my friends now use Macs.
    But, then again, I now have much higher quality friends.

Re:Fix Available

[Anonymous Coward]

Good point, a Mac user is already used to not being able to use any of the software his friends do.

If you think of pimply, gameoholic teenagers you may have a point.

Re:Fix Available

[Anonymous Coward]

But, then again, I now have much higher quality friends.

bahahaha! yes there's always someone like you who thinks the genius bar employees actually are geniuses!

Re:Fix Available

[Anonymous Coward]

Guys, please stop rickrolling us.

I surf using a linux VM hosted on OS X

[koan]

Not perfect, but less likely to be exploited and get to my host machine, I don't do much on OS X any more, moved all the video editing and audio DAW to Win7 because I can build my own boxes to my spec that way.
Hello to my fav NT4 machine at 31 jing-ring street Beijing !

Well, I just disabled my Java plugin

[gman003]

Guess it's time to start treating my Mac computers the same way I treat my Windows computers - in need of extra care and protection against external attacks.

And so I've just disabled my Java and Quicktime plugins. Java because that's where all the current attacks are focused (and I never use it anyways), Quicktime because I never use it, either, and a smaller attack area is always good. I still visit enough sites that I need Flash enabled, but that's currently my only plugin (and protected by some heavy blocking rules).

I'll also be much more strict about keeping everything up-to-date, and all the other basic security practices.

Next, guess I need a basic virus-scanner. The only GPL one I see is Clam, which, last time I used it, was completely ineffective at stopping viruses. The one I use on Windows, MSE, is naturally not available on the Mac. So, any suggestions?

Re:Well, I just disabled my Java plugin

[Jerry Smith]

Sophos works well enough. Free and enough configuration options imho. ClamXav is there as well but only there for when something suspicious is going on AND sophos unexpectedly stops working.

Re:Well, I just disabled my Java plugin

[Anonymous Coward]

Clams a bloody good virus *scanner* - but it's not good for preventing you from infection. I run it across the board on my XP64/2k3 systems, but that's because I'm pretty paranoid about what gets to run on them. A quick scan every week or so checks all is well (and picks up a couple of network tools that are false positives). I like the latter particularly, as it would be a sign straight away if the F/Ps stopped getting generated for whatever reason.

Re:Well, I just disabled my Java plugin

[Bobfrankly1]

I'll also be much more strict about keeping everything up-to-date, and all the other basic security practices.

This practice would be much more effective if Apple had the same commitment to keeping things up to date as you do.

Protect yourself.

[pubwvj]

Turn.
Off.
Java.

Re:Protect yourself.

[Jeremi]

Turn. Off. Java.

Serious question here -- what makes Java inherently less secure than, say, JavaScript? AFAICT they are both languages that run in a sandbox inside your web browser. Is today's anti-Java-applet push just because the malware-of-week exploits a Java implementation bug, and next week we'll be saying "Turn. Off. JavaScript. Too." as the next malware exploits a JavaScript implementation bug instead ... or is there some fundamental difference that I'm missing?

Re:Protect yourself.

[Anonymous Coward]

Yes, there is something fundamental which you are missing.

Javascript does not "run in a sandbox inside your web browser". Your browser IS the sandbox. Your browser runs the Javascript.

Java, OTOH, runs as a plugin inside your browser. Your browser attempts to sandbox the plugin, but the plugin is native code, and the browser can only go so far to try to sandbox native code.

Trying to sandbox Javascript, and trying to sandbox a plugin, are completely different scenarios.

Re:Protect yourself.

[Jeremi]

Trying to sandbox Javascript, and trying to sandbox a plugin, are completely different scenarios.

I'm not sure I see this as an important difference, unless you trust the secure-coding abilities of Apple/Safari programmers more than you trust the secure-coding abilities of Sun/Oracle/JavaPlugin programmers. Either way the sandbox-code is either secure, or it isn't. Why should the location of the code matter?

Or to put it another way... would compiling the Java-plugin code directly into Safari have avoided the security hole that this malware exploited? I doubt it would have.

Re:Protect yourself.

[Daniel Phillips]

There are very few Java sites out there, but the few there are seem to have a high probability of pushing the JVM into 100% CPU. After a while I got tired of that and just removed the browser plugin. I haven't given it a thought since, that was a few months back.

My child on the other hand, likes to use a couple of web sites that run games as Java apps. Those kid's games are the only thing keeping Java in any browser in this household.

Re:Just be sure not to panic & delete the wron

[Anonymous Coward]

Yes, note the capital 'G' in the trojan plist file. Also, be sure to look in /Library/Preferences, and not /Users//Library/Preferences where there is a legitimate file called com.apple.PubSubAgent.plist (without the capital G).

The correct place to look for the trojan shouldn't have more than about 30 plist files listed. If there are several screens full of plist files, (I have 120+ on my OS 10.5.8 Mac) you're probably looking in the wrong place.

Java sucks

[JDG1980]

A large part of the blame for this rests on Sun/Oracle's idiotic decision to install the browser plugin by default when the Java runtime is installed.

Most users don't need Java at all. Of those who do, a majority of them don't need it in the browser. And of those who do need it in the browser, they only need it for a small handful of websites, not any and every site on the entire WWW. What should happen is that Java installs by default for desktop applications only with no browser plugin. If the browser plugin IS enabled, then by default it should work only on explicitly whitelisted sites or domains, not everywhere. Of course, there should be methods for system administrators to roll out custom whitelist configurations to users in bulk. But apparently no one at Oracle has heard of the principle of least privilege, so we get crap like this every couple of months.

If you have Java, please reevaluate whether or not you really need it. If you do need it, but only for desktop apps (and/or development) and not for browser based apps, then remove the browser plugin. There are virtually no legitimate public websites that use Java, but a lot of malware that exploits the plugin for evil purposes.

Re:Java sucks

[phantomfive]

Do you think Javascript is much different?

Re:Java sucks

[bryan1945]

Done with Linux Mint? Try BSD butterscotch!
(sorry, it just popped into my head) :)

Re:Java sucks

[phantomfive]

Great, and it took me like 30 seconds of wondering what kind of hardware support BSD butterscotch has before I realized there is no such distro..... :/

Re:Java sucks

[MadMaverick9]

If the browser plugin IS enabled, then by default it should work only on explicitly whitelisted sites or domains

http://noscript.net/faq#qa1_8

the NoScript add-on for Firefox already does exactly this.

user follows a link in their Web browser

[nurb432]

....so its more of a trojan than a virus, as the user did have to do SOMETHING...

Re:OS Preference

[Phrogman]

It would really be nice to think that the majority of /.ers are mature enough to just accept that other OSes exist and that some people prefer them. However, apparently most of us are children when it comes to OS preference and have to take an antagonistic and condescending approach to dealing with anyone who differs from our preference. Sad.
My first computer was an Amiga 500. Then I bought an IBM PC clone. I have used MS products for years (DOS 4 -> Windows XP). I didn't particularly like them as they were rather flaky for much of that time, but they got the job done, and my employers used them so I needed to be familiar with them as well. Eventually I bought an iMac and tried OS/X and I like it. I still use Windows XP when I want to play games, but do the majority of my actual computer using on the Mac side of bootcamp. I have used Linux on the desktop and on the server for the past few decades, plus BSD etc. I have an Android smart phone ATM.
I try to use the right tool for the job at any point. I *like* OS/X because it works for me quite well and it seems fairly reliable. Other than that I seldom think about the OS. Its a nice form of Unix and it works well, that is about it.
OS Wars are so childish, unless you are actively developing an OS yourself and can hold discussions based on merit and not personal opinion/bias...

Little Snitch?

[Anonymous Coward]

Does Little Snitch give an alert when this malware calls out?

Apple-Oracle

[Anonymous Coward]

A couple weeks ago, while taking my asian girlfriend shopping at the local mall, I had to take a piss. As I entered the john, Steve Jobs -- the messiah himself -- came out of one of the booths. I stood at the urinal looking at him out of the corner of my eye as he washed his hands. He didn't once look at me. He was busy and in any case I was sure the security guards wouldn't even let me shake his hand.

As soon as he left I darted into the booth he'd vacated, hoping there might be a lingering smell of shit and even a seat still warm from his sturdy ass. I found not only the smell but the shit itself. He'd forgotten to flush. And what a treasure he had left behind. Three or four beautiful specimens floated in the bowl. It apparently had been a fairly dry, constipated shit, for all were fat, stiff, and ruggedly textured. The real prize was a great feast of turd -- a nine inch gastrointestinal triumph as thick as his cock -- or at least as I imagined it!

I knelt before the bowl, inhaling the rich brown fragrance and wondered if I should obey the impulse building up inside me. I'd always been a liberal thinker and had been an Apple customer since 1984. Of course I'd had fantasies of meeting Jobs, sucking his cock and balls, not to mention sucking his asshole clean, but I never imagined I would have the chance. Now, here I was, confronted with the most beautiful five-pound turd I'd ever feasted my eyes on, a sausage fit to star in any fantasy and one I knew to have been hatched from the asshole of Steve Jobs, the chosen one.

Why not? I plucked it from the bowl, holding it with both hands to keep it from breaking. I lifted it to my nose. It smelled like rich, ripe limburger (horrid, but thrilling), yet had the consistency of cheddar. What is cheese anyway but milk turning to shit without the benefit of a digestive tract?

I gave it a lick and found that it tasted better then it smelled.

I hesitated no longer. I shoved the fucking thing as far into my mouth as I could get it and sucked on it like a big half nigger cock, beating my meat like a madman, and thrusting my pink iPod Shuffle into my ass. I wanted to completely engulf it and bit off a large chunk, flooding my mouth with the intense, bittersweet flavor. To my delight I found that while the water in the bowl had chilled the outside of the turd, it was still warm inside. As I chewed I discovered that it was filled with hard little bits of something I soon identified as peanuts. He hadn't chewed them carefully and they'd passed through his body virtually unchanged. I ate it greedily, sending lump after peanutty lump sliding scratchily down my throat. My only regret was that Steve Jobs wasn't there to see my loyalty and wash it down with his piss.

I soon reached a terrific climax. I caught my cum in the cupped palm of my hand and drank it down. Believe me, there is no more delightful combination of flavors than the hot sweetness of cum with the rich bitterness of shit. It's even better than reading an Apple press release!

Afterwards I was sorry that I hadn't made it last longer. But then I realized that I still had a lot of fun in store for me. There was still a clutch of virile turds left in the bowl. I tenderly fished them out, rolled them into my handkerchief, and stashed them in my briefcase. In the week to come I found all kinds of ways to eat the shit without bolting it right down. Once eaten it's gone forever unless you want to filch it third hand out of your own asshole. Not an unreasonable recourse in moments of desperation or simple boredom.

I stored the turds in the refrigerator when I was not using them but within a week they were all gone. The last one I held in my mouth without chewing, letting it slowly dissolve. I had liquid shit trickling down my throat for nearly four hours. I must have had six orgasms in the process.

I often think of Steve Jobs dropping solid gold out of his sweet, pink asshole every day, never knowing what joy it could, and at least once did, bring to a grateful Apple customer.

Java in a browser? What? Why?

[emt377]

Why would anyone want Java in their browser? I don't have the JRE plugin and would never install it. There's no need for Java to run in a browser. Desktop apps is a different matter, Eclipse and such are quite useful. And it's eminently practical on the server side. But in the browser? That's completely legacy, and Apple should just stop distributing the plugin for Safari.

Re:Java in a browser? What? Why?

[emt377]

I guess default is that it's not installed on Chrome. Default for some bizarre reason is to install this shovelware on Safari. Quit Safari, then remove with:
$ sudo -s
# rm -f /Library/Internet\ Plug-Ins/JavaAppletPlugin.plugin
# rm -rf /System/Library/Java/Support/CoreDeploy.bundle/Contents/JavaAppletPlugin.plugin
# exit

Restart Safari. Gone!

Re:Java in a browser? What? Why?

[Anonymous Coward]

Why would anyone want Java in their browser? . . ..

Because I like using iKVM and iLO to access my server consoles.

issue is now moot

[noh8rz3]

Apple's latest security update (from Thurs) turned off automatic execution of java applets. User can still turn it back on if he wants, but for nearly everybody this is going to be moot.

What, No Tinfoil Hat People?

[Greyfox]

When the first one came out, I thought Apple might use it as a justification for dropping OS/X support for Java completely. It's always seemed like a red-headed stepchild on the platform. It seems like the only one where updates come from someone other than Sun (Well, Oracle now,) and those updates have always seemed like they're few and far between. I bet very few tears would be shed over at Apple if Java just went away.

Re:Java in a browser? What? Why?

[SilverJets]

Came here wondering the same thing.

Applets failed before they even had a chance to take off. Who the hell is still installing the Java plugin?

Best protection is abstenance

[__aazsst3756]

To be specific uninstall Java. I did on my wife's mac, and she is yet to miss it. There is always the sandboxed java built into chrome if needed.

Re:Best protection is abstenance

[cmdrbuzz]

Java is not included with Chrome. You are thinking of Flash....

Where the Fuck is Steve Jobs !

[freedom_india]

Where the fuck is Steve Jobs? Guess counting iTrojans in iHeaven. Stupid moron.

Re:Where the Fuck is Steve Jobs !

[Anonymous Coward]

You are an idiot.

--
Marcan, asshole and proud.

Re:Java in a browser? What? Why?

[jgrahn]

Came here wondering the same thing.

Applets failed before they even had a chance to take off. Who the hell is still installing the Java plugin?

Yeah; Java applets were a fad in the late 1990s. Last time I saw one, I was using Windows 95.

Re:Java in a browser? What? Why?

[Anonymous Coward]

In Norway, most banks support a java-based sign-on solution as one one of the login methods for their sites.

Java applets have still their (painful) uses.

Re:Java in a browser? What? Why?

[Freultwah]

Some banks need it for smartcard based authentication. (Do not ask me why.) Also, me like this nice chromatic guitar tuner at www.seventhstring.com.

Re:Java in a browser? What? Why?

[Anonymous Coward]

Why would anyone want Java in their browser? I don't have the JRE plugin and would never install it. There's no need for Java to run in a browser. Desktop apps is a different matter, Eclipse and such are quite useful. And it's eminently practical on the server side. But in the browser? That's completely legacy, and Apple should just stop distributing the plugin for Safari.

My bank (and most others in my country) require Java for online banking (switching is not really an option due to debt).

More stupidity from Apple Haters

[SuperKendall]

- All the fanboys who lorded the "virus immunity" (I personally know of several).

Since it's not a virus, they have a point. Idiot.

No one has even claimed the system is immune from attack. Find just a single Slashdot post that claims that. Just one.

APL just does things better (despite it may be a hardware thing, like high DPI screens everyone has)

It's more about overall quality than any one feature. Idiot.

How many cases for other devices do you know have a gaping hole in the middle for the exclusive purpose to show the company logo?

Why would you want to use a device from a company you dislike so much you feel compelled to hide a logo? Who cares about the logo? Honestly.

Fashionista Idiot.

So yeah. From my perspective? They needed to be taken down a notch.

Well yeah. You are an Apple Hater. You are desperate to paint Apple with the most negative brush possible - even when it make no sense.

That technological tourette syndrome you have, to babble meaninglessly about Apple technology without understanding what you are saying - that is what makes you an idiot. And it will remain so until you can free yourself of an abnormal hatred of Apple.

I use Apple products, I like Apple products - but I also have an Android phone, and other non-Apple products. The Android phone doesn't work as well but I don't contort myself into technologically indefensible positions just to glorify one side and bury the other.

Re:More stupidity from Apple Haters

[Anonymous Coward]

Since it's not a virus, they have a point. Idiot.

Man, I'm tired of you Mac faggots trying to redefine terms so that you can blame Apple's security issues on the users. By the way, how does Steve Jobs' cock feel up your ass?

Re:More stupidity from Apple Haters

[exomondo]

Since it's not a virus, they have a point. Idiot.

You know what very few end users care about? The difference between the terms virus, trojan, malware, worm, etc... If it's any of them it's bad.

GoToMyPC on OSX

[Anonymous Coward]

Just disabled Java on a relative's MacBook, GoToMyPC now doesn't work...

Re:GoToMyPC on OSX

[Anonymous Coward]

Just disabled Java on a relative's MacBook, GoToMyPC now doesn't work...

Good. You should be using Screen Sharing (VNC) instead.

Re:Java in a browser? What? Why?

[gl4ss]

some banks need it for authentication just because the consulting contract went to asshats("and we got this extra layer of security by installing these native dll's on the users machine through running a java plugin! oh and by the way this way you can buy an iphone, android and symbian applications for mobile use, since the default netbanking solution will not let you login, sure it would work perfectly after the login but the login can only be done through this java applet, so it's really high tech buy buy buy buy").

however, java plugin can be a pretty snazzy way to distribute enterprise wide real sw that works on both macs and pc's and starts from the intranet page with one click...

"...all can do it," Cole Porter style

[Anonymous Coward]

'xploits - do it.
Worms - do it.
Even viruses and tro-jans do it.
Let's do it-- Let's fall in p0wn.

If you don't get it, go watch the movie Tank Girl, or just go here http://www.youtube.com/watch?v=0pvMCu_YeYU

Re:Java in a browser? What? Why?

[cmdrbuzz]

Why not just untick the 'Enable Java' checkbox under Security in Safari Preferences?

As the next Java update will put those plugin's back.

why is this not cross-platform?

[sl4shd0rk]

If you need to hit a link for the exploit, I would guess this is a malicious Java applet. What role does the browser and platform play then?

Re:Java in a browser? What? Why?

[gtall]

Because some of use have to use Oracle's webapps and those require java.

Re:Just be sure not to panic & delete the wron

[Guy Harris]

Yes, note the capital 'G' in the trojan plist file. Also, be sure to look in /Library/Preferences, and not /Users//Library/Preferences

The user name apparently got deleted from the pathname by the posting software; you presumably meant /Users/{your_login_name}/Library/Preferences.

... so it stops just when seeing Little Snitch?

[Herve5]

Thank you AC!
Having been a happy user of Little Snitch for years, I see apparently I don't even need to wait for it to warn me as the malware just suicides when seeing it :-)
Too bad LS doesn"t exist (yet?) on Ubuntu...
(the latter is no pun indended, but hope instead!)

End of an era

[Kaldesh]

And thus the end of Apple's 'security via obscurity' is coming to a close. It was nice while it lasted, but it's time to move on

Re:Those idiots at the fruity company

[Anonymous Coward]

Except that this requires NO user interaction which means it got superuser without asking.

This is a flaw in the base OS that happens to be abused from a Java application (since it's easier to exploit an online application then a local). Get your head out of the sand before it's too late.

Little Snitch

[Herve5]

My suggestion: install Little Snitch, a (non free but brilliant) system that'll alert you whenever *anything* on your mac wants to connect outside.
Of course you'll immediately allow browsers, mail etc. connect to html port 80 or pop servers.
But any other surprising attempt to join any unnatural place will be interrupted, with an alert to you, where you can allow or not (just once, up to quit, or forever) with extreme fine grain on destinations (aanywhere/just this port/just this port and address...)
Little Snitch is so efficient that I read an analysis of the last virus, who just deletes itself when detecting a "Little Snitch" folder on the mac!
H.