Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Apple

"Experts" Say Macs Are Not Safer Than PCs 128

Posted by pudge from the and-i-say-that-the-middle-east-is-a-great-vacation-spot-this-year dept.
MoneyT writes "As reported at vnunet, experts are claiming that Macs are no safer than PCs in terms of protection from a virus. Seems more to me like they're just saying that we Mac users aren't invulnerable, but until I see things like nimda taking out my Mac, I'll stick with the iBook." The article doesn't mention that the "7,000 macro viruses" attack Microsoft products (leaving uses of a Mac only as a web server completely protected from them), nor does it quote any statistics about how many Mac vs. Windows viruses exist, and it doesn't address the real- world fact that Macs are hit with viruses far less often than Windows machines.
This discussion has been archived. No new comments can be posted.

"Experts" Say Macs Are Not Safer Than PCs More

"Experts" Say Macs Are Not Safer Than PCs

Comments Filter:
  • "and it doesn't address the real- world fact that Macs are hit with viruses far less often than Windows machines."

    Well the real world fact is that viruses work based off the ability to infect other machines. Odds are pretty good of finding another Windows box in a random scan compaired to a Mac box. Plus you now have two seperate operating systems on a Mac to write for, not just one like many common Windows viruses. (OS 9 and X). If Apple had say 45% OS market share, I'm sure there would be many more Mac viruses rampaging across the net.
    • Ah, you mean Win3.1 viruses would always work on Win95, and Win95 viruses would do on NT and 98, and those for 98 would work on XP ...

      Sure, the reason why somebody wrote Code Red was that there are so many IIS Servers. But why is it still around? Because of inherent vulnarabilities. Sure, there is a fix. But some people still haven't used it.


    • If Apple had say 45% OS market share, I'm sure there would be many more Mac viruses rampaging across the net.

      I hear that argument from Windows users all the time and I'm sure there's some truth to it. I mean it's obvious. But there's another part to the story. The part where Microsoft makes many of it's software products in an extremely vulnerable way in order to "give customers what they want."

      Case in point. Why are Word, Outlook, Excel, PowerPoint, Access, etc all able to open programmable documents which could contain potentially malicious code? In plain english, the way they've chosen to impliment scripting and macros makes them dead-on guilty of making extremely vulnerable products.

      Do you remember back in the days before such things existed? Before the concept of the "macro virus"? How many virii were there back then? How vulnerable did you feel? What percentage of Windows users even had virus protection? And most importantly, don't you think it's strange that everyone just accepts this? All for the sake of the 0.02% of macro-writers out there.

      So yes, there would be more Mac virii if there were more Macs, I buy that. But there would be less Windows virii if MS didn't knowingly and repeatedly sell fundamentally insecure software products.

      So please don't lull yourself to sleep with the old "there are so many Windows virii because there are so many Windows boxes out there." Rather, wake up and realize that Microsoft has decidedly turned away from security in favor of whiz-bang features that look good printed on the software box.

      And please pardon the shrill, crazed tone of the above. I've been holding that one in for a while I guess.
      • You took the words right out of my mouth. I've written legitimate Word and Excel macros (most of which wound up being incompatible the moment people upgraded to the next version), and there's no question Microsoft's implementation of macros makes it way too easy to write virii.

        I wonder why nobody's done an Access virus yet? Access is unique in the Microsoft canon, since startup macros are often genuinely legitimate applications. Therefore, shutting macros down in Access would harm functionality.

        Since most people with Office have Access lying around somewhere, I would think an Access virus would be a sure thing, and yet I haven't heard of one yet.

        Just a matter of time?

        D
      • All for the sake of the 0.02% of macro-writers out there

        While not many people write macros ad-hoc, the document "OnLoad" or "Autostart" type functionality is used by a large portion of the market. This is due to large corporations who tie their document management system, or custom Excel toolbars into all documents via this mechanism. MS biggest fault was not in giving it's customer this much needed functionality, it was in not requiring the macros to be signed before invocating by default. This was a lesson they learned the hardway.

        But you can't look at a limited market like Apple has and say "See, if only MS had done it this way". Because Apple would have bent over to the large corporate customers as fast as MS did.

        When a 200k seat install customer calls you up and says "Look, we need a way so we can tag all our documents, and each time they get loaded check to make sure a newer version doesn't exist in the document management system...." you're going to do whatever you can as fast as you can for that client.

        Don't forget MS and most other companies were BLINDSIDED by the internet. When MS thought of security, they thought of closed loop networks and the 'security' of Dial-In/RAS on NT boxes. They didn't think of mail worms, or MS Word based virii. Unix came from an environment where it was second nature to worry about being rooted. Windows did not. Two OS, built for two very different purposes, and grew up in two very different neighboorhoods. One's poor and street smart, the other rich and oblivious to the dangers out there.
        wake up and realize that Microsoft has decidedly turned away from security in favor of whiz-bang features that look good printed on the software box


        ..cough..cough.. A/UX... cough cough

        Anyhow, thats just the troll trash in you talking. Seriously, you give MS too much credit, in them knowing the danger the future held for their features. You have to think of WHEN the built these features, and how new they were to networking security in general. My guess is most of the deadly code was written in 1995. Legacy support carried it in all versions from then on. MS biggest achiles heel is legacy support. But it's how they managed to keep their install base, and grow it.

        Also, MS software engineers, like most other software engineers, put too must trust in the end user. This used to be a common pitfall for all sorts of software. When MS Office went mainstream, it took millions in usability study and mentoring of the Office architects to convey to them just how stupid most of the users are. It wasn't until they understood that did we start seeing dialog boxes pop up and ask "Are you sure!?!?!" which up until then was a GUI no-no (see Inmates Are Running the Asylum).

        Look over the CERT advisories and some Virii databases for the past 10 years, and you'll get a sense of the number of software packages that had (in hindsight) blantently dangerous features. Hell, look at all the holes and security failures in CISCO software. The backbone of the Internet.

        And apple isn't immune. What's scary is, for the most part, Mac users know less about their OS then windows users (partly because the OS does such a good job at user-friendliness). My friends that use Macs are mostly in Graphics/Design/Publishing. They are a social-engineering nightmare in terms of protection for trojans. Luckily, so far, they are rarely targeted.

        • Re:Less demand for viruses, not less feasable... (Score:2, Insightful)

          by Anonymous Coward
          I take issue with the statement that most mac users are generally less computer literate than windows uers. It is my experience that most mac users are at least slightly more IT literate than your average Windows PC owner.

          Don't forget we're talking about a 90-95% market-share here for Windows, and it's my experience as an ISP support engineer that has drawn me to this conclusion.

          I supported macs and pcs side by side, and without exception the complete no-hopers were PC users.

          Most mac users tend to have macs for work, and make it their business to know at least the basic System maintenance tasks to ensure their livelihood.

          The fact that the average (traditional) mac user's fascination with their computer's inner workings stops there is not an indication of ignorance, more that the computer itself is not the toy, it's the creative tools that run on it.
      • Also not that there are many many more people who hate MS and write viruses with the sole purpose of embarrassing MS. I suspect especially now with the Darwin kernal most people with the skill to write a virus probably won't do so because they have nothing against the company and can do a lot more damage to the immensely more evil MicroSoft with the same effort. Why go after the good guys?
    • OK ... so? That is just admitting that real-world experience is such that Mac viruses are less prevalent, which is what I said. Sure, market share is a big reason why. But the "experts" -- who exist in this story only to scare Mac users into buying their product -- said the opposite, that the risk for both platforms is the same. It's untrue, by any measure.
  • It doesn't matter if you own an amiga, you can still get anthrax or the flu etc from either computer if somebody else has been touching it with icky hands and you use the same keyboard!
  • Was this commentary done with OS/X, or earlier versions? I would expect OS/X to be considerably more resistant, given a true multi-user base, where the default userid is not 'admin'.

  • Now there's an unbiased opinion... (Score:5, Funny)

    by jspayne ( 98716 ) <jeff AT paynesplace DOT com> on Wednesday May 29, 2002 @10:41AM (#3602217) Homepage
    Antivirus firm Symantec said that over three quarters of Mac users are under the illusion that they are not a target for virus writers and hackers. Well, in that case I should rush out and buy some Antivirus soft...hey...waitaminit.. Jeff
    • I seriously doubt these findings. Yes, any computer can be infected with a virus - and Macs of either platform are no exception.

      The difference is accessability. Microsoft has several exploitable problems in it's OS, not the least including operating system integration with it's web browser, a default email client which can execute items by previewing them, and a word processor that can transmit virii via documents. Solutions to the problems seem to be non-existant or overkill. (Write-Protecting Normal.dot, and the new Outlook rejecting certain files based on attachment)

      The first line of virus defense, however, is always the user - and unfortunately, most users are unaware of even when they have a virus. My cousin, who had a laptop, had icons moving all around the screen on her, and didn't know that she had a virus until I told her. Even then, she has not bought and installed antivirus software, although I tell her of the seriousness of the problem.

      Brian
  • The larger the user base the more prone your system is to viruses. That is not the real problem when dealing with them, it is how the respective platform handles the situation when it does happen that matters, and I think MS has a bad track record on that.

  • Fear, Uncertainty, and Doubt strike again (Score:3, Insightful)

    by kalidasa ( 577403 ) on Wednesday May 29, 2002 @10:42AM (#3602223) Journal

    Just Symantec trying to boost sales of their Macintosh product. I use a Mac without MSOffice, and I almost never use IE (I use OmniWeb, Chimera, or full Mozilla instead), and only use OS X (don't use Virtual PC). None of the viruses they're talking about (except maybe Sub7, though all but one of the SubSeven viruses listed in Symantec's only encyclopedia are said to affect .exe files - not a Mac problem). Sure, there are probably a few Unix vulnerability that could hurt me, but compared to the 1 copy I get of Klez.H per day, I feel much safer on my Mac.

  • what are they talking about? (Score:4, Insightful)

    by RealisticWeb.com ( 557454 ) on Wednesday May 29, 2002 @10:43AM (#3602225) Homepage

    according to experts who have just shattered a long standing myth.

    This is total biased crap. I don't mean to troll, but think about the statement. Who where the experts? A company who sells virus software, who wants to break into the mac market. What was their evidence? "Because we said so".

    Unless I get cold hard facts, I refuse to beleive that apple has code that is so flawed it would be a threat to national security. The same things about MacOS that makes it more stable are the things that make it more secure, namely properly written code, and quality assurance testing before release. None of this security by obscurity that you see way too often.

    • Re:what are they talking about? (Score:5, Insightful)

      by Dephex Twin ( 416238 ) on Wednesday May 29, 2002 @11:21AM (#3602452) Homepage
      I noticed that line too. How exactly was this myth shattered and by whom?

      In fact, 62 per cent of Mac users said that increased security was the main reason for them moving to the platform, according to Symantec.

      Sixty-two percent of Mac users have a Mac mainly because they want security? I don't think 62% of Mac users really even think about security.

      "Obviously there are more PC-only viruses out there, but there are still over 7,000 macro viruses which can hit either Mac or PC platforms."

      So there are lots and lots of viruses, mostly for the PC, but some are cross platform. Who, then, has more? When was the last time a Mac-only or even a Mac-compatible virus (like Nimda or Code Red) been in the news (or even existed)?

      Chapman explained that, because of the Mac's age, some of the first viruses ever written were for a Mac

      Oh no, not the first viruses ever! What is the relevance of that?
      and some writers still target the platform specifically.

      Really? All 15 of them? Compared to 15000 on Windows? Did anyone claim there was a 0% chance of a virus being written for Mac?
      "Another big problem Mac users don't think about is that they make perfect incubators for Windows viruses," said Chapman.

      This makes the Mac less secure how? And the fact that Macs don't automatically search for viruses on any platform and destroy them means they are somehow guilty of giving Windows users viruses?
      At the time of going to press Apple was unavailable for comment.

      That's because Apple shouldn't have to waste its time defending itself to trolls like that.

      Okay, so the Mac community believed there were FAR less Mac viruses out there, and very few Mac virus writers. What "myth" has been shattered exactly?

      This is such complete FUD that pretty much every sentence is full of it. This wasn't ignorance but someone going out of their way to deceive.

      mark

    • Re:what are they talking about? (Score:4, Informative)

      by digitalcowboy ( 142658 ) on Wednesday May 29, 2002 @04:24PM (#3605185)
      I agree with you completely. This is the most biased anti-Mac propaganda I've read in a long time. One small piece of evidence:

      In the past even the US Army has moved its web servers over to MacOS in the mistaken belief that they will be more secure.

      They fail to mention that that was prior to OS X. While it's certainly true now also, back then the Mac OS was FAR more secure than Windows for running a web server simply by virtue of the Mac having NO COMMAND LINE. Even if you could exploit a Macintosh web server in the days of OS 9 and prior, what would you do once you got in? There is no ability to do anything remotely on the machine unless there is third party remote desktop software installed on it.

      I find the line about 7,000 macro viruses hysterical as well. The vast majority of those macro viruses are VB viruses that attack the myriad gaping security holes in Outlook (or the myriad gaping security holes in IIS, installed by default on all Windows systems and not even available for Macintosh). The Macintosh version of Outlook Express doesn't even support VB! The only macro viruses a Mac might be vulnerable to are MS Office macros. How long has it been since you heard of an MS Office macro virus outbreak? They're virtually non-existent now because it's so much easier to propagate a virus via Outlook and/or IE.

      Speaking of which, if you're dumb enough to be running IE on a Mac, you probably are opening up some vulnerability. That's one reason there's so much activity in the browser space (iCab, Opera, OmniWeb, Chimera, etc.) even though IE is free.

      No system is totally invulnerable, but having spent many long hours dealing with the effects of NIMDA (for one) at work, I'll gladly hold on to my Mac at home, thanks.

      • I was still seeing them last year on our Human Resources machines (Office and Windows 2000). It amazes me that people are still sending Office macro viruses in resumes. The first one I saw (back in 97) was for an IT Manager position, I told HR that there was no freaking way I was working for that person since he's creating unecessary work for me before his interview.
    • Who where[sic] the experts? A company who sells virus software, who wants to break into the mac market.


      I don't see how you can say that a company that has been selling Mac software (including antivirus software) since the '80s is trying to "break into the mac market".

  • I think the perception that Macs are more secure derives from their relative lack of use in the server world. There are more Windows machines out there and therefore, Windows machines have more problems. I didn't see anything about relative failure rates between MacOS and Windows but I wouldn't be suprised if they were about the same. (Linux might be a little better if for no other reason than your average Linux user actually cares about security).

    The reality is 99% of security is up to the user. [slashdot.org] A properly configured Windows machine is pretty much as secure as a properly configured Mac, or Linux machine, or [insert your OS here].
    • I think the perception that Macs are more secure derives from their relative lack of use in the server world. There are more Windows machines out there and therefore, Windows machines have more problems. I didn't see anything about relative failure rates between MacOS and Windows but I wouldn't be suprised if they were about the same. (Linux might be a little better if for no other reason than your average Linux user actually cares about security).

      I think the perception that Macs are more secure derives from the fact that Mac users rarely get viruses.

      I've used Macs as my primary desktop for 10 years and I've never caught a virus. Not once. Not even when Mac viruses where more prevalent and I used to wander about with floppies in student labs. I still don't take particular care in what I download. I haven't used any kind of anti-virus software in about 7 years, because it was a waste of time and money.

      Most Mac users don't bother with anti-virus software because they feel no particular threat. Whereas Windows users, and rightly so, live in continual terror of viruses. This is just a cheap attempt by an anti-virus vendor to spread FUD in the hope of drumming up some business.

      And don't anyone get it into their heads that Mac OS X is more secure than Mac OS 9 either, I could drive a truck through the security flaws in it. But I still don't worry because most virus writers couldn't give a rats arse about writing a Mac virus. There's no particular reward in infecting such a minor player when there's such rich pickings to be had in the Windows world.
    • The reality is 99% of security is up to the user. [slashdot.org] A properly configured Windows machine is pretty much as secure as a properly configured Mac, or Linux machine, or [insert your OS here].

      Agreed & seconded. Still, maing the windows machine as secure as my mac would require me to somehow get rid of MSIE as the windows shell... while I'm at it, I suppose I'd have to get rid of Outlook Exp. as the default email app - oh, and I suppose I'd need to...

      The problem is that virii proliferate, and every unsecure system helps spread the virus. Most home users don't give a darn about security or virii, and part of the reason Macs have a reputation for security is that you don't need to make tons of changes to the system to have a reasonably secure system. This is true of Linux as well. Most people just want to type emails and surf the web - they can't really be bothered to "do" security.

      Brian.
  • I think Mac users feel attacked enough by the rest of the world, to bother with attacking each other. :)

    As I am fond of saying, I believe it's possible, I just don't think it's a coincidence that I've never seen it.

    - H
  • You compare Mac Virii to Windows Virii..fine.

    You compare Word Virii to Mac Virii...fine.

    How about you get those numbers out then work out a ratio to the number of Windows OS's to Mac OS's.

    I think then you will understand the reason the numbers are the way they are. More targets, get more Virii. If Macs had the market share there would be more Virii for Macs than windows. Supply and demand in a strange sort of way. Not a better or worse OS, the OS have very little to do with which system gets more Virii writen for them. It has to do with infection ratios and impact.

    • Right, but to a consumer, it doesn't matter whether the OS is inherently "better" or more secure, what matters is the infection rate--how likely am I going to be infected. If going for the less popular brand means decreased probability of infection, even if it is just because it is the less popular brand, the security conscious consumer should still go with the less popular brand.

      • Although I agree with you about this on one hand, I disagree on anouther kind of outside the original topic point.

        Which is most consumers, IE mom and pop, really don't care about infection rates at all. They care about software, price, and ease of use. The very same ease of use that gives ease of infection.

        I agree that the security conscious consumer point is very valid, if that is what you are looking for. If security is that important to someone they are not going to be looking into how secure the OS is, they will be looking into how secure there firewall is. Education is the key here, and they would take steps outside the OS to secure there systems at this point.

        I guess what I am saying is at some point your become a bit parinoid and buy a firewall. If you have the beans to rub together to get it set up, your going to have the beans to secure your box as well no matter what OS is on it.

        So I guess the argument here is "what is the most secure box, out of the wrapper, for a newbie" that has enough brains to realize that their stuff might need some protection.

        • Which is most consumers, IE mom and pop, really don't care about infection rates at all. They care about software, price, and ease of use. The very same ease of use that gives ease of infection.

          It's not ease of use that gives us ease of infection, it's proliferation of features. This very same proliferation of features is generally bad for ease of use.

    • btw- the plural of virus is viruses not virii.

    • Re:Your statement is FUD. (Score:1, Insightful)

      by Anonymous Coward
      although mac does contain a very small market share, what hasn't been touched on here is the code. The code from apple or linux is far cleaner than anything m$ has ever written, or for that matter will ever write, thus avoiding a lot of problems with infections and buffer overflows.

      Also m$ does this really cool thing to your security in windoze xp, it bypasses it all for its .net service and "pirate" app checker, leaving huge holes in your OS no matter what type of firewall is installed on your computer.

      The simple fact is, cleaner code is far less buggier and less likely for infection.

      Now these people state that viruses can affect any OS, this is true, but remember that 99% of all viruses are written for the m$ OS simply because the system is so easy to hack.

      With Mac entering the GPL world, they will have an advantage along with linux or any other *nix os, because if a fatal flaw is found on the code, you don't have just 3 guys in a backroom working on the problem like m$ does, but rather, you have a whole community that will come to its savior to fix the problem, giving virus writers a rather difficult time in creating malicious code and having it work longer than a week.
  • The "revelation" that Macs aren't inherently more immune to viruese is like someone revealing that all multicellular organisms are vulnerable to viruses.

    Not news. Ye gods. Of COURSE the Mac platform is suceptible to viruses. Anything that accepts any kind of instruction set and has the ability to create data in some way is suceptible to viruses. The more of something there is, the more viruses "survive" long enough to mutate into new forms, 'cause there's really no point in creating a virus unless it's going to be released somehow. The smaller a population, the easier it is to defend against a viral invasion, as there are both less things to immunize (install anti-virus software on) and less potential hosts for the virus (making it alot harder for the virus to get a grip). Macs are currently less suceptible to viruses because there are less out there created for it and there are less Macs to put them on, and I would imagine that the only reason a virus writer writes a virus is to release it and cause havoc for whatever reason they may have, and there's a finite amount of havinc that you can create through a Mac virus. The only reason there haven't been more Linux viruses is because it's in relatively low numbers in comparison to Windows (as far as total machines with the system loaded, not any particular subset) and because of those low numbers and other reasons, Linux users take far more care of their PCs than most people who run Windows. Very few Linux users that I know aren't update freaks. Mac users are also a relatively rabid update community (see versiontracker) and that means a majority of the holes that viruses use to sink their teeth into systems just aren't there like they are on Windows boxes, which half the time haven't been updated at all since they installed the OS.

  • Safety (Score:2)

    by Gid1 ( 23642 )
    I think I'm reasonably safe from being hit in the face with a big fish when I leave my house... not because it's not possible, but because it's not likely.

    For now, Macs are safer because there are fewer viruses around. We'll see when/if virus writers start targeting Mac OS X as much as Windows.

    I suspect even then, Mac users will be safer.

    Looks like antivirus publishers run amok.
  • I've been using MacOS 9.x and OSX for the last 4 years quite extensively. Browsing the web, downloading binaries, etc, etc, etc. In all that time, I've not been hit once by a virus that I can tell. I've consistently run Norton Antivirus, and it's never reported a damaged, infected, or otherwise bogus file. However, I've seen pc's in my office drop like flies. (Fortunately, I rarely need to use the immunocompromised little beasties, and when I do, I'm meticulous about my virus checking. I also don't run Outlook, EVER.)

    Given the stress by Apple to move people to OS X and it's BSD underpinnings, it's obviously scary to Symantec, MacAffee, etc. that they might lose their chunk of money. Think about it, who ever heard of a virus checker for any *nix?

    Find me a non-corporate virus hunter that will make the same claim and I'll buy it. Otherwise FUD.
  • Comment removed based on user account deletion
  • I doubt that you'd see many. Of course there are mac users that always log in as root and thus could execute a malitious (sp) program. Personally I think Macs are as vulnerable to virus as Linux, BSD and SUN boxes. More than likely they are susceptable to buffer overruns and bad cgi scripts gone wild. Of course a process that is run as nobody and owns nothing cannot do real damage (assuming it is not taken over by a hacker).
    • Of course there are mac users that always log in as root

      root login is disabled in Mac OS X unless the user turns it on with NetInfo. Your statement is probably still true, but it's also true people who do "have asked for it!"

    • Actually its much more difficult to write buffer overflows for PowerPC's. Too many instructions have null bytes in them terminating the buffer. That's not saying its impossible but its much easier to write overflows with intel's instruction set.
  • This news story has made the rounds at several Mac sites in the past two days. It amounts to nothing but free advertising for the 'experts' to help them sell their product.

    It's like asking an insurance agent if you should buy more insurance. Of course they're going to try and paint a doom-and-gloom picture to line their pocketbooks.

    Macs ARE at risk for viruses but the greatest risk for viruses right now are those viruses that exploit Microsoft's Outlook and Outlook Express for windows as well as those that exploit stupid users who run attachments (which almost always attack Windows). Until viruses are written in Java, the Mac is not going to be the danger zone that this article implies.
    • I would be more worried about the source of the statement. If Symantec is the one saying that Macs aren't immune to virii, I would look very closely when an OS X virus comes out. After all, "who watches the watchmen" and "things get broken,see? Accidents ... happen ..." and all that.

      I would not only look at the source for the Mac virus, I would look at the writer (if he/she is ever found) and possible connections to Symantec.

      Maybe I'm just a paranoid overreactor, but it's statements like that of Symantec that make me very suspicious of their intentions.
      • Chapman explained that, because of the Mac's age, some of the first viruses ever written were for a Mac and some writers still target the platform specifically.

        There's even a release of the infamous Sub7 Trojan in Alpha development at the moment, he added.

        It sounds to me like Symantec is developing the virus, or at least knows the people who are. If the former, they are criminals, if the latter, they are obligated to tell the appropriate legal authorities.
    • Once they get the story out Symatec's gonna unleash a wave of Mac virii they have been paying to have made.

      Then they'll scream "I told you so!!!"
  • That was a bad article.
    Macs do suffer from virus, and other malware, and the article does make the point that if a venerablity exists it will be exploited, regardless, however what it fails to point out are that there are fewer venerablities on a mac.

    Also it fails to mention that macro virus's are MICROSOFT Viruses. dont use MS and you are fine.

    The article should be Use Microsoft, Get viruses.
    More FDU With this one folks
    • actually, there used to be vi macro viruses running around (you could run arbitrary vi, and that means by extension shell code whenever a particular file was opened). Most vi versions have dropped default autorun code support, or dropped the possibility of autorun code altogether. IIRC there is a similar case with emacs (I think it will still autorun code if you are the owner of the file).
  • In fact, 62 per cent of Mac users said that increased security was the main reason for them moving to the platform, according to Symantec.

    WTF? who are they surveying, almost all of the mac users i know are artists/designers that could give two less about security.

    and viruses, why target 5% of the market when you can hit the other 95%? plus windows sucks and it diserves all of the viruses it gets.

    ot have any of you seen the CDW ad where this guy is asking the IT guy why an email named I LOVE YOU is a virus, its got such a lovely name. LOL... ah poor windows users

  • Point-by-silly-point (Score:2, Interesting)

    by torinth ( 216077 )
    The article doesn't mention that the "7,000 macro viruses" attack Microsoft products (leaving uses of a Mac only as a web server completely protected from them)

    Irrelevant: Ok, sure. If I run a web-server only (Windows) PC with Apache the daemon, I'm invulnerable, too. What does that have to do with Mac vs. PC. That's just a matter of software (which happens to be cross-platform). If you don't run Microsoft client software, you are protected.

    nor does it quote any statistics about how many Mac vs. Windows viruses exist, and it doesn't address the real- world fact that Macs are hit with viruses far less often than Windows machines.
    This one's a little more reasonable, but really, let's look at this article. It clearly is implying that the Mac, as a platform, is theorectically prone to virus attacks, like any system. Now, as long as it has only marginal market share it won't be a target, and won't have as many viruses, but that won't last long if everybody switches to it for that reason.

    Mac vs. PC vs. Alpha vs. whatever is just not the place to be talking about security. Security, as of this moment, is not really a part of the hardware-layer of systems. If you want to talk about security, you need to talk about applications - like those made by microsoft - but those applications are becoming more and more cross-platform...

    -Andrew

  • In fact, 62 per cent of Mac users said that increased security was the main reason for them moving to the platform, according to Symantec.

    Sounds like a botched survey question to me -- the question was probably asked under circumstances like those Quiznos sandwiches commercials. I really find it hard to believe this statistic. What about ease of use? Things just working correctly? Lack of infestive software (like Bonzai Buddy)? Lack of P2P utils? Lickable UI elements? And who did they ask, the Army? *cough*

    "Obviously there are more PC-only viruses out there, but there are still over 7,000 macro viruses which can hit either Mac or PC platforms."

    Right. That's probably the reason that the Microsoft Office X suite has the "Macro virus protection" option enabled by default.

    Chapman explained that, because of the Mac's age, some of the first viruses ever written were for a Mac and some writers still target the platform specifically.

    ....all three of them......

    "A Mac user can get a virus from a Windows machine that won't affect them but, if it's attached to a document or a file, then they can pass it on to another Windows machine."

    I wouldn't exactly call them "incubators," as Chapman whines. The viruses don't even run. If the user replies, how many email clients include attachments in the replies?

  • I just loaded my virus definition list on my Windows machine. Took long enough for me to go get a cup of coffee quicker than it loaded....

    The grand total is..... 24,295 detectable virii, probably higher if you count variants.

    The total of MacOS X virii is.... 0

    Holy Infection Rate Batman!

    Anyone know how many MacOS 9 virii there are?

    Nevermind that a large portion of MacOS X is OSS and personally I think OSS has a much better track record that MS's lard bucket that they think passes as an "OS".
    • There were *about *(!) 30 significantly different viruses (including at least a couple of worms) for Mac OS Classic (though I'm not counting Macro viruses like the ones that can infect Word and Hypercard, etc).

      For example, many of the Word Macro viruses are cross platform.

      Many of the origional viruses came out of fun and games at MacHack, people just trying to see if they could do it, but a few were modified and released into the wild by Script Kiddies after they appeared on some of the MacHack CD's, IIRC...

      I think the last virus of any sigificance for Mac OS classic was Autostart-9805 in 1998.
      • True, and if I remember correctly, 3 or 4 of those 30 viruses won't run on System 7 or higher, so are only a danger to those who bought their Macs in the 80's and didn't upgrade their OS.

        This article was on Mac Central recently, and all the forum comments there labeled this as pure FUD. I ran NAV on my Performa 6400 for a few years, and it never found a virus. Never. Also, I don't own a copy of Office, so I'm not vulnerable that way. I suppose that someone could DOS my DSL connection, but even if I turn file sharing on, they'll need to figure out my IP address, my name, and my password to log in, and anyone who knows my name doesn't know my IP address(including me, I never memorized it)
    • Last I knew there were in somewhere's between 40 and 50 classic virus' , many of which did not run on PPC macs and many which didn't run after system 9. The most prevalent virus on classic (not counting the auto start worm) was the MDEF virus and it's varients. And this virus wasn't even malicious, most of the varients simply annoyed you with random system beeps. Only the D varient (I may be wrong on this one) did anythign truly evil, causing internet programs to randomly crash.

      Last I knew, OS X had 3 X specific virus'/vunerabilities and one of those was a flaw in IE

  • "Inherently" (Score:2, Interesting)

    by usr122122121 ( 563560 )
    they left out the word inherently when they were typing this up.
    Macs are not inherently safer than PCs, however, Apple has a MUCH better track record when it comes to writing secure code than Microsoft does...

    I think the first Mac OS X virus we will see will be an Apache exploit [good luck, guys].

  • The discussion about security vulnerability as a function of market share is not new but consider this: Think of the network as a whole and not just individual machines. Viruses are an example of common mode failure - a situation where all systems of a particular type fail in response to something. The way to combat this is through diversity.

    We are vulnerable because of the lopsided distribution of operating systems. If we had better balance, not 95% Windows, it would be harder for any virus to spread.
    • We are vulnerable because of the lopsided distribution of operating systems. If we had better balance, not 95% Windows, it would be harder for any virus to spread.

      Or, everyone could run the same OS, but with different mail daemons, web browsers, editors, etc. A kmail exploit (if it could exist) will never effect mailx (hell mailx is just a new version of mail, the original mail program, the first email client ever, and I seriously doubt it has ever had a vulnerability, but I digress). What I am trying to say is that homoginous systems can be avoided, if, for example, your web browser isn't an integrated part of your OS.

  • The fact remains, however, that OS X ships with a lot of its ports closed. Windows XP has a lot of them wide open. OS X also has a better security model (it is Unix, after all).

    Everyone knows that OS X is not immune from viruses. However, a virus run by an unprivileged user is limited in the amount of damage it can do. Also, the fact that the default firewall configuration is more secure limits the amount of remote exploits. OS X is still more secure than Windows XP, even if it is vulnerable to viruses.

  • from the and-i-say-that-the-middle-east-is-a-great-vacation -spot-this-year dept.

    You are thinking of South Asia. Just remember to take lots of sunscreen. Oh, say, SPF 1,000,000,000. [bbc.co.uk]

  • Known troll, or just a moron? (Score:4, Insightful)

    by zephc ( 225327 ) on Wednesday May 29, 2002 @12:25PM (#3602953)
    The story author, James Middleton, is a known troll and MS banner-waver, check out http://www.vnunet.com/News/1128907 [vnunet.com]
    Either that, or he is very susceptible to marketing hype from corporate interests, and taking it as news.

  • The article doesn't mention that the "7,000 macro viruses" attack Microsoft products (leaving uses of a Mac only as a web server completely protected from them), nor does it quote any statistics about how many Mac vs. Windows viruses exist, and it doesn't address the real- world fact that Macs are hit with viruses far less often than Windows machines.

    Because none of those are relevant to the question at hand. Honda Accords are stolen way more often than VW Beetles, but I don't think anyone is going to argue that the canvas sunroofs are the reason why.

  • Risk Assessment (Score:2, Insightful)

    by shunnicutt ( 561059 )
    Once upon a time, I read some article saying that risk assessment was accomplished by examining the possible threats, the consequences of each threat and the likelihood of that threat actually happening. All of the threats discussed in the article are real, but the actual risk at this time is quite small. You also have to look at the malware tools available for Windows and Microsoft products that can automate virus creation, etc. giving the clueless the tools to cause a little havock. To my knowledge, there isn't anything analogous for the Macintosh, either OS 9 or OS X. Yes, the virus writers will go for the platform where they can do the most damage. But they'll also go for the platform that is easiest to write viruses for -- Windows!
    • Oh, I forgot to mention the network effect -- if someone does write a virus specific to OS X, it has to somehow find another OS X machine to propagate.

      This might be possible where actual media is exchanged at an office, student lab, trade show, etc. but I hardly exchange physical media any more. Any email leaving my machine is more likely to find a Windows computer, which wouldn't host the virus.

      The network effect ensures that any Macintosh virus has the deck stacked against it.

      There you have it: less damage to be done, no virus writing tools, difficult to propagate.

      Begone! You have no power here!
  • While working as a field tech in '98 I had a lot of customers that were infected by the multiple varieties of autostart worms [sherpasoft.org.uk]. It was the first Mac virus that I had seen with my own eyes. It spread itself around quickly in the graphic art community because of all the file sharing they do. MacAddict magazine also unintentionally helped spread the virus by including it on one of their monthly CDs. It was fairly easy to kill and helped sell a lot of Virus software.
  • considering the large number of obsessive mac-bashers in the world, i'm surprised that a malicious os x virus hasn't surfaced yet.

    i'm not an expert, but i would imagine that at least one api in os x would be fertile ground for a virus; quartz executables, opengl scripts, postscript fonts, quicktime. all of these can be embedded in innocuous documents.

    the level of risk is increased by the present sense of complacency. (and no, i'm not working for an anti-virus co).
    • However the largest number of virii and worms in the wild today, or at least the most disruptive are VB scripts which can be written by a lot more people than postscript code or the like. Though who knows if AppleScript might not offer similar vulnerabilities.
  • "Obviously there are more PC-only viruses out there, but there are still over 7,000 macro viruses which can hit either Mac or PC platforms."

    I run OS X. I do not have MS Office installed. I use Eudora for mail, and iCab for the web. What macro viruses can I get hit with? The statement above is based around the incorrect assuption that all Macs have MS Office installed on them.

    Antivirus firm Symantec said that over three quarters of Mac users are under the illusion that they are not a target for virus writers and hackers.

    As a Mac OS X user, I would agree with the statement "[I] am not a major target for virus writers and hackers."

    I am definitely not under the impression that crackers could not go after my box. I take precautions as a result of that. However, I think that, as others on this story have pointed out, the sheer number os MS boxes out there make them a much more appealing target.

    The article makes baseless assumptions and jumps in logic that no sane person would ever make.

    i am just pointing out two flaws in it. There are more.
  • So the story basically had no valid data. Talk about a troll post.

    • Re:No Data? (Score:1, Offtopic)

      by MoneyT ( 548795 )
      Sorry, I had to contribute the story cause I knew that the editors wouldn't be able to resist. Besides, after having 4 rejections, I needed an accepted.
  • this is my favorite part:

    In the past even the US Army has moved its web servers over to MacOS in the mistaken belief that they will be more secure.

    Yes please, lets compare the security records of IIS vs. Apache. Or better yet lets compare the security records of WinNT/2K and FreeBSD (which Darwin was based on IIRC). Give me a fuxking break.

  • Whatever (Score:2, Interesting)

    by d3xt3r ( 527989 )
    This is clearly a case of someone trying to make a case that Mac users need virus protection as much as Windows users do.

    The fact that all Operating Systems are subject to virus attacks cannot be argued, but some are more secure than others. There are three requirements for a virus to damage a user's machine. First, the user must acquire the virus (download, email attachement, etc). Second, the user must execute the infected application (thinking it's something else). Three, the user must have permission to modify/edit/delete the resources that the virus intends to attack.

    Seriously, we hear the argument time and time again that Mac and Linux are less succeptable to Viruses than Windows, but what they really mean is point three from above: OS X and Linux to a better job of protecting system resources than Windows. So yes, Windows is more succeptable to catastrophic damage than OS X and Linux.

    What really goes without saying here is that viruses follow the same pattern as useful software: 90+ percent of the population uses Windows, so target that population and you will see the most damage (or revenue for real software).

    No one should really think that they are not Vulnerable to viri simply because they run a more secure OS. While a OS X or Linux virus executed by a local user with limited privledges cannot necessarily damage the system, they could still delete all of that user's personal data because that user has full permission on their stuff. I don't know about any of you, but if a virus wiped out my entire home directory, I'd be pretty pissed, and the fact that my system still booted up would be no consolation. =)

    My point here is just that anyone who runs foreign applications on their machine from a user account that has write permissions on their own files is succeptable to a virus attack.

    As long as Windows enjoys the overwhelming majority share of desktop operating systems, it will be the target of the majority of virus attacks. If that balance shifts towards the Mac, don't doubt that the virus writers won't prey on Mac users as well.

    • Try thinking about it this way...

      It's not only that OS X is less targetted, it's that the OS is inherently more secure. User and system level access are more distinct. Base system applications are less likely to 'autoexecute' damaging code.

      How about two point to point comparisons?

      1) How long has Outlook continued to leave programatic access to the user's address book and increased the spread of viruses? Can you demonstrate a similar bug in OS X's Mail.app?

      2) How many holes/viruses/problems are caused by IIS web servers? What percentage of Apache webservers show the same problem?

      I'm sure I could find other examples where a BSD based OS is more secure than a Microshaft machine. (Daemons run with non-root status, ...)

      And for the record, I still run virus protection and checking software, because I'm not stupid enough to believe I'm totally immune. That doesn't equate to my machine being AS VULNERABLE as a PC to being exploited, as the title of the article implies.

      Lee

      Mac OS X is to Windows as _______ is to swiss cheese.
      • There is no doubt that Microsoft products are shoddy and filled with security holes, and yes the Unix security model is superior to that of, say a Windoze 95/98/ME box. However, my point is just that a virus does not have to destroy the system in order to be effective. Simply trashing a user's home directory is enough to really hurt a PC or Mac user.

        Your point about the Mail.app vs Outlook address book argument is interesting, but I don't think that an OS X hacker would have a hard time getting into your address book as well. Once that virus is running, it can find a way to read anything that you have read access to (and is not encrypted). That includes your address book. A litte C program (maybe even apple script) could most likely find your address book and begin mailing itself to all your contacts.

  • Come on, people. Get with the English program.

    'j

  • They are right...almost (Score:3, Insightful)

    by theolein ( 316044 ) on Wednesday May 29, 2002 @02:55PM (#3604330) Journal
    The Mac, either Classic OS9 or OSX is generically not safer than Windows. The fact that Microsoft products are virus traps is not only because they are written without any real security in mind. It is also because the platform is so widley used. I can't substantiate this of course, but the sheer volume of Windows, IE, MSSQL and Outlook Virii does point to the fact that *a lot* of people are almost constantly on the lookout for ways to crack the system.

    The Classic Mac OS had the one built-in but not for that purpose security measure in that it didn't have a commandline. This prevented anyone from logging in via SSH or whatever and rooting the system. The only widespread server on the Classic OS was Webstar and by default it didn't have any way of getting in via a CGI or buffer overflow unless you installed plug-ins, and even then you could crack the serve but had no way of doing anything else on the computer.

    Mac OSX has had the occaisional security hole, the last one I remember (Apart from an IE hole but we won't talk about that) was the HFS case hole. Apple has simply been wise and turned off most of the daemons that are notoriously prone to sniffing etc by default such as telnetd, ftpd etc. If you turn these on, you stand a good chance of getting hacked.

    Apple also has a built in Scripting System on both the Classic and OSX systems: AppleScript. The only reason that there have not been more Virii coming in on this channel is because there is no automatic way to execute one of these as there is on windows. You could however easily use social engineering (i.e. trick someone into downloading a bad Applescript application) and wreak havoc on that persons machine.

    Anyone who has used Macs in the early '90s will remember many Virii such as mdbf or the CD autoplay worm, some of which were even spread on MacWorld CD's. Apple's loss of marketshare in the mid '90s coincided with less virii being written for the Mac. You work that out.

    With the rising marketshare of the *new* Apple under Jobs and Tevanian with the new OS I am willing to bet that the attempts to crack the system will incease.

    How Apple will eact to this will determine Apple reputation in this espect. Up until now Apple has been very good and fairly candid at reacting to and releasing patches and hasn't gone on any whining campaigns as MS has done in order to try to draw attention away from buggy products.

    So, the article is not entirely wrong but still misses the true issue.
  • This piece of FUD was already picked apart [macworld.com] on Maccentral [macworld.com] yesterday.

    In short, this was a piece of FUD backed by Symantec to try to sell more copyies of Norton Antivirus for the Mac. I've been using Mac's since the 80's and I've not had a virus since 1993 when I got a floppy infected with Scores and NVIR from an infected High school computer lab.
  • It's the users. I've worked for years on both PC's and Macs. We regularly bring in customer PCs that have viruses. Know how many virus's I've had? Zero. Why, because I'm not stupid. Properly set up security on shares, not opening every flipping 'look at me!' email that comes across my desk. Not using a root level account for everyday use. PC's don't spread viruses, people do.
  • Can any of you name...

    Top three mac-viruses?

    The deadliest mac-virus and the damage it did?

    The virus that last affected your computer...

    ...and when?
    • WDEF, NVIR.a, and NVIR.b are the only ones I've ever seen in the wild (ITW). I think NVIR said something out of the speakers if you had that damned talking moose around, and that would be, oh, about '92 or so I think when I disinfected a high-school computer lab (MacWareZ was bad news back then, I guess....).
  • Check the WildList [wildlist.org] for this month's viruses found in the wild. These are the only ones that actually pose a threat. Looks to me like if you don't run Microsoft Office products, and don't run Microsoft Windows or Microsoft DOS, you're pretty damn safe.

    For those of you unfamiliar with virus naming conventions, here's some basics:

    Most of the ones w/o a prefix are going to be DOS executeable or MBR/Bootsector infectors.

    Prefixes:
    JS/- Javascript VBS/ - Visual Basic Script
    W32/ - Win32
    W95/ - Windows 95
    W97M/ - MS Word 97 Macro
    WM/ - MS Word Macro
    X97M/ - Excel 97 Macro
    XM/ - Excel Macro
    O97M/ - Office 97 Macro

    Realize that Mac Classic OS's are just as vulnerable, and in fact there were viruses being written for them ~1990 or so and possibly before, but they just aren't widespread anymore (WDEF was pretty popular for a while though...). Obviously, with the file protections of *nix, OSX is a bit more resiliant to infection although still perfectly targettable.

    If you don't make sure your system is locked down properly, and you run executeable code from untrusted sources, well, you're taking a risk. It's just not all that big right now (contrasted, of course, with the 5+ .scr/.html and .exe/.html combo's I get in my mail box per day aimed at infecting windows...).

  • Kevin Chapman of Symantec said:... ...There's even a release of the infamous Sub7 Trojan in Alpha development at the moment, he added. " Do virus writers run formal testing programs? Use change control? Does Kevin Chapman work in the mail room? "Mr Virus Writer? I'd like to report a bug in the alpha of Sub7 - it consistently fails to infect my machine."
  • "Another big problem Mac users don't think about is that they make perfect incubators for Windows viruses," said Chapman. What makes him so sure we don't think about it? Waa ha ha haaa!
  • The antivirus companies will make sure of it. The truth is out there.
  • This isn't exactly a technical white paper on the relative security of Macs. Like most of the crappy journalism in the computer industry these days, this article has no real substance or useful information in it. It just states "well, we think the Mac might be just as big of a target as Windows."

    Trust your instinct though - most people here know that Windows suffers from some symptoms no other platform has to contend with: lots of visibility and major security holes that many people never get around to fixing. _Every_ other currently viable desktop operating system is at _least_ less visible; in the case of Mac OS X (with an open-sourced FreeBSD-like core) it's even harder for a user-space application to attack critical system components.

    Yes, Mac users should get some virus protection. Heck, EVERYONE needs virus protection these days. But to ascribe the Mac as "not really more secure than Windows" is just bunk.

  • Not only are these guys blatant trolls, but they're also wrong. As anyone who has ever tried to crack a Mac will tell you, there are entire classes of buffer overflow attacks that can't be done on PowerPC that are instant root access on x86. And it's harder to write many other types of exploits on PowerPC.

Slashdot Top Deals

"I have not the slightest confidence in 'spiritual manifestations.'" -- Robert G. Ingersoll

Close