STATIC DISCLAIMER: All the stuff in here is purely my opinions, and they tend to change depending on what mood I'm in. If you're going to get bitter if I say something about you that you don't like, then maybe don't read. I avoid using names as much as possible, and would request that people who know me do the same in their comments. Basically, I often vent my frustrations on here, so if you happen to be someone who frustrates me, expect to read a description of someone very much like you in here!

Wednesday, July 18, 2007

Mac OSX: Success breeds malware

It’s always been claimed by Mac advocates that the lack of Mac OSX malware was not to do with the fact that malware writers were logically targeting the largest OS population, but rather was to do with the fact that OSX was inherently more secure.

It seems that with the rise in the population of OSX users, people are starting to exploit it, proving the previous assertion false.

Reading this article, this vulnerability is equivalent to the one that allowed the infamous Blaster worm on Windows to propagate – that is, a remote exploit that gives the hacker root access to deploy any code they wish to the compromised system.

My company has numbers of clients who run Mac servers that are open to the wider world sans any kind of firewall. We even have one I know of that you can get remote access to their server without a password. We've advised them that's a bad idea, but they believe their Mac will remain secure. It's a product of the misinformation by Apple that because presently there are no major threats, that the situation will continue. Hopefully, people will begin to realise that being under the radar only provides you security while you're small enough to fit there.

If you use a Mac and you're reading this - be smart. OSX is not magically all-secure. Firewalls and virus protection are good, good things.

@Nathan: I certainly wouldn't describe this post as "whiny". Maybe "gloatish"? lol.
@Frances: More mind-bent philosophy/less computer-nerdish technobable post is coming soon, I promise. :)


Nathan Zamprogno said...

My response is "la, la, la. Not listening, not listening, not listning".

Not good enough?
Look, Mac OS-X is inherently more secure than Windows. Here's why:

If Macs have 10 percent of the market, and malware is proportionate to market share, why doesn't OS-X have 10% the number of viruses? You're making news about a single proof of concept vulnerability that hasn't made it into the wild. Compare that to the literally thousands of viruses that plague Windows and which require a massive industry of anti-virus software companies to try and cure.

No one should be suggesting that Macs are so invulnerable that admins can afford to put them on the net without firewalls or passwords. If a clueless sysadmin thinks their Mac can do that without attracting bad attention, then it's a sign of ignorance on their part, not a bad reflection of the state of Mac security.

Mac security is not based on being "under the radar" of virus writers. Nor is it based on the notion that script-kiddies with nefarious intent are more likely to attack the "uncool" Windows and favour the "cool" Mac platform as a gesture of solidarity against Microsoft. OS-X is based on Unix, whose own security credentials are well proven.

When a security hole is found (and no constructs as complex as a modern operating system can ever be considered bullet proof), Apple patches it. So do Microsoft. Big deal.

We're talking about one potential hole. There have been others. They were patched. This one will too.

Consider that more than 90% of the spam you and everyone receives worldwide are a result of viruses infecting Windows computers and turning them into spambots. How much press is given to the massive cost of lost productivity and wasted bandwidth this causes when the blame can be laid as much at the feet of Microsoft and their shoddy code, as on the spam-originators themselves?

No, the Mac is indeed not magically all secure. It is, however, significantly superior to Windows, in every respect.

Frances said...

Promises, promises!

Tam said...

Funnily enough, I ran my laptop for 3 days before realising I had no firewall or antivirus, and nothing came of it...

Not only that but I've never recieved any spam, even in the early days of internet maill with a reputation of poor filtering (hotmail). Though it did get hacked a fair bit...

And while on the subject of Mac vs PC (which seems to be a common thread on this blog :) some of you might be interested in this article:

Justin Warner said...

I'd written a long post, explaining the faults in your arguments (the "Why isn't there 10% of the malware?" one I believe is particularly flawed), but I've decided not to post it, and instead just link this in response.

"No, the Mac is indeed not magically all secure. It is, however, significantly superior to Windows, in every respect."

And anyone who says otherwise, PREPARE TO DIE!!!!

Nathan Zamprogno said...