Slashdot Mirror
Game Theory, Antivirus Improvements Explain Rise In Mac Malware
Sparrowvsrevolution writes "Four years ago, security researcher Adam J. O'Donnell used game theory to predict in a paper for IEEE Security and Privacy when malware authors would start targeting Macs. Based on some rough assumptions and a little algebra, he found that it would only become profitable to target Apple's population of users when they reached 16% market share. So why are we now seeing mass attacks on Macs like the Flashback trojan when Apple only has 11% market share? O'Donnell says it turns out he may have underestimated the effectiveness of the antivirus used by most Windows users, which now makes overconfident Mac users a relatively vulnerable and much more appealing target. Based on current antivirus detection rates, O'Donnell's equations now show that victimizing Macs becomes a profitable alternative to PCs at just 6.5% market share."
How it security by obscurity treating you now?
So his equations show that he's still wrong, but differently. Good job!
We all know it's due to momentary lapse in prayers to the Almighty Jobs.
CC.
TaijiQuan (Huang, 5 loosenings)
It may be true, but user ignorance and social engineering will always be avenues of attack.
In all of the fights between Windows and Mac users over the disparity in viruses for both platforms, I've never seen a Windows user point out the fact that Windows is often used on infrastructure that is valuable to compromise. No major business runs their corporate infrastructure on Macs. No major sites with valuable data I know of are hosted on Apple hardware. What has changed with the marketshare is that now Macs are used by the upper-middle and upper classes extensively at work and at home. So even at 6.5% of the market, you're far more likely now to compromise a Mac with valuable data or access to it now.
Compromise a Mac today and you might get access to a corporate network, a richer man/woman's bank information, etc. That wasn't true 10 years ago.
Back in the 1980s, Macs were very tempting virus targets. They had multitasking operating systems at a time when the rest of us were running DOS or CP/M (although Amiga users and users of DOS multitaskers like DESQview had a small market share). Luckily this was before the internet, so the only real risk was downloaded software.
Perhaps the model wasn't off by much, rather the rate of mac growth being so high that 16% is already a guarantee with the current adoption/switch-over rate.
He says himself that the equation is vastly oversimplified, and a small change in antivirus detection range changes the answer from 16 to 6%. That means the equation is all-but useless and pointless to try to "predict" anything except, apparently, in hindsight.
I could have plucked any number I liked out of the air and wrote a (reasonable) equation to make it come out with whatever answer I wanted, even basing it on "game theory" (which has very, very, very little relevance here, actually) - I could have done that even before I graduated in mathematics (including Game Theory) over a decade ago.
When enough Mac's exist to make it viable (and market share has little to do with it compared to "number of computers active on the Internet" of that particular model), viruses will target them. Guess what, same for every other platform on the planet. If someone miraculously sells a popular device based on MINIX that millions start buying, eventually someone will write a virus for that platform.
Seriously - don't give it the press.
Which is why one of the selling points for Macs on Apple's website is that they're immune to "Windows viruses"
Let's see what our wise men can come up with:
1) Write a "scientific" paper, make assumptions, use some "algorithm", predict event A
2) Wait
3) Observe empirical evidence
4) Revise initial paper
5) Bask in peer admiration
Did I miss anything?
Now even you can quote Game Theory thanks to Stanford Engineering online course offerings!
come on fhqwhgads
After the 2013 NCAA tournament is over, I will show you a formula I have that would have predicted ALL of the winners of each game! (Pardon the wait, but I may have to recalibrate my formula in light of whatever evidence shows itself in 2013.)
Tis a feature, allowed by the Almighty Jobs as a test thy faith in Apple .. so only mayest the True Believers be granted the next iDevice.
Since the number of hosts a virus will likely infest grows exponentialy with the share of the population not imune to it (until that share reaches somewhere near 25% of the hosts), those anti-virus should make infecting a Windows machine orders of magnitude harder.
As usual, the press article doesn't include the actual equations. So, it is impossible to know if the study took actual infection spread equations into account.
Rethinking email
Step 1: Get infected
Step 2: Get your shit jacked
Step 3: There is no step 3
While I realize there may be some outrage over the "overconfident" label, it does make sense in terms of learned behavior. More specifically, Windows users have known malware has been rampant for so long that:
A) they're used to having to use antivirus, firewalls and other "security" type apps
B) Windows has steadily improved its built-in firewall and anti-trojan features to combat real and perceived vulnerability
C) Windows-based PC OEMs and system builders install anti-virus by default and have for quite some time now.
I can't say whether Macs get a/v software by default but despite our joking about macs not being susceptible to malware, that view is held by far too many mac users. While it might be true statistically speaking relative to Windows, it is unhelpful in being a rightfully vigilant denizen of this wretched hive of scum and villainy we call the Internet.
How exactly is OSX more secure than Windows 7, assuming both are patched and not used by total morons that click Yes to everything?
Security through obscurity is no way to go through life.
Apple has dominated the high end of the -personal- computer market at least in the US, making it a more lucrative target for attempts to steal personal information.
On the other side, is there any way to measure how easy/difficult it's been to develop successful viruses on platforms, MacOS, Windows (XP, Vista, 7, 8), various Linux distributions, etc?
"PC Viruses" actually.
Which makes little sense, since Macs used to run on PowerPC machines.
Probably failing to take into account the value of the targets compromised was the biggest flaw.
Since the average apple user will be far more profitable (apples are a luxury good and thus will have a higher percentage of wealthy users) to compromise than the average pc user, he needed to adjust the numbers downward to take that into account.
As evidenced by their "I'm a Mac" commercials, Apple used the formula "PC = Windows based personal computer" even though Macs are /technically/ PCs as well.
I don't know about your definition of secure...
They have less DISCOVERED flaws that's true. But it doesn't mean there aren't many which can be discovered and exploited.
And quite frankly their virus-response is crappy. It took ages for them to patch something that Oracle had patched a while ago. I think that's the main issue here - they needed a fire lit underneath them, and even then they worked sluggishly.
I'm not a fan of ether company, but one partially successful trojan later... and now OS X is deemed the number one target? i'd still trust OS X more than Windows. The perceived statistics here seem overwhelmingly skewed on this topic recently.
Virus, malware. 220, 221, whatever it takes.
Are you saying that Macs are not obscure now? Because, according to TFA, they only have 6.5% market share.
Or are you saying that they were never "obscure" but no one else had been able to compromise them on a mass scale because most Mac users did NOT run anti-virus software?
Or are you attempting to mock the person who's prediction failed and so he changed the numbers and assumptions until his prediction reflected the current situation?
Back in the 1980s, Macs were very tempting virus targets. They had multitasking operating systems at a time....
But that was not why they were tempting. They were tempting targets because it was REALLY easy to spread a boot-sector virus on floppy discs, even when you didn't hand out the discs yourself you'd just include it on a floppy disc image of some game or utility that was being pirated and it would spread like wildfire from that person to all friends...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
http://www.apple.com/why-mac/better-os/#viruses
Is this true? Yes, but only because the malware they are talking about was written specifically for Windows. It has nothing to do with the "built-in defenses in Mac OS X that keep you safe". It is at best disingenuous because the average user reads that to mean "Macs can't get malware".
Thank you SlashDot for attracting intelligent commenters/users. After reading the blogs and comments on other sites, I had lost faith that there were any intelligent people left. Apologies for not discussing the subject in particular... just needed to say it.
This is one of those things that drives me nuts. Everyone, learn your definitions.
From Wikipedia...
"A computer virus is a computer program that can replicate itself[1] and spread from one computer to another. The term "virus" is also commonly, but erroneously used, to refer to other types of malware, including but not limited to adware and spyware programs that do not have a reproductive ability."
Note the words REPLICATE ITSELF. To date, not Mac malware has done this. Drive by installs and trojans are out there, but it drives me nuts when people don't classify these things correctly. The generic term is Malware.
I am an Mac user (Mac Administrator to be exact), but I squarely put the blame on Apple for this latest trojan. Java was patched a month before the latest Flashback variant came out. If I was a malware developer, I too would go after Java on the Mac. Apple has always been lazy about issuing these patches after the Windows versions. Hackers then just reverse engineer the latest Windows Java patch and boom, you know how to exploit it on the Mac. Apple's fix, disable Java. Lazy.
Mac users, stop being smug about security. The point of this article is dead on. The only reason we we're not attacked before is because of Market share. It had nothing to do with the Mac being superior to Windows (although it is in other regards, had to throw the fanboy line in). Any OS is vulnerable to malware. More often these attacks are becoming targeted at stupid people. I personally have been concerned about the growth in the Mac market share because it was obvious these attacks would become more frequent.
Anti-virus would not have helped with Flashback, as it spread before any AV client would have picked it up. The best things you can do as a Mac user is:
1. Patch your machine regularily
2. Demand Apple get more serious about these kind of things. They are slowly moving there, but it is always better to be proactive. Mountain Lion with code signing will go a long way to protecting the lay user.
3. Think before you put your password in. If something doesn't look right, don't ok it.
4. Avoid sites that you don't know or trust.
5. Turn off Java except when you need it. This is the number one problem on the Mac as to my point above.
I'm a Mac user, but I have to call this one the way I see it. You, my friend, are an idiot. Malware is a computer problem, not a Windows problem.
EVERY MAC USER LISTEN UP....
MACS ARE NOT IMMUNE TO MALWARE.
I can't stand when mis-informed Mac users stand up here and say we are immune. You make the rest of us who have a clue, look like idiots. If you don't know what your talking about, don't add anything to the discussion. Just read and learn til you have a clue.
http://www.theregister.co.uk/2011/07/21/mac_os_x_lion_security/
http://blog.laptopmag.com/mac-os-x-lion-vs-windows-7-which-is-better/9
http://www.eweek.com/c/a/Enterprise-Applications/Apple-Mac-OS-X-Lion-Bests-Microsoft-Windows-7-10-Reasons-Why-647298/ (slide 4)
http://gadgetwise.blogs.nytimes.com/2011/07/29/lions-upgraded-robust-security-features/
I think you get the point... all of these I found on the first 2 pages by Googling "lion security vs windows 7".
As evidenced by their "I'm a Mac" commercials, Apple used the formula "PC = Windows based personal computer" even though Macs are /technically/ PCs as well.
Yeah, but pretty much everyone else does too. Heck, the original article does it! I see 5 posts on this page that are also referring to windows machines as PCs and Macs as Macs.
There are two ways to read the GP's quote. Guess which one most Mac-heads use?
I am John Hurt.
Two examples I've ran into:
Limiting it to just people who have IT experience that I know:
(1) One person literally told me that it is impossible for a mac to get a virus.
(2) One has said that, since he uses Chrome and MacOS, he can't get malware, period.
That's maybe 10% of the MacIT people I've dealt with, the rest have been in the 'it is less likely' camp.
From the non-IT Mac users, it's closer to closer to half, that fall into one of those (or similar, change the web browser), categories.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
It's a factor insofar as it is part of the process of turning Macs into status symbols. Price alone is just one variable; it's the price factor which separates the product from the hoi polloi who couldn't stomach a $2000 professional laptop when a $500 meets their needs easily. It's everything from the packaging, to the build quality and taste, to the marketing and product integration.
Macs were always expensive, but 10 years ago, they were more of an eccentricity or specialty than a high quality replacement for a Windows PC for most people with some money.
Everything you say is worthless because you possess no capacity for personal introspection. You are completely incapable of turning a critical eye to your own sacred cows.
You want to compare track records? MacOS X, since its inception as NeXT, has been around since the late '80s.
Only now, in 2012, are we seeing the first widespread outbreak of malware. I don't buy the installed base argument. If Mac developers can make money off of the platform, then malware writers sure as hell can, too - more, with its exclusivity, it means they have a large pool of potential targets largely to themselves. I think Apple's willingness to gut and rebuild their systems when desired, and to ruthlessly deprecate old revs, a feature some users and devs absolutely hate about the company, has done more to thwart malware writers than anything else.
Lots of zero-day exploits out there, but very, very few of them survive the next Software Update. This is rough for malware, which relies on crufty old code surviving =years= past its sell-by date, which is pretty common in the Windows world (How YOU doin', WinXP?)
In the latest round of Macageddon (the ONLY round of Macageddon), we have either ancient and unsupported Macs targeted by APT, or an unpatched Zero-day sploit Apple took a loooooong time to fix. Don't get me wrong, Apple made a boo-boo of Kodiak Bear proportions, but I don't think this is an opportunity for AV and Anti-Spyware and firewalling and other security-scam vendors, and it's not the herald of a new age of mass Mac attacks. Instead, it's a signal Apple needs to make sure this stuff is properly sandboxed in future revs, and critical security updates moved on early and quickly.
Why would they give the Windows brand any recognition? Mentioning your competitors by name advertises for them.
No such thing as bad press - and all that.
APK
P.S.=> Linux Security Blunders DOMINATE in 2011-2012, despite all /. "FUD" for years saying "Linux = SECURE" (what bs that's turning out to be, especially on ANDROID where it can't hide by "security-by-obscurity" anymore & is in the hands of non-tech users galore - & EXPLOITS ARE EXPLODING ON ANDROID, nearly daily)
... apkLinux
Nice roundup of articles, but at the end of the day anyone that uses a blanket statement like "Linux = secure" is as stupid as anyone that says Macs are virus-proof.
I know Linux server admins, and all of them take security seriously and acknowledge they are as vulnerable as any other OS if you just lay back and look at them pretty. You have to make sure they are updated, secure, and properly configured for your needs with minimal permissions granted to processes that need them.
Mac have no A/V stuff on them by default. Apple does do some anti-malware fighting on a per-item basis these days with updates, but there's no A/V program as you'd normally think.
You can get them, but they don't come installed, and Apple doesn't have or recommend any because they are interested in admitting that viruses are now a Mac thing too. Some of the major A/V vendors have Mac versions. Kinda hit and miss as to which companies have decided it is worth it to port to the Mac. Sophos is one I know does (it is what we have at work, I hate it with the fire of a thousand suns, but I can say it has a Windows, Mac and Linux version).
Flashback is not a virus, it's a trojan. This is sort of like saying to someone who bragged that they don't get skunks in their neighborhood "Well, after those coyotes ate your dog, I guess you'll be taking that skunk problem a lot more seriously now!" Viruses and Trojans work completely differently - one infects programs and data files, then spreads all over your computer when you access those files, and the other is a program all of it's own that hides and sneaks onto your computer, then runs separately. Viruses infect your files, Trojans invade your whole system (and generally don't attach themselves to individual files).
/slam head against desk
Difference between Virus and Trojan:
Trojan disguises itself, pretending to be something else, to get into your system (named after the Trojan Horse.) A program that says pretends to be a photo file (with a jpg icon) or pose as an antivirus installer would count as a Trojan.
Virus simply activates and goes into your system when, lets say, you insert a floppy disk or visit a website. As long as it can infect a machine without the user opening it up, it's considered a virus.
The last java based Flashback was a virus, not a Trojan.
It required the user to do something, in particular, provide a password.
So run an Apple II.
Sure, it may seem like a pain, but I'd wager the number of malware for the Apple II is quite low. That, and those 5 1/4 floppies last forever.
It doesn't matter the platform. Mac, Windows, Linux. Stupid users get viruses. They're the ones clicking on every farking attachment in every farking e-mail they receive without first doing a simple visual check of the email (ie. reading it). They're the ones downloading executables from unknown or untrusted sources and running them on their computers. They're the ones that believe every little farking web browser pop-up informing them that their computer is infected and THEY MUST CLICK HERE NOW!!!!! (Hint: web browser != anti-virus )
The first variant did. The second did not.
Just hit up the previous Slashdot Flashback article and you'll see the article title that specifically said that it could go "without user interaction." -- i.e. it was a drive by that installed itself without user interaction.
Sounds like a virus (by anon's definition) to me.
I have a different interpretation: Trojans are applications that pose as legit programs (like codecs or games) that trick you to run the program. Viruses (trojans being a subset of viruses) is any software that was specifically written to do bad stuff (delete files, spam, etc). This may or may not be with user interactions.
So why isn't Linux getting tons of viruses? Presumably "they" don't care about your myspace account so this isn't a home computer. "They" only care about corporate stuff, much of which is hosted on Linux now. Even if Linux isn't on the desktop, surely there would be Linux viruses piggybacking on Windows viruses.
But they aren't, so you have a hole in your logic.
If your next argument is "but they don't need to be," then you're arguing against yourself---Windows systems are the compromising factor, and you don't even need to compromise your secure systems ... you just need a Windows user on your network.
/slam head against desk
Difference between Virus and Trojan:
Trojan disguises itself, pretending to be something else, to get into your system (named after the Trojan Horse.) A program that says pretends to be a photo file (with a jpg icon) or pose as an antivirus installer would count as a Trojan.
Virus simply activates and goes into your system when, lets say, you insert a floppy disk or visit a website. As long as it can infect a machine without the user opening it up, it's considered a virus.
The last java based Flashback was a virus, not a Trojan.
Not only did it require the user to provide a password, as oh_my_080990890 points out, but even if it hadn't, it still wouldn't be a virus, and it still would be a trojan. Trojan versus virus is not a case of "happens with or without user interaction". Viruses infect files - VBS viruses can even infect .html files (ie: Code Red and others from a while back), or image files, or anything else, but they do need a file there to infect, of whatever type of file that virus is intended to infect. Yes, the boot sector on a floppy disk is also a type of file. Trojans pretend to be some other type of program, and get the user to run them - in this case, by being a Java applet in a web page, which of course means that if you've shut off Java running in your browser (I do because it annoys me. The only site I commonly use that wants to run Java is my work webmail, which oddly works better with Java disabled completely...) it's not a problem, regardless of your operating system, and it's not a virus, it's a trojan. Even the article Tharsman (at ars technica) linked to calls it a Trojan, and not a virus. Same with the initial article way up at the top.
The Mac people (and their advertizing) have been saying "We don't have viruses", and they're still right. (For now.) Regardless of the coyotes eating people's dogs, there still isn't a skunk problem.
Linux on the other hand, actually does have a virus available - there were several slashdot articles about it a few years ago, provided by a security researcher at an AV company. In order to get it to run, you need to install a specific version of the Linux kernel, and then apply a patch kindly provided by Linus Torvalds after he analyzed the code to figure out why it wouldn't work for him. It takes advantage of three separate kernel vulnerabilities which, sadly, never all co-existed in the kernel simultaneously (unless you install the patch). Much like just about everything else fancy at the time (expensive video cards, TV tuners, ...), getting the virus to actually work required re-compiling your own kernel.
In the past we used to think that we were totally safe because in the past most hackers were like Dogs and didn't "shite where they sleep". but now we are among the rest of you realizing that the new generation of hackers are a truely dogs, and eat their shite after they poop it......
MacOSX, because making *NIX better is a lot better than waiting for Micro$loth to fix Windows
Funny, the same could be said about Windows machines too.
Most Tuesdays, I get this "Malware Removal Tool" in my list of Windows Updates. I also have an antivirus that blocks known malicious viruses often the same day they're discovered. And, yes, I'm running Windows XP. No, I haven't had a virus attack in a long time.
I don't buy your argument.
Think about it this way: most malware writers these days are made to either: set up a command and control client, or spam ads (either by random popups, or by forcing redirects). Why would you write a program that does 10%? It's just like Android now: some companies don't offer an Android version of a game (or delay it by order of months) because Android users are a bit more tight-fisted with their wallets. Devs can make more by selling free-Flash-game newgrounds quality games for 99 cents than by advertising, despite it being roughly the same thing.
If you skip all the marketing fluff and read the technical claims, at best, those articles say that Lion has finally caught up with Windows security-wise - ASLR, browser sandboxing and file encryption have been there since, what, Vista?
Tough to take your comment seriously when the first link talks about ASLR (available on Windows since Windows 7). The 2nd is a blog that talks about full file/disk encryption for the Mac and then about Microsoft's Security Essentials, which aren't even the same thing -- and declares MacOS the winner. The 3rd is about gestures.
3 strikes, you're out. I didn't bother reading the 4th link.
--Jeremy
Jesus was a liberal
According to you, the "true, factual statement" is that Macs aren't susceptible to thousands of Windows viruses, thanks to built-in defenses in Mac OS X, which also "protect" it from thousands of perfectly legitimate and useful Windows applications: It can't run them.
You have to understand one thing that makes Linux better than the rest; they practically show why it is secure by providing source code. Security by obscurity is a myth but security by having a large market share and an open process exist. Both Windows and Linux routinely do security audits and provide updates in a timely fashion. Linux have the advantage, because everyone can audit as oppose to one company. Apple does non of these things, so one day they will have patch many of their applications and actually care about security.
What the Hell are you talking about?
Show one virus (actual virus) that managed to do any noticeable harm (not just was uploaded to some hosting service) on Linux. Then shut up because there is no such thing.
Contrary to the popular belief, there indeed is no God.
Could it possibly be that the whole idea of calculating at what market share Apple users will get attacked is a tenuous theory and he was lucky to even be within 5%?
Currently hooked on AMP
link 1 harps on and on about ASLR while basically saying they've caught up now, disk encryption (on Windows), and Sanboxing in browser, without saying it's better than MSIE. Essentially, the article lists ways it's better than previous versions of OSX, and concludes it's Windows 7 Plus Plus
link 2 once again mentions browser sandboxing and ASLR, also says Windows 7 relies on 3rd party software (which having good 3rd party software available for is a bonus I guess). At least they make a point though
link 3 slide 4 says "Of course, part of that is due to the fact that more malware is created for Windows 7. But that doesn’t matter. If the security of each platform is taken into account, Lion must get the nod." with no real explanation
Link 4 says the same stuff.
All of these links lead me to believe that as far as engineering goes, they are now equivalent, rather than Windows being ahead. I'll give a nod to really liking the Windows 7 UAC slider bar where I can set how it behaves (I prefer system access, no screen dimming, but pop-up present).
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
boy, there was a slight chuckle when I read that.
Problem is... everyone is getting all butt hurt over stupid semantics. Virus and trojan cannot be compared, because one is payload, one is methodology.
Here is a really simple sentence that in summary, to anyone intelligent, would end all of this.
[Potentially] every computer/OS combo and variant is susceptible in some form or fashion to have code executed with or without specific intent and resulting in undesirable effects.
Right? I didn't say any of the "bad words". So, everyone agree? Good, let's end the bickering.
-AI
For me, it is far better to grasp the Universe as it really is than to persist in delusion
As Lord Kelvin (yes, as in K the temp unit), said, in remarking about Physics,
a) all of physcis boils down to reading a dial
b) a number uncertain to an order of magnitude is wrong
So this guy is off by only 2.5-3Xover a few years; not wrong, but not right, either
That's true. And Windows has mostly caught up to the Mac and other UNIX systems by finally having sane default permissions for user and program directories rather than most developers assuming they can write to disk wherever the hell they want as if they were Administrator/root all the time. While it was theoretically possible to set that up even under Windows XP or earlier, the process was excruciating for all but the most advanced users, and software developers didn't make it easy even if you tried. The transition to sanity started with Vista, and by Windows 7 it's mostly okay. It took them long enough to learn lessons about multi-user systems that UNIX has had since the 1970s, and OS X since its inception (and NextStep before that). So, yeah, OS X has been a little slow catching up to some of the newer security techniques, but Windows has been decades behind the curve on the *basics* for a lot longer, and let the problem fester for years, which was part of the motivation for bringing in kludgy "innovative" hacks like UAC first introduced with Vista. How hard is it to realize that not running as root is a good idea? And why the hell did it take so long for it to be something regular users could *actually* implement by default without creating loads of problems for half the programs out there?
Please explain why this news item is news, and why after (how many years?) Microsoft hasn't managed to fix the virus problems on the Windows platform. When you need a monthly "malicious software removal tool" I think it's a big sign that things are out of control.
We've heard for years that it's because of marketshare that Macs don't have virus issues. Mac users still don't have virus issues -- although sure this is a flaw in Java (a piece of third-party software not installed / enabled by default on any recent Mac) and has since been corrected.
If, in the future, Macs begin to really get viruses then Mac users will purchase and use AV software just like Windows users. It's just not a big threat right now, and that's why this whole thing is news.
Anything can be made to fit explanations after the fact. This article reads like the bubble heads talking about the causes behind financial market movement. They're clueless and it's all bullshit.
Start here. Now, go clean up that egg on your face, and tell us what antivirus software you use on your Linux systems. Or did you buy into the bullshit Linux marketing claim that "you don't need antivirus software because it's inherently secure"?
If the Linux foundation can claim that the inherent security of the Unix design is all you need to keep your Linux box safe, why can't Apple claim that the inherent security of the Unix platform is all you need to keep your Mac safe? And if it's bullshit marketing with the Mac, what makes it not bullshit with Linux?
This "lack of viruses" on Linux is simply because it has fuck-all for desktop market share, and you dipshit FOSS-bots are just as complacent as you accuse Mac users of being.
The Windows AV market is saturated so the AV companies are all about talking up the Mac and Mobile malware scare ...
AccountKiller
Oh this is egg? I was hoping it was your hot load.
Please explain why this news item is news
Which one? The links that you gave?
nd why after (how many years?) Microsoft hasn't managed to fix the virus problems on the Windows platform.
The "virus problem" on Windows is not an OS issue, it's a user education issue. So long as users keep opening random links, and click "Yeah, OK" on any warning prompts the OS throws their way, they will keep getting viruses. This is true on any OS, and just as true for Macs - it's just less exploited for them because their userbase is lower, and so it makes more financial sense to write malware that targets Windows, because the absolute number of clueless users who'll run it is greater.
There's exactly one way you can handle this problem, and this is by not allowing users to run arbitrary software, period - aka the "walled garden", iOS style. That is actually coming to Windows, at least in its ARM incarnation - unfortunate as I find it myself.
If you disagree with my reasoning, then can you give some reasons why you believe Windows is more susceptible to malware? If you claim it's due to some security issues in the OS itself, then please go ahead and point out specific issues that make Windows malware easier; then we can debate those. As it is, I haven't seen any specific claims other than the cursory mention of ASLR and browser sandboxing, which have been in Windows for far longer than it has been in OS X (and, in any case, they're both means of mitigating the impact of an exploit, rather than preventing exploits as such - and neither is bullet-proof).
We've heard for years that it's because of marketshare that Macs don't have virus issues. Mac users still don't have virus issues
And Macs are still below 20% in market share... what's the point you're trying to make?
we know it's you, commodore_64_love
troll with an IQ of 64 anyway
The problem with Linux (and I run a Linux box at home) is that there are far more options for pilot error, and fewer canned solutions (*). Mac box, I keep it up to date, I run Little Snitch, I keep /Applications protected, I disable the usual attack vectors by default (browser Java, Flash, Adobe Acrobat, auto-open of allegedly "safe" content). If things get suckier, I look into anti-virus. The steps to take are pretty obvious.
(*) No doubt there ARE canned solutions. I'm motivated and intelligent, but busy. They never showed up on my radar.
But Linux, I think I am no longer running the latest rev of Fedora (I'm at 14), but it's not offering to update. The autoupdate for the various software bits quit offering me new stuff (did I accidentally bork a configuration file, or is this just life with Linux?). I'm not running the latest Firefox, it downloaded an update, and now what? It doesn't self-install. It's just this blob of bits, and I'm supposed to do something with it, but what?
The second problem with servers is that they are by design exposed to the internet, and much of the software that speaks to the internet is non-friendly in its configuration (Apache docs are a mess. I'm not touching sendmail.)
It didn't. It attempted the user to enter a password to dive deeper into the system, but it was perfectly functional without the extra priviledges.
No doubt you were, friend. No doubt you were.
But when my hot load smacks you in the gob, it's gonna be so forceful that your momma's gonna taste it, too. You'll know the difference
Two totally different things. PC referring to a computer has no relation to the Performance Chip.
Maybe You are to young.
Its not invented by Apple and it has a history. "PC-compatible" was used for hardware and asoftware in compliance with Microsoft OS on Intel (-like) CPU.
Much due to the fact that IBM renamed and also developed "MS-DOS" in the name of "PC-DOS"
Hence, PC is not, an abbreviation of any generic personal computer.
Well - to be fair to Apple - this statement WAS broadly, more-or-less true, back in the Windows XP (vs OS X 10.1-10.3-ish?) days. With Vista, and the UAC feature, (as a default) it became less true, and more of the numbers-game that it is, today.
In the Mac OS 9-ish days, of course, Macintoshes were a security clusterfuck, and only enjoyed their security via (extreme) obscurity. Nobody wrote malware for Amigas either.
Well - statement 1, used to be, actually true. It just is now, demonstrably, no longer true.
Was it ever TECHNICALLY true? Nobody had ever PROVED it. But you and I know, that it was not, likely, ever true. But IN PRACTICE, it WAS true, that it used to be impossible. Simply because there was no such thing as malware written for Macs. It was a true statement. It implies a technical impossibility. That's ignorance. Well, those IT people were just ignorant fucks. I'm a hardcore (ex) Mac fanatic, since OS 7, and on my Macs, I mostly use best-practices, not ignorant statements. I *know* that the security gig is UP. It's still an inherently safer system (due MOSTLY to the obscurity, and partially, to the better architecture, over Windows - but Apple has been making some pretty awful mistakes in that area, so I think those days will soon be gone;)
Long-term - one must understand that best-practices are your only hope. And given that most users, by nature, CAN'T implement best-practices, in the long run, we're all basically fucked.
So the linux virus was nothing more than a proof of concept.
Flying cars have been proven as a concept, by the way... guess how soon most people will be driving one?
File under 'M' for 'Manic ranting'
That's just BS. Apple makes a half truth "A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers.", The second part of the statement is an out and out lie, there is no possible reading of the second half of the statement that can be taken as factual. "That’s thanks to built-in defenses in Mac OS X that keep you safe, without any work on your part." This is a LIE. They are safe from windows malware because OS.X doesn't run windows programs, there is no built-in defense keeping a Mac user safe. Even if you ignore the outright lie the whole statement is misleading to the people that malware defense is most valuable too, i.e. the uneducated user, the one that doesnt't know why OS.X can't get a windows virus. Personally I am suprised the false advertising laws haven't jumped up and bitten them in the arse on that statement in many countries.
Those are not viruses.
Contrary to the popular belief, there indeed is no God.
From fellow Mac users everywhere, your friends in the the MacIT world are:
(1) Stupid.
(2) Stupid.
Meh. I don't use AV software on my Windows 7 pc and have pretty decent results. If I can get away with that, there's no way in hell I can convince myself AV is needed on my Macs.
what antivirus software you use on your Linux systems
...nor antivirus software would be of any help against exploits, or against trojans installed by administrator. "Antivirus software for Linux" is actually software that runs on Linux but looks for Windows viruses.
Linux system's security can only be improved by removing, not adding software -- what should be true for any system, but false for Windows due to its massive brokenness.
Contrary to the popular belief, there indeed is no God.
Neither is the Flashback trojan, champ. It uses a flaw in Java to run automatically *as the user.* It then requests the root password from the user, in the guise of an installer package; the user MUST enter the admin password for the payload to be downloaded. That's a trojan, not a virus.
And yes, there ARE viruses in that list, but keep on proving my point - Linux is just as vulnerable to malware as Macs, and the Linux Foundation is actively encouraging complacency on this front by telling users "you don't need a/v and security software, because Linux doesn't get viruses." Which is exactly the same line you're trying to slag Apple for using.
Neither is the Flashback trojan, champ. It uses a flaw in Java to run automatically *as the user.* It then requests the root password from the user, in the guise of an installer package; the user MUST enter the admin password for the payload to be downloaded. That's a trojan, not a virus.
Flashback is a virus/exploit -- at least one variant exploits the Java sandbox vulnerability and runs as a non-sandboxed application on the system without user specifically installing it.
And yes, there ARE viruses in that list, but keep on proving my point
Sure, there are. They just DON'T WORK. You can just as well bring up the original Morris worm.
Contrary to the popular belief, there indeed is no God.
The real target opportunity is more complicated than most people say.
1). You need a large enough pool of machines to make the malware authors time worthwhile;
2). The loaded software is of varying quality. Some platforms do better on GA release quality;
3). Administrative attention matters. Some platforms (and some industries) have better patching records than others;
4). Don't want to overstate this, but a malware author is theoretically at risk by their activities. Some industrial sectors might be more dangerous to attack;
5). Malware is mostly designed to extract money these days, either directly or indirectly. Therefore the commercial opportunity of the target systems matters;
6). Malware authors need some knowlege of their target. Could be anything, technical, psychological, industrial, whatever. If the malware authors cannot find and exploit their target, there's no security event.
Flashback is a trojan. It is not self-replicating, and it requires specific action from a user to infect a computer - namely that you browse to an infected server, and that you have java installed & java applets enabled. Oh, and you also have to supply your administrator password for infection to happen.
Plus, if you really want to push to declare it a "virus," well... it can also infect Linux systems that haven't patched the Java vulnerability that it exploits. So there's another example of a virus in the wild that can affect Linux!
So again: when will you be installing antivirus software on your Linux desktop system, and what package will you choose? We're all very eager to hear!
The one that fits your version of "idiot Mac user" reality is not the one I have ever encountered in real life.
Oh, and you also have to supply your administrator password for infection to happen.
As far as I know, only in earlier versions, and it certainly managed to get out of sandbox using exploit, not by asking the user. If it was just a web page "Install this executable, it's Adobe Flash!", there would be no brouhaha about security.
Contrary to the popular belief, there indeed is no God.
/slam head against desk
Difference between Virus and Trojan:
To most people the difference is blah blah blah blah it's a Virus.
Perhaps he searched on Bing!!!
The thing is... while neither of those statements is theoretically true (and Flashback shows it), for the last 10-15 years, they have been *practically* true.
How many mac users do you know (prior to this incident) who had a virus?
We all knew (or should have known) this would eventually change. But a whole decade where it was impossible to get malware specifically because there wasn't any written for your platform (hey, it's impossible to get Halflife, too) is a pretty good run, and a strong selling point, given the number of Windows machines I have had to clean out over the years.
Mac owners tend to occupy a higher-income demographic, increasing their attractiveness to criminals. Would you target someone with a $500 bank account or a $50,000 account?
This factor helps Linux, with its third world popularity, but complacency is always the Devil's playground.
You do realize, do you not, that /. admins have unlimited mod-points and are not shy about nuking your worthless posts straight to -1 where they belong?
You also realize that the "Flag" icon that they created makes it very easy to bring your posts to their attention?
And finally, you realize that by "admin" I am referring to Samzenpus, Soulskill, Timothy, etc., not your average /. user who's been given a handful of modpoints?
And Macs are still below 20% in market share... what's the point you're trying to make?
Browsing through his comment history, he appears to be more of a disgruntled MS admin, and less of an Apple fanboy. He likely works among an inept group of individuals with no political support from his office, and therefore no ability to implement functional resolutions, because they either cost money or make it difficult for the sales staff to play farmville, angry birds, or whatever the flavor of the month is. MS is the outlet upon which he unleashes his wrath. =D
He actually has some good and insightful comments, but whenever Microsoft is brought up, his comments take on a more hostile tone.
You completely ignored the questions and directed an ad-hominem attack at me because "(I'm) not an admin & shouldn't speak for them".
Sorry for the late reply.
User or computers? Several dozen. A few years ago (2006? 2007?) a there was a virus (never got the name) that went around a department in the unviersity that has a lot of Mac users.
It's not that there was no malware, just that it was rare, back then.
Prior to that, I worked in a different department, and every year or two we had to clear out some new virus that got half the Windows machines. So, yeah, Windows is worse, I just got sick of the blanket statements of technical ignorance from some of the Mac users.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
http://apple.slashdot.org/comments.pl?sid=2800343&cid=39748051