Apple's Big Virus

Apple's Big Virus
Kelly Martin, 2005-04-20

After your identity has been stolen, your bank accounts compromised, 53 critical patches and 27 reboots later, when will you decide that you've had enough?

Colapse all | Post comment

Apple's Big Virus 2005-04-21
Anonymous (2 replies)

Thanks, Kelly. I think you've really nailed an interesting ecology of tech ideas. You neatly and accurately listed all of the real-world mechanisms that all reinforce the sense of freedom that OS X is building. I think it's also interesting that Apple seems to be building this perception in users of...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

I also agree with you Kelly. Being an avid ethical hacker, I have been advising personnel to shore up there MS systems on a continual basis. After purchasing my first OS X based platform 2 years ago - I have had absolutely no problems whatsoever (securtiy wise). It's amazing how much grief I get ...

[ more ] [ reply ]

Apple's Big Virus 2005-05-02
Anonymous (1 replies)

If you truly want to escape the viruses, revert back to an old OS, no-one creates viruses for these because they are not popular... so you only to worry about the viruses that are already there....

[ more ] [ reply ]

Re: Apple's Big Virus 2005-05-25
Bradbury9

In case you are not joking...

>> revert back to an old OS
Interesting opinion, but old OS do not have the same features and, now becomes the important part, what about the drivers and the programs?

The drivers related problem can be fixed not having modern hardware or developing drivers of c...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Wanne (2 replies)

My old ZX Spectrum (1982) also had no viruses, not because it was so secure, but the viruses could not spread because they couldn't reach another computer.

Apple OS X is enjoying security through obscurity which works fine for now. However, as I read somewhere, Apple's lack of viruses is a perfe...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
M. T. MacPhee <macpheem@telus.net>

There is no such thing as "Security through Obscurity". Read the following tale of a virus that infected a specific community - with a population of only 12,000.

http://www.computerworld.com/securitytopics/security/virus/s
tory/0,10801,93584,00.html...

[ more ] [ reply ]

Apple's Big Virus 2005-04-23
Anonymous

You don't get it do you? You *OBVIOUSLY* don't use a mac! Its not obscurity, it is built-in security...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Brian McMahon <brian.mcmahon@cabrillo.edu> (3 replies)

I am of two minds. Here they both are.

PRO: Indeed, there is a historical precedent for the "user cultural" argument. Back in the early days of viruses (Yeass, back in myyy day, sonny...), the Microsoft DOS platform (which includes the first several generations of Windows that were essentially...

[ more ] [ reply ]

Apple's Big Virus 2005-04-23
Anonymous

This post is dead on the money. The reason that there are no virii for OS X is that it would be actually difficult to write one, and most of the people who could have real jobs. It's not market penetration or anything else, it's just logistics. The people who write virii are sometimes very smart, bu...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

:-) The first academically documented virus was written by Fred Cohen and was written in DCL on VMS. I remember when Fred rushed into our lab down the hall to tell us about it (at USC)....

[ more ] [ reply ]

Apple's Big Virus 2005-04-26
Anonymous (1 replies)

There have been proven exploits, including a web link that would end up firing up a terminal window, listing the contents of your user directory. Could just as easily erased the contents. This exploit was fixed in a few weeks by Apple but it really wouldn't have been to difficult to construct an App...

[ more ] [ reply ]

Re: Apple's Big Virus 2005-06-05
Anonymous

the fix was out after some weeks of publicity.
they knew about this hole 3 months earlier without doing anything.

lucky indeed......

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Andrew

sorry but I think that being in a situation where you are encouraged to be complacent can only be a Bad Thing.

Complacency/ignorance of the potential for malicous intent has been one of the prime factors in the current horrendous state of alot of windows systems out there. Yes in an ideal world ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Jimbo

I thought the switchback virus was written to target OSX?

...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Anonymous (1 replies)

Wrongo. There are viruses for OSX, you clearly don't know what you're talking about. But it's not viruses that you need to worry about, rather rootkits. With OSX's BSD core a rootkit is something that you need always worry about, even though the chance is remote.

No system is perfect or secure. ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
M. T. MacPhee <macpheem@telus.net> (3 replies)

Please show us the virus (or worm or Trojan horse) for OS X 10.3.9. There are three rules:

It must be "In the wild", it must be shown to have caused some sort of damage to the machine on which it was found, and, it must have spread to other machines.

We'll wait here....

[ more ] [ reply ]

Apple&#39;s Big Virus 2005-04-21
Anonymous (2 replies)

Actually, I can do that. My organization has about 70/30 PCs to Macs OS9 & OSX, and we had a pretty bad issue with the Macs being little virus factories for Office macro viruses.

Users would bring in the virus from home (via USB drive, floppy) and their Mac would happily spread it to other Mac us...

[ more ] [ reply ]

Sophos Enterprise A/V 2005-04-23
Anonymous

For the person looking for an enterprise level system, take a look at Sophos. It doesn't have all the features of the windows system, but it's pretty close and getting better....

[ more ] [ reply ]

Apple&amp;#39;s Big Virus 2005-04-25
M. T. MacPhee <macpheem@telus.net> (1 replies)

But those macro viruses did not affect the Macs!!!

They affected the security weak PCs!!!

The Mac users had no idea ? their computers worked just fine.

Again. They were not Mac viruses. They were PC viruses. Get 100 Macs and you have no problem....

[ more ] [ reply ]

Apple&amp;amp;#39;s Big Virus 2005-04-27
Anonymous (1 replies)

Ummm, no. None of our PCs were affected due to solid enterprise antivirus. As a matter of fact, without the virus protection installed on the PCs, our detection would have lagged much more and our costs to clean would have been much higher.

I wouldn't say that $thousands sunk into cleaning off Ma...

[ more ] [ reply ]

Apple&amp;amp;amp;#39;s Big Virus 2005-04-29
Anonymous (1 replies)

Accusing the Mac to have virus because it "spreads" (transfer rather) macroviruses that affects the common winPC is like accusing TCP/IP for being virus prone and for spreading Sasser......

[ more ] [ reply ]

Apple&amp;amp;amp;amp;#39;s Big Virus 2005-04-29
Anonymous

That is what Macro viruses do on the PC. They spread, but rarely do actual "catastrophic" damage. However, an employee emailing a macro virus to a client will do just as much reputation damage and will incur the same legal liability whether it comes from a Mac or a PC. Virus damage goes way beyond w...

[ more ] [ reply ]

Apple&#39;s Big Virus 2005-04-21
Anonymous (2 replies)

Ms MacFee,

Why do you feel it neccessary to rewrite Kelly's article to prove a point? The article itself is ridiculous zealoutry, and as we see from your post, Kelly is truely preaching to the choir.

Quote: "Why, then, are there no viruses for OS X?"

Reality: Mac OS X has Unix shell scripti...

[ more ] [ reply ]

Apple&amp;#39;s Big Virus 2005-04-21
Kelly Martin (3 replies)

Renepo/Opener was an excellent example of what is possible, in particular because it revealed how a user-level process could place an executable in the user's StartupItems directory, which would then be run with root privileges upon next boot. It did cause quite a stir.

But it was never found in ...

[ more ] [ reply ]

Apple&amp;amp;#39;s Big Virus 2005-04-22
Anonymous

Quote: "But it was never found in the wild. It also required a user be socially engineered to execute it, or else the attacker would need physical access to the machine."

Firstly, if it was reported there's a good chance it's out there. Just not widespread enough to be classified as much of a th...

[ more ] [ reply ]

Apple&amp;amp;#39;s Big Virus 2005-04-22
Anonymous (1 replies)

Hi Kelly,

Its not just opener.sh, check out the recent thread on incidents@lists.sans.org

http://lists.sans.org/pipermail/intrusions/2005-April/008917
.html

So what was the article about anyway? A simple admission of pipe dream security? Its amazing to me that statements such as "Linux is al...

[ more ] [ reply ]

Apple&amp;amp;amp;#39;s Big Virus 2005-04-22
Anonymous (1 replies)

Anonymous,

Psybnc? That's not a virus. That's an Unix based IRC bouncer and not at all specific to OS X. Darwin is Unix, and therefore you can compile and install almost anything you want. If you create a script that has "rm -rf /*" in it, chmod +x it and get someone to click on it; does that mak...

[ more ] [ reply ]

Apple&amp;amp;amp;amp;#39;s Big Virus 2005-04-22
Anonymous

THAT...would make it an OSX-compatible trojan....

[ more ] [ reply ]

AppleScript as virus/ 2005-04-22
Anonymous (1 replies)

Renpo and others require User idocy in order to work. Heck I could send an AppleScript that erased a drive and most of the users 'round here would blindly open it, run it and even type their own password (if any) when asked. requiring user input in itself disqualifies these attempts as virii....

[ more ] [ reply ]

AppleScript as virus 2005-04-24
Matthew Murphy

"requiring user input disqualifies these attempts as virii..."

dream on. Explain, then, Netsky, et al. being at the top of the malware charts, with little more than e-mail as propagation method, however advanced?

Fact is, the vast majority of successful malware requires user idiocy, as *THAT*...

[ more ] [ reply ]

Apple&amp;#39;s Big Virus 2005-04-25
M. T. MacPhee <macpheem@telus.net> (1 replies)

re: security updates

"The price of freedom is eternal vigilance"

OS X is malware free not because of happy accident. It uses the most secure version (BSD) of the most secure available operating system (UNIX), and the open source community and Apple work hard to keep it that way. Their succe...

[ more ] [ reply ]

Apple&amp;amp;#39;s Big Virus 2005-04-27
Anonymous

...It uses the most secure version (BSD) of the most secure available operating system (UNIX)...

I wouldn't say its the most secure at all. Mac OS X does use some bits like network stack from FreeBSD.

But FreeBSD does not live for security.

OpenBSD is the only BSD variant that lives for se...

[ more ] [ reply ]

Apple and its Big Virus 2005-04-30
Anonymous

Don't wait here.

OSX is 'nix in its core, i.e. built as _server_ OS from the gorund up. I do not need to write a stupid virii code for the server OS, I need to look for an error in security configuration, in order to exploit perfectly healthy machine. If I want to stole and use a car, I want it i...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Encrypto (1 replies)

From a personal perspective, I made the switch 3 years ago to OS X and have not looked back. When I first made the move it was based on the unix underpinning that was the attraction. The security aspect was secondary. Now, I enjoy the fact that I do not get the nasties of the net reducing my product...

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous

Not to mention Spyware and Adware. ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
M. T. MacPhee <macpheem@telus.net> (3 replies)

I think the only point that you miss, and Brian came close to, but skirted as well is the following:

To write really good malware, you need to have the machine for which it is targeted. Any potential malware author is going to have to fork out at least US$500 just to join the club.

$500!!! ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Jason Miller

My only real concern with apple and security is that when an exploit is released apple drags their feet in releasing patches. And even more ironically the patches sometimes do more harm than the exploit itself.

On another note, I totally agree with the notion that for a long time now Apple has b...

[ more ] [ reply ]

Apple's Big Virus 2005-04-21
Brad

I wouldn't count on the security through elitism angle working for much longer. Now that the G5 systems are out, perfectly usable G4 systems can be had for under $500. I just nabbed a fully loaded 867MHz box for $430 including a 15" LCD!

This article seems predicated primarily on the idea that ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Biz Nerd

As Bruce Schneier realized a while back, security and anti-security (e.g. cracking) is about microeconomic risk assessment and decision making.

Anything that creates a barrier to threat creation is a legitimate security measure. That includes both real and *perceived* barrier creation. Percep...

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous (1 replies)

Hey hey.. hold it.

If you spend your life in an unsafe enviroment brothels and unsafe sex (Windows) you are much more prone to gets AIDS than if you are on a less risky environment (Mac OS X).

That, my dear friends, is a fact.

OS X, for whatever circumstances they are today.. is a safer OS....

[ more ] [ reply ]

The infested beast indeed! 2005-04-23
TJ (1 replies)

As others have said, it's not the OS. I've run every flavor of Windows since Windows 95 personally and professionally without ever an instance of spy/malware or any virus/worm. How's that possible if Windows is the problem? The OS is only part of the entire picture here....

[ more ] [ reply ]

The infested beast indeed! 2005-04-25
Pecos Bill (1 replies)

Have you ever run your Microsoft OS withOUT anti-virus software on the Internet?

I have yet to install such on OS X.

Note, there is a piece of malware out there called "Opener" by its author and Renepo-A on here. (It's a root-kit.) It's more of a trojan though called a worm. It doesn't propaga...

[ more ] [ reply ]

The infested beast indeed! 2005-04-27
Anonymous (1 replies)

I run 5 Windows OSes and have anti-virus on only one of them. I generally find that anti-virus and exploit code do not function happily together even when you tell the anti-virus to ignore directories.

I have never gotten a virus, trojan or worm that i did not place on my system to determine eff...

[ more ] [ reply ]

The infested beast indeed! 2005-05-01
Anonymous

Interesting how the posts arguing for the security of Windows have to either include optional anti-viral software, or do the XP + Patch qualification....

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous (14 replies)

If there are no viruses for the Mac why do Symantec make anti-virus software for it?...

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous

$$$...

[ more ] [ reply ]

Apple's Big Virus 2005-04-23
Anonymous

First, Office documents can be infected with cross-platform virii, although most such critters don't run "correctly" on the Mac. Also, starting with the OS X version, Office is pretty hardcore about warning the user about documents that contain macros.

Second, lots of users hear computer virus ho...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Ummm... because they can make money doing so?...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Umm... how about PROFIT?...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Primarily to detect viruses written for windows so that you don't pass them on. At least for now.......

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Because suckers will buy it....

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Symantec creates antivirus to scan for and remove all the PC viruses out there so that you don't inadvertantly pass them on to the Windows world. I can't tell you how many times I have gotten a file from someone that was perfectly legitimate, but Norton caught it and cleaned it out. It was likely ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

To cleanup Window viruses. If the above poster who had trouble with Office macro viruses had Virex running, life for him would have been much better....

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

To answer your question, Symantec makes antivirus software so that Mac users don't inadvertently transmit MSOffice "viruses" like macro viruses. Note that these "viruses" cannot infect MacOS, but can be retransmitted to PC users....

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

A) So that they can make money (this is the main reason).
B) To protect against Microsoft Office macro viruses, which can infect Mac Office.
C) To keep OS X users from passing viruses along accidentally (i.e. via e-mails). George sends an awesome (and virus-laden) e-mail to Bob, who uses OS X. Bob...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

Namely Office Macro viruses, which are not "OS X" viruses, they are Office Macro viruses. And besides, just because someone sells something doesn't make it useful, I could sell you a rock that keeps tigers away, I haven't seen a tiger in years (before I got the rock) so it must work....

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

> If there are no viruses for the Mac why do Symantec make anti-virus software for it?

You mean aside from the venal desire to make money? Business works just as well on fictious need as real need. The former is often more profitable!

...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

According to most article I have read so infected files from on PC will not be passed on to another PC through a Mac.
...

[ more ] [ reply ]

Symantec makes Antivirals for uninformed CIOs and IT staffs 2005-05-01
Anonymous

People like me have to get Symantec antiviral for Mac because the corporate IT staff who has never used a mac insists all computers attaching to the corporate network needs to have an antiviral program installed.

Sometimes they are even willing to buy a copy for me.

So should I waste hours to ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous (2 replies)

Still, strange things can happen, even on MacOSX. I had to rescue a friend of mine after he clicked on an attachment he thought was a jpg in an email. OSX thought it was a jpg too but when Preview tried to open it rather than saying it was not the right format, Preview actually crashed his system! T...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
Anonymous

BS. Preview cannot crash the system. All it can do is crash itself. So Preview unexpectedly quit. Big Whoop!...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

Yah! Right! Intel code ran on a Motorola code machine at machine level? or jpeg code was executed as instruction rather than data? How did that work again?...

[ more ] [ reply ]

Apple's Big Virus 2005-04-22
Anonymous (1 replies)

Perhaps Apple would consider a virus a vulnerability of the OS and fix it, while others leave a market for antivirus - firms...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

Oh yeah, sure. Remember when they tried to *SELL* us their Security Patches for OSX (the Panther release). That was classic.

http://www.eweek.com/article2/0,1759,1490804,00.asp

...

[ more ] [ reply ]

Apple's Big Virus 2005-04-23
Anonymous

Just because no OS X virus hasn't been seen in the wild doesnt mean that one hasn't already been writting ;) . ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-24
dave (1 replies)

The real underlying issue is that the mind set of Microsoft and Apple are much different.
Microsoft specifically engineers in gateways that allow the advertisement and monitoring of their products as well as the ability to trigger global obsolescence. The products garner the largest profits availab...

[ more ] [ reply ]

lol 2005-04-25
bob (2 replies)

Alright, mac boy simmer down now.. Dont spill your starbucks coffee.

I think everyone is missing the huge picture here.. If you distribute anything to the scale that microsoft has, you WILL experience more security issues... Who wants to code a virus which only effects less than 5% of the worlds ...

[ more ] [ reply ]

lol 2005-04-26
Anonymous

Right on! I also own a small company that does consulting for SMBs. At one of my clients they have a ratio of about 2/3 PC/MAC.

We have had tremendous headaches in regards to PC/MAC compatability when it comes to file servers. Our main file server is a Win2K box running apple file sharing. Si...

[ more ] [ reply ]

lol? Not me, I'm crying... 2005-04-30
Anonymous

Ladies and gents, you're missing the point. Right now, there are not a lot of script kiddies exploiting OSX (of any 'nix). No need - drive the stolen car when its owner does not know about it. I'm sure there are at least 10% of 0\/\/ned Macs (the number is arbitrary, just made it up. It can be every...

[ more ] [ reply ]

Apple's Big Virus 2005-04-25
Anonymous

strange indeed. Intel code executing on a Motorola code machine. Or even stranger data code executing as instructions without overflowing a stack somewhere....

[ more ] [ reply ]

Apple's Big Virus 2005-04-26
Anonymous (2 replies)

O.K. I get it! You MS'ers think you're cool. Great. Don't forget the McAfee; Symantic and the PHYSICAL firewall.

Longhorn may be secure--in 2009

Security can be done BEFORE Longhorn! Really! Check it out-- Mac OS-X...

[ more ] [ reply ]

Apple's Big Virus 2005-04-26
Anonymous

Rah Rah Rah...

[ more ] [ reply ]

Apple's Big Virus 2005-04-27
Anonymous

Why the heck do I need to SPEND money to use BSD technology?

I just download and use FreeBSD (which OS X is largely based on) for FREE. And if I'm in the mood, buy the CD to support the project. (to show appreciation for their work).

I don't need to spend money on ridiculously styled hardware ...

[ more ] [ reply ]

Apple's Big Virus 2005-04-27
Anonymous

Why does this link exist on Apple's website if Macs are immune?

http://www.mac.com/1/iTour/tour_antivirus.html

We need to wake up here folks. No more arrogance before the fall....

[ more ] [ reply ]

Warez and Office Mac 2005-04-29
Anonymous

Also viruses and malware are introduced into Windows machines by using warez. In the Mac OS world, I remember reading that there was a version of Microsoft Office Mac, that was destructive. Therefore, I would not say that there is none malware on a Mac.

Yes, in theory it should be legal, but on t...

[ more ] [ reply ]

Apple's Big Virus 2005-04-29
Anonymous

Sounds about like Oracle's "Indestructable" rant, we all saw how that turned out......

[ more ] [ reply ]

Apple's Big Virus 2005-04-30
Anonymous

I'm a big fan of your articles Kelly. You make me proud by your thoroughness and thoughfulness with a topic area. Thanks....

[ more ] [ reply ]