Slashdot Log In
Computer 'Worms' Turn on Macs
Posted by
CmdrTaco
on Mon Feb 27, 2006 10:08 AM
from the here-they-come dept.
from the here-they-come dept.
Carl Bialik from WSJ writes "Macs have been laregly immune to the viruses, worms and malware that have plagued PCs, but the Mac's recent popularity uptick has meant that 'bad guys appear to be casing the joint,' the Wall Street Journal reports. Among the signs: two recently discovered worms and the discovery of a vulnerability in Mac OS X that leaves Safari open to a hack. A Symantec engineer predicts a 'gradual erosion' of the idea that Macs are a safer operating system than Windows. 'Some security experts believe hackers are becoming more interested in writing nasty code for Macs precisely because of reports of its relative immunity to security woes,' the WSJ reports. 'Apple itself has gone out of its way not to promote the Mac's relative safety, lest it tempt hackers to prove the company wrong. Apple declined to discuss the topic of security in depth for this article.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Symantec? (Score:5, Insightful)
Now there's a neutral party with no agenda when it comes to security!
Honestly, the worst Mac malware I've seen so far had a Symantec sticker on the box.
Re:Symantec? (Score:5, Insightful)
Parent
Re:Symantec? (Score:4, Insightful)
So yea symantec sales would be slow.
Parent
Re:Symantec? (Score:3, Insightful)
Re:Symantec? (Score:4, Insightful)
Parent
WSJ: "What the rich want you to think." (Score:5, Insightful)
It's completely unacceptable that Slashdot editors would post this garbage. From the referenced article:
"In the past two weeks, information-security companies like Symantec Inc., Sophos PLC and McAfee Inc. have identified several security issues related to the latest version of Apple's Mac operating system, called OS X. Among the concerns: two "worms," programs written by unknown hackers that were designed to spread themselves to other Macs through Apple's iChat instant-messaging software and Bluetooth wireless-communications capability."
Translation: Some public relations drone, with no technical knowledge, paid the Wall Street Journal to post the article. The Wall Street Journal is a "What the rich want you to think" publication, and, in my experience, usually unreliable for anything useful. Note that the article jumps from subject to subject rapidly, apparently to hide the fact that there are no actual incidents of Mac infections to report.
Another translation: Symantec, a maker of very buggy security software of poor design, and other "security" companies want Mac users to buy their products.
Some people, in my opinion, spend their entire working lives being dishonest, trying to trick other people. In my experience some of them work for WSJ.
-
Cheney's company is rapidly [nytimes.com] building prisons [halliburton.com] for the U.S. government.
Parent
Re:Symantec? (Score:5, Insightful)
I use iChat every day, and have other Mac users on my "Buddies" list, yet I've still yet to get this particular worm delivered to me, and it's been well over a week since I heard about it being "in the wild." There was even a story about it over on Drudge, so somebody must have been hit by it, right? Yet, I still have yet to hear a first-person account of somebody getting this particular worm sent to them.
Part of the reason for this might be that the Mac gives all kinds of warnings about the nature of incoming files, and even requires that you type in your admin password before running anything that hits any important part of the OS. (Hint: just installing an application or performing trivial tasks does not require a password. Whenever you get a password prompt on a Mac, you know that the app in question is trying to do something which requires root-level access.)
Installing antivirus software on a Mac is worse than useless. Should a virus ever come along which can get past both MacOS security and simple user awareness, currently-existing anitvirus software won't be ready for it anyway.
Plus, I know enough from running antivirus software on my Windows PC at work (which I would never DARE go without) that anitvirus software means a performance hit and less stability of the operating system.
I think I'll just stick with common sense and Apple's frequent OS update patches.
Parent
Re:Symantec? (Score:3, Informative)
Re:Symantec? (Score:5, Informative)
Nearly ever OS X user on a single-person machine runs as admin, and that's what Apple sets up by default. But it's not a bad idea to reocnsider.
Parent
Re:Symantec? (Score:3, Informative)
Actually, the reports [ambrosiasw.com] were clear that it doesn't require a password. The reason is that it only modifies iChat.app, not any system files. An admin user has read/write access to /Applications, no authentication necessary. Try it yourself (modifying /Applications, that is, not running the worm).
You're absolutely right that admin != root; but nor is it quite as blind, deaf and dumb as an unprivileged user.
Immune? (Score:2, Interesting)
Just because no one has exploited a system doesn't mean it doesn't have exploits. I know about a month ago this came up in an article about how OSX/Linux users could face issues because they felt to secure. Hopefully they will be able to cut this off at the quick but don't think that running an "obscure" OS makes you safe. How many Mac users today run anti-virus software?
Re:Immune? (Score:5, Insightful)
*sigh* We don't. We think running an operating system with proper security makes us safe.
Parent
Re:Immune? (Score:2)
Re:Immune? (Score:4, Insightful)
I haven't seen any compelling evidence that Linux or MacOS X are more secure than Windows is against the twin threats of malicious software and badly trained users. They're all based on similar security ideas, which just don't cut the mustard. A better security model [plan99.net] does exist, but it's not implemented in any desktop operating system today.
Parent
Re:Immune? (Score:2)
Running anti-virus software is a stupid thing to do when you can FIX the system instead.
Just because Microsoft is at the "fix one bug, re-create another" stage doesn't mean Apple has to go the same road.
An analogy - would you rather eat fresh, properly prepared food, or moldy infested crap and a megadose of antibiotics? (I would have used the "would you rather have sex with someone who isn't infected with HIV, or someone who is, but you take *precau
Re:Immune? (Score:3, Insightful)
What's the phrase? There is no patch for human stupidity?
Go ahead, be smug about it. But the bottom line is that as Mac becomes more popular you're going to have idiots who are going to let thing thru simply because they don't understand what they're doing. Do you really think that Windows user who keep their systems up to date and use a bit of common sense are the ones you're reading about? Windows is insecure in a l
Re:Immune? (Score:2)
Basically it all comes down to being smart when using your computer. First and foremost is never run anything in any sort of admin mode unless absolutely necessary. Most mac users create an admin account and use it for everything they do(and I hate to admit I am one of those), that i
Re:Immune? (Score:3, Insightful)
Hopefully very few. With the current state of affairs, anti-virus software for the Mac is a case of the cure being much worse than the disease. Even these recently discovered worms and the Safari vulnerability are relatively benign and can be protected against with a little common sense. In fact, most users hopefully are already safe from the Safari vulnerability since the "Open Safe Files" option was already the source of another vulnerability a while ba
not a worm or a virus! (Score:5, Informative)
Re:not a worm or a virus! (Score:2)
Any such program could say that it just needs you to enter your password so that it can perform its miracles on your system, and let you have a faster compurer without paying for it.
Everyone wants something for free, and there are enough average users that don't know any better.
The social engin
Re:not a worm or a virus! (Score:5, Insightful)
The difference between the security hole approach and the social engineering approach, is that the latter starts and ends with stupid users. The worm cannot force its way onto the computers of more savy users like the RPC worms in Windows did. Instead, it will set off a huge number of warning flags with more experienced users, and perhaps prompt them to take action to clean other user's computers or encourage them not to run anything that asks for their password.
The end result is that such viruses could not spread as fast or as far as their Windows counterparts.
Parent
Re:not a worm or a virus! (Score:3, Insightful)
Pretty nasty IM
Re:not a worm or a virus! (Score:5, Funny)
I don't get it. I tried running the "rm -rf
Maybe I should try it on my Windows machine next? Shouldn't I type "C:\" instead? Or, is this script not that portable?
Parent
There's always Linux... (Score:2)
Turn on (Score:2)
Learn what a @#$(*&^ worm is! (Score:2)
Worms are very different than viruses. Don't mix them up! It's not that hard!
I disagree with this (Score:5, Insightful)
Why would criminals care if Apple succeeds? (Score:5, Insightful)
Considering that the main incentive for virus writers these days seems to be economic (profitable criminal activity such as spamming, phishing, DDOS blackmail, identity fraud), it seems unlikely to me that these criminals care if Apple succeeds. More likely, the profit motive isn't there, probably a result the combination of greater security on OSX, and smaller installed base.
Parent
It's a proliferation problem... (Score:3, Interesting)
All of those require infection of a system, which requires the virus/Trojan/worm to copy itself from one system to another. The increasing number of Macs creates more dead-ends for a proliferating virus.
Imagine two situations. In the first, everyone is using a Wi
Terminology (Score:2)
I guess this will test ... (Score:3, Insightful)
I.e., will these worms affect the whole computer because of a fault in the operating system, or will they affect only a single user on the computer because of a software issue that let the worm in to play in that user's space, or will it affect people only because of user stupidity ('ooh, really, clicking on this will make my pen0r bigger!')?
Note that Microsoft gets critical security issues fairly often with their approach.
The recent Apple issues have been lowest rated security issues.
Certainly I think that not having users run as root by default will help Mac OS X, but that doesn't stop them entering their password when prompted.
You can't secure against user stupidity except by scanning each file that they try to execute for viruses. And that means virus checkers, and the associated slowdowns they bring.
Childishness (Score:2, Funny)
Using google images as a definitive source, I tried the following searches
Microsoft worm
and
apple worm
Surprisingly the Microsoft one was filled with warning messages and exclamation marks and maggots.
Meanwhile the apple one was all cutesy and cartoony and fluffy (some of the worms even appear to be wearing turtle necks)
The world will continue to turn.
Consider the source (Score:2)
Well, yeah... Symantec has kind of a vested interest in gradually eroding that idea, don't they?
Lets be fair, folks (Score:2, Insightful)
A computer is only as secure as its maintainer.
It's not that Linux is secure (Score:3, Insightful)
It's not that Linux is secure. It's that Windows is *insecure*.
Microsoft had a long period (perhaps over?) where they introduced *horribly* insecure designs -- making decisions that completely ignored security in the name of any shred of functionality that they might gain. (And those designs still affect us today.) Double-click execution of executables in email, using their full-bl
Re:Lets be fair, folks (Score:5, Insightful)
Now is it right for me to say that my linux computers are more secure just because they are running linux? No, that's stupid.
Why is that stupid? There are real architectural, operational, testing, and implementation differences between Windows and Linux. Obviously one of them is more secure and less likely to be compromised than the other. There is nothing stupid about looking at those differences and at the track record of both OS's and making predictions and making usage decisions based upon that information. "They're all the same," is the argument of a lazy man or someone trying to justify a bad choice by trying to make all choices look equally bad.
The same thing applies with this story - Macs can be exploited because that is the nature of the business. We usually find the holes because some numbnut exploits it.
No one is arguing that Macs can't be exploited. They certainly can be and are. We do not, however, find most exploitable holes by seeing exploits in the wild. The majority of holes are discovered by developers coding the products. The next largest chunk are found by users and legitimate security researchers. Then a few are found when they are exploited in the wild by hackers. How many zero day exploits have their been for Linux or OS X? The answer is very, very few if any. There have been some for Windows, but most of the underlying vulnerabilities were probably discovered by MS, but they just did not get around to fixing them.
Sure there will be exploits and even zero-day exploits for OS X, but they are just not likely to spread widely or be much of a problem for the average user. If they are a large threat they will be well-known and quickly fixed. A major worm for OS X would be news and it would be unusual. For Windows it is business as usual.
But don't assume that just because no one has broken into your house yet that your house is completely secure.
This is a very good analogy. My house is concrete block and was built with only glass block windows on the first floor. Actually the block is two thick on the first floor. Before I bought it, someone had wired a security system and outdoor flood lights. A few months back someone busted into my shed, but ran off without getting anything. The items in my shed are relatively large an not all that valuable.
I'd say that is a good analogy for OS X. It is built with security in mind on well tested, industrial grade framework. They have added onto it and made it more secure in some ways and less secure in others, but it will likely never be as insecure as the neighbor's ranch style place with two plate glass doors and a key under the mat that you see the kids get out every day.
OS X had someone break into the shed (try to distribute a trojan) but nothing has been taken. It is a good sign that maybe Apple and OS X users should be paying attention and maybe doing some more security reviews, but it is in no way comparable to the apartment complex down the street that have been burgled at least once a month for several years and where we always hear about people getting shot.
Parent
Faulty reporting (Score:2)
They are not "targeted" due to their small market share. They are also not targeted due to the fact that they keep changing OSs, processors and whatnot such that any Mac (OSX PPC, OSX x86, OS9 PPC, OS9 Moto) is a subset of an already small market share.
Windows is a huge bullseye due to is truly massive installed base. Linux will be the next target.
Mac OS X in the malware picture? (Score:2, Funny)
It's not that Mac OS X is "virus-proof" (Score:5, Insightful)
Even if Apple magically pulls some sort of super OS-jujitsu that reverses their market share and Microsoft's, the basic architecture will stay the same underneath - and that means Apple will have their relative advantages intact for the foreseeable future. Windows is, as its heart, an OS that has traded off many security options for ease of access and ease of programming. Apple had the advantage of seeing what was already happening to Windows when they made their decisions about how OS X would be designed, plus the system it was derived from was pretty robust to begin with.
There will be viruses that attack Mac OS X. Some will do a pretty good job of attacking. I'm kind of surprised it's taken this long to get there. But I'm also not expecting it ever to compare to Windows in that regard.
Wired article re: Mac security (Score:5, Interesting)
From the linked article:
Man bites dog journalism (Score:4, Informative)
OS X exploits are news only because they are unusual (though it does serve as an early warning, I sincerely hope Apple is busy auditing their code base). The fact that they are not as severe as Windows exploits, requires more user intervention and are often limited in scope are not discussed or probably understood by most people.
Argh, what crap (Score:4, Insightful)
The guy who wrote this article doesn't know what he's talking about. "Worms" spread without any user interaction -- they can infect millions of machines on the internet in hours. Those are the kind of vulnerabilities that got Microsoft in trouble in 2003. Viruses require user interaction to work. All the "vulnerabilities" described in the article require the user to install a program and it's trivially easy to be destructive once you have the user's trust.
In addition, virtually all the vulnerabilities described by the article are local ones -- meaning a malicious person needs access to the machine. Truly dangerous vulnerabilities offer remote access, which means any random hacker on the Internet can control the machine from afar. AFAIK, none have been discovered in most Linux distributions or OS X. If OS X did ship with remote vulnerabilities, THAT would be huge news.
The only relevant part of the article comes at the very end:
Many viruses and worms, for instance, don't exploit security holes in operating systems. Instead, they use what are called "social engineering" techniques to trick users into doing things that they shouldn't do, like unwittingly installing programs. The Anna Kournikova worm from 2001, for example, infamously tricked Windows users into installing it by masquerading as photos of the leggy Russian tennis star attached to e-mails.
Rather than weaknesses in operating systems, such approaches exploit "a bug in peoples' brains, which is much harder to patch," Mr. Cluley says.
That should have been the lead. The rest of the article is idiotic.
Old security hole, shared by Windows & Firefox (Score:3, Interesting)
The only worms I've seen announced for OS X so far have depended on social engineering attacks. Social engineering attacks are possible on any OS, because they work by convincing a user to do something. They're basically the same kind of "security hole" as the one the folks claiming to be an exiled dictator with a bundle of cash...
The central security hole* found is one that was discovered almost two years ago, and Apple has refused to fix. That security hole is the use of the desktop shell interface to run programs to display untrusted content. As I wrote at the time [scarydevil.com] this is fundamentally insecure, and yet the native browsers and third party ones still do it.
This is the same kind of error as having a browser on UNIX run an external viewer for a link with code like this:That would be a security hole you could drive a truck through, because you don't know what the shell is really going to do with whatever the URL contained. Maybe it looks like benign.pdf?";curl http :
Well, Safari doesn't really know what the shell (LaunchServices) or the app it calls is going to do, either. It's not quite as obviously bad as the above code, but it's subject to the same kinds of attacks. As has been shown multiple times already on both OS X and Windows.
What's safe?
Well, there's two options.
1. Safari can maintain its own database of safe applications to pass unsafe files to, and call them directly rather than through LaunchServices.
2. Apple can provide an alternate LaunchServices for unsafe content that ONLY contains applications that are explicitly designed for handling unsafe content, or alternatively add an option to LaunchServices saying that the content is unsafe so it can use an alternate database.
Here's some options that have been tried and don't work:
1. Maintain a list of file types and suffixes that you consider "safe", and only use LaunchServices to open these files (Safari and Firefox and IE do this).
2. Modify LaunchServices to try and figure out when an application is being launched on an "unsafe" document, and ask the user if they really want to do this (Apple's 'fix' for the original hole, which has already failed twice).
3. Maintain a list of locations that are "safe" and "unsafe", and only allow dangerous actions based on the location (Microsoft's Security Zones).
So far Apple's tried two of these, let's hope they don't try the third.
* Exacerbated by two other holes: making "Open Safe Files" the default, and considering archives to be "safe" files.
Macs will never catch up (Score:3, Funny)
Works both ways... (Score:3, Funny)
They will only be able to demonize Mac's for so long, until people realise that they are harder to exploit on a large scale because they come with less insane defaults.
BTW, if you really REALLY want to fuck up your Mac install... install some Symantec products. A serious downgrade.
Re:They could report a worm a day ... (Score:3, Funny)
We already know Microsoft's answer, but how does Apple deal with bugs in Mac OS 8 and Mac OS 9? (And does anyone still use Mac OS 7?)
Re:They could report a worm a day ... (Score:3)
Totally irrelevant to what I had posted. Also, again, they already know that their new code is also going to be just as subject to viruses as their old code was - that's why they're including an anti-virus. Microsoft can't make a reasonably secure operating system. Its not part of their culture, nor part of their technical capabilities.
Re:Hooray Social Engineering! (Score:2)
Go to a command window and type "sudo rm -rf /".
Re:Popularity decides if an OS is secure. (Score:4, Insightful)
The situation just isn't as simple as you believe it to be. Sure, the number of people who use an operating system tends to have a relation to the number of people who develop for that system and also the number who have the skills necessary to create a virus, trojan, or worm. But there's more to it than that. Windows, although it's getting better, and hopefully Vista will be much better, has architectural issues that make it easier to exploit. It also has consumer-targeted development tools which have the sole intention of lowering the bar to new programmers. Combine these two, and you have a societal petrie dish ripe for creating malware authors - not only are there more people using the OS, but there are proportionately more people capable of writing malicious software and a system that is easier to exploit.
If the Mac had 95% market share, there would certainly be more malware, but the situation would simply not be as bad as it is for Windows right now.
Parent
Re:Popularity decides if an OS is secure. (Score:5, Interesting)
Far be it for me to shatter your little bubble, but Apache Web Server is more popular than IIS, and has significantly less critical exploits.
God, it feels like Karma whoring just pointing out something so bloody obvious.
Parent