Beware iPhone Users
Apple is under attack more frequently these days. That would seem to support the latter theory. Popularity comes with a price. The more popular your platform and applications, the larger the target on your back. The Register reports that malware is circulating disguised as an iPhone application. To be fair, this is not directly an attack on Apple. The Trojan is simply leveraging the explosive popularity of the iPhone and iPhone apps to lure users into infecting their systems.
The same report from The Register though also discloses information about a more direct threat against Apple. Vulnerabilities have been discovered in both QuickTime and iTunes. The bug, rated as a High risk vulnerability by US-CERT, does not yet have a patch or update available from Apple.
Comments
You did read the comments over at The Register, yes?
The whole article was taken to task by both PC users and “so called” Mac fanboys for being completely misleading.
“Apple fans besieged by iPhone Trojan and iTunes attack.”
Who are these “Apple fans” of which they speak? That would be PC using Apple fans which is where the Trojan is singularly aimed at. If you are using a Mac then there are no issues whatsoever.
Yes. Did you read *my* whole post? I specifically pointed out that the Trojan exploiting iPhone popularity is aimed at Windows users.
That is not to suggest that it couldn’t affect the Mac, but again- if I am a malicious developer trying to make money I am targeting the more popular platform. If you get paid per kill, would you choose to hunt common ground squirrel, or rare albino alligators? Mac (and other Apple products like iPods and iPhones) are gaining in popularity and the target on their back is growing- but they’re still a very small fish compared to the whale called Microsoft.
That also doesn’t take away from the iTunes / QuickTime flaws or other critical security flaws which have been identified and patched in Apple products recently which, whether they impact Apple or Microsoft (or both) platforms are still a function of Apple developers.
You are totally wrong.
While I agree your argument of the popularity theory is partially right it is not the ONLY reason for a lack of viruses and other security britches on the Mac platform.
While the Mac OS is by no means 100% secure, no software is. It is however more secure then Windows which you seem to deny, correct me if I wrong.
A simple example to this is, when any major system change or and application is needed to be installed, the Mac OS prompts an administrator password request, like a security guard if you will. A feature which Windows lacks.
One scenario is if I was to let my friend use my Mac OS and he for whatever reason wanted to install an application, he will be asked for the system password as soon as to clicked the install button and will be unable to continue without my password (permission). This works in exactly the same way if an application was download from the internet and tried to install itself in the background without my knowledge.
Secondly if the Mac OS has 5% (estimate) of the worlds market, shouldn’t there be say at least five percent of those 14,000 or so viruses created for Windows each year. Do you really think that when those 14000 or so are being produced by Crackers/Hackers not one of them is thinking of the Mac, not a single one. Really?
Furthermore do you think every single Cracker is doing it for only financial gain and not for glory? Because if it’s glory their looking for what better title to have and be able to say “I created the first Mac OS X virus, of which they said cannot be done”. If you look at the media coverage the Apple/Mac platform get he/she will be a recognised figure overnight, even above the likes of DVD-Jon.
No incentive of the Mac? Really?
Please educate yourself in the subject matter if you want to have a shot at us ‘Apple fanatics’.
Wow.
OK. Let me start by saying that I appreciate you visiting my site and that you took the time to comment. I hope you will return and I hope you will not only learn some things, but also continue to contribute.
That said- please educate *yourself* before replying with condescending, and incorrect accusations about whether or not I did *my* homework, because *you* are “completely wrong”.
Let’s take your points one at a time:
First- you are correct in stating that I disagree with the premise that the Mac platform is more secure. How are you measuring? Total vulnerabilities? Critical vulnerabilities? Are you counting peripheral flaws like web browsers, media players, or music software? Because by all of those measures Apple has as many or more vulnerabilities.
Microsoft releases bulletins once a month and they are up to number 55. Apple has released fewer updates, but those updates are carpet bombing updates that deal with a plethora of vulnerabilities. Just 6 days ago Apple released a Highly Critical update for the Mac (http://secunia.com/advisories/31882/) which addressed 30 different critical flaws.
I hope you aren’t so deep in your delusion about Mac’s ‘inherent’ security that you haven’t been applying the patches and updates. Mac, Safari, Quicktime, iTunes, etc. have all had their fair share (or more) of flaws and critical vulnerabilities.
Second, the security feature you describe *is* part of Windows- just not XP. Part of the security functionality of UAC performs the actions you describe. Ironically, Apple has spent millions on commercials making fun of that same feature rather than recognizing that Microsoft finally got a clue and took some steps toward more Unix-like security (which Mac is built on) and enforcing least-privilege user access.
Third, no it does not make sense that if Mac has 5% marke share they should have 5% of the viruses. Researching vulnerabilities and developing successful malicious code to exploit it takes the same time and effort regardless of the number of systems in the potential exploit pool. So, no sensible malicious developer would invest the time and effort for a 5% chance at a return when they could invest the same time and effort for a 95% chance of return.
Lastly, the days of glory-hacking and script-kiddies are all but over. So, no, I do not believe that anybody would waste their time and effort just to make a name for themselves. Besides, only a cracker who has lived under a rock would waste his time or effort to be the “first” person to write a virus for Mac OS X because it was already done more than 2 years ago (http://www.sophos.com/pressoffice/news/articles/2006/02/macosxleap.html) and a number of times since then.
My points, and my post still stand.
Yada yada, whatever. In the real world, we Mac users don’t have to slow our systems down with email scanners, anti-spyware apps for our web browsers, anti-virus programs that run constantly in the background etc etc. Incidental as this may be, I personally have been running Macs on and off the internet since System 7, and have never, that’s NEVER had a spyware/worm,trojan/virii issue. Period. And you’ll find (if you do your homework) that that is the case of the vast majority of Mac users. Just because your world of PCs is riddled with this crap,don’t think it’s everywhere else. It reminds me of someone who lives in a ghetto thinking that gunshots are a normal sound in every neighborhood. Sorry, but I’ve been in that “neighborhood”, and couldn’t wait to get back out, and the neighborhood is the Windows/PC environment.
But again, I believe that is a function of swimming in the small pool- not the inherent security of the software itself. A search of critical vulnerabilities from Mac OS X, iTunes, Safari, QuickTime, etc. will support that they are not ‘inherently secure’.
So, if you never applied any of the many critical security updates put out by Apple, the software would, in fact, be swiss cheese. The fact that you don’t feel the need to protect against attacks exploiting those flaws is based on the fact that nobody is attacking the small pool.
Also- your assumptions and comparisons again seem based on Mac OS X vs. Windows XP. Vista does alleviate most, if not all, of the concerns you list. My computers are behind my router firewall, but I don’t run any additional tools to protect my system and I have never had an infection or compromise on a home PC whether running 2000, XP or Vista- nor has my wife or kids.
I used to be network administrator and technical support at a company with about 25% Mac users. They did not have malware or security issues, but they still had just as many hardware / software glitches and failures. Also, I can’t say if its the norm or not, but I have more friends using Mac’s than PC’s as their primary computer and more often than not they are using a “fallback” PC while their Mac is in the shop for one reason or another.
I never said that the Mac is not a solid operating system, or that other Apple software is not solid as well. I do not mean to disparage Apple. I am simply pointing out- factually so- that there are flaws and vulnerabilities in Apple software as well, and that it is my opinion that the relative ’safety’ of Apple hinges on being in the small pool.
I guess we’ll have to agree to disagree.
I think we’ll just have to agree to disagree.
My apologies for the condescending way in which I expressed my view of your knowledge of Apple, after reading your post I however still feel you need to re-evaluate your viewpoint in the reason for why the Mac is ignored in security issues.
I believe it is a combination on issues that makes the the Mac a more secure environment for its end user, your argument by attributing the Mac’s low market share as the single reason shows where the ‘fanatic’ attribution should be bestowed. As only a fanatic deals in absolutes.
Though I am a ‘Power User’ and do have all the latest security update on my primary machine due to my use of Apple’s auto update reminder, I know of many friends and family who don’t and have yet to call me up regarding a security issue. Suffice to say I really am not that intimidated of my Quicktime crashing or being terrorised by zombie icons on my desktop, as apposed to say the horrors Windows users face.
Regarding the password feature I spoke of in which you say Windows has implemented please explain to me where or how, as I am unable to replicate it (Vista or XP). I inserted a install disk in the Mac OS click install and a password request pops up. Though Vista has tried to replicate that same security feature in Vista it is not comparable to the security strength to the Mac’s implementation, for if I do the same thing on Windows I am able to install without any password knowledge of this system whatsoever. Do you “Deny” or “Allow” this statement.
Now I can give you links to counter your number of security issues on Mac verses the Windows platform, or what belongs to the Open Source parts of the Mac and what belongs to the propriety parts. Weather the included software vulnerabilities should be couldn’t as part of the OS too, or why Leap-A is not a virus (dispute the fact that security companies tell me it is and I should buy their security products). As this could go on forever and it has been since the dawn of (IT) time. I will however ask you at what percentage do you think the Mac will have enough interest to see a major security breach on a mass scale, namely a (undebatable) virus as witnessed on Windows?
As then and only then will we know which hypostasis was correct, and with the pace the Mac is growing in it wont be long.
I also disagree with your statement that Money it the only motivator, just look at the Open Source community of which I cannot delve into detail due to a lack of time (sorry I’m not a blogger, I have my own business to run).
Regards,
P.S
One last thought the Mac OS Classic (8/9) had 9 viruses yet it had less market share that Mac OS X.
There is a big difference between reported vulnerabilities, exploitable vulnerabilities and exploited vulnerabilities. Microsoft plays fast and loose with their vulnerability patch numbers. Don’t hang your hat on their number comparisons.
Let’s ask why none of Apple’s reported vulnerabilities have been exploited until Apple’s patch to fix that vulnerability has been reverse engineered.
Let’s ask why every widely publicized Mac exploit has needed both physical access to the exploited Mac and the Admin password for that Mac. Anyone can exploit their own computer.
Every platform is vulnerable to Trojans. The critical numbers with Trojan exploits are the IQ numbers of the computer user.
The final question we should ask is why no OS X virus has ever infected a Mac in the wild.
Is the Mac too scarce? No, the Macs running OS 6 to OS 9 all got viruses, spread mostly on floppies, and they really were scarce. It’s a lot easier now with the new Mac popularity and the internet.
Is the Mac too hard to program for? No, there are free programing tools with every Mac OS. A new programing language probably has to be learned but once you know one…..
No, all signs point to the fact that it is much harder to write a self replicating virus for a Mac vulnerability than a Windows vulnerability. Could it be that the Unix kernel that OS X uses is much more secure than all the legacy code in the non peer reviewed Windows kernel?
No, Unix can’t be more secure than Windows. It can’t be that simple.
I seem to recall that more than one virus was released for Vista while it was still in beta. At the time there were a few tens of thousands of machines running Vista (IIRC). This would seem to be a counter example of the scarcity argument. That small number of systems could not constitute even 1% of the market.
On the other hand perhaps these were beta viruses being tested in anticipation of Vista’s eventual release.
I was hoping to read a reply from the writer (Tony Bradley) on my and AL’s counter comments to his. But this may or may not be due to that fact he’s busy with other arrangements.
I would however would love to hear the reasons why if market penetration is the sole reason why Mac OS X has not seen a virus then why is it Mac OS Classic had viruses despite it having a low market share then Mac OS X.
Leap-A that Tony mentioned was not a virus for various reasons, in either case it was a proof of concept. Some Cracker was trying to create a virus to prove it can be done but it was killed early in the wild without ever managing to spread to more then a few computers (due to the low IQ level of those users) nor was it ever complete. One reason for it’s lack of multiplication was because user interaction was needed for it to execute (password prompt), again due to the Mac OS X security strength.
This goes against Tony’s view and shows there is interest in the Mac OS (or at least from that Cracker) yet we’ve never seen a more advanced version of Leap-A, a Leap-A for example that replicates without user interaction or knowledge, now why is that do you think?
Another thing to note was Leap-A never did anything, there was no evidence of any attempted financial motive. Yet even though it only managed to spread to a few computers out of millions and did nothing it managed to get as much if not more media coverage than a real virus of a Windows platform.
P.S a simple google search will give you virus names for various other platforms like the Plam OS or BeOS. All of which have far less market penetration then the Mac OS X and Crackers are hardly likely to make any money (or status) whatsoever from them.
BeOS? Most people reading this won’t of even heard of this OS, that’s how rare it is. Your more likely to bump into Bigfoot.
JT- First, there are no reporters and editors here- just me. I write my own stuff. I edit my own stuff. On a purely technical level, I agree with you that “hacker” is more of a benign term for someone who is more curious than malicious. However, on a purely technical level, a “cracker” is also not an accurate description of a “malicious hacker”. I addressed this very issue- the use or mis-use of the word “hacker”- 5 years ago in my article “What’s In a Word?“