Featured Article: Dr. Mac: Rants & Raves - Episode #84: When Good iPhones Go Bad...
TMO Reports - Symantec: Mac Virus, Hacker Attacks on the Rise
by , 10:45 AM EST, March 23rd, 2005
With the introduction and popularity of Mac OS X, Apple Computer has become an increasingly bigger target for viruses and hacker attacks, according to a report from anti-virus software vendor Symantec Corp.
"Contrary to popular belief, the Macintosh operating system has not always been a safe haven from malicious code," said the 96-page report, entitled the Symantec Internet Security Threat Report, obtained by The Mac Observer. "It is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various Unix-based operating systems. Symantec believes that as the popularity of Apple's new platform continues to grow, so too will the number of attacks directed at it."
"I think it's fair to say that Mac users today shouldn't believe they're impervious to attacks," David Cole, Symantec product management security response director, told TMO.
More Macs sold = more security concerns
While Mr. Cole admitted there is no actual data to prove a connection, he said say "it's reasonable to assume that with in increase in market share and popularity comes an increased interest by the hacker attacker community to go after the Mac. No platform is absolutely free of vulnerabilities and no users at the end of the day are impervious because they use a particular product."
The report said an increase in market share for the Mac will be impacted by sales of the much lower priced Mac mini -- a US$500 computer sold without a display, keyboard or mouse -- which may be purchased by less "security-savvy" users. "As a result, the number of vulnerabilities can be expected to increase, as will malicious activity that targets them," the report stated.
The report was clear to say that while the number of vulnerabilities in Mac OS X is expected to increase, they will likely be outnumbered by vulnerabilities in other operating systems, such as Microsoft Windows, for some time to come.
Symantec said it had documented and Apple had confirmed 37 "high-severity vulnerabilities" in Mac OS X since July of last year.
"The appearance of a rootkit called Opener in October 2004, serves to illustrate the growth in vulnerability research on the OS X platform," the report stated. "Additionally, multiple remote and local vulnerabilities have been disclosed that affect both the server and desktop versions of OS X. Vulnerabilities in the Apple windowing system and development kit and in the Apple default Apache configurations are two of the nine vulnerabilities (not all of which were high severity) for which Apple released patches."
A rootkit is a hacker security tool that captures passwords and message traffic to and from a computer. The kit is a collection of tools that allows a hacker to create a backdoor into a system, collect information on other systems on the network and mask the fact that the system is compromised.
Browser attacks very high
Mr. Cole said the biggest "holes" for hackers to attack are vulnerabilities in browsers, where 70% of reported vulnerabilities were considered easy to exploit.
"We saw a large increase over the past six months in security attacks as the market share for Mozilla-based browser climbed," he said. "Their have been 21 documented security concerns with Mozilla in the past six months, which is more than (Microsoft) Internet Explorer."
"This is a massive increase over the single Mozilla vulnerability documented in the previous period and the seven noted in the same reporting period one year ago," the report said.
Between July 1 and December 31, 2004, Symantec documented 13 vulnerabilities affecting Microsoft IE, nine considered high severity. Six vulnerabilities were reported in Opera and none in Apple's Safari browser.
The report called the zero number of confirmed Safari vulnerabilities "somewhat surprising given the increasing popularity of Mac OS X," but suggested that as the browser grows in usage, so will the attacks.
Mr. Cole: Common sense fends off attacks
Mr. Cole said the classic and basic rules still apply to fend off virus and hacker attacks.
"Keep your operating system up to date, your browser to date and your virus definitions up to date," he said. "If you do that, your chances of having problems are minimal."
Observer Comments
QuoteWhile Mr. Cole admitted there is no actual data to prove a connection...
It doesn't say much for Symantec that, in the absence of any data to support their assertion, they went ahead and made it anyway. This isn't the company I want protecting me from the alleged looming onslaught of OS X malware.
QuoteThe report said an increase in market share for the Mac will be impacted by sales of the much lower priced Mac mini ... which may be purchased by less "security-savvy" users.
There is no "actual data" showing that users more concerned about security spend more on their computer, while users who couldn't give a spit about security spend less.
QuoteSymantec said it had documented and Apple had confirmed 37 "high-severity vulnerabilities" in Mac OS X since July of last year.
And zero exploits.
Anyone who thinks any platform is bulletproof is naive, and the silent majority of Mac users know their OS isn't perfect. In fact, the only people who actively call Mac OS X "invulnerable" are those who dislike it for some irrational reason or another.
This whole topic is factless speculation based on false pretense.
Sounds like the next single from the Stone Roses. Anyway...
This little marketing gem from Symantec is quickly spreading as "news" or fact. Reuters, for instance is reporting it, and InPlay (financial briefs for investors) is passing along Reuters report: http://finance.yahoo.com/mp#aapl (that URL may only be valid for a short time):
9:27AM Apple Computer -- Macintosh hacker attacks on the rise - Reuters (AAPL) 42.83: Reuters reports that hacker attacks on Apple's Macintosh OS X operating system, thought by many who use the Mac to be virtually immune to attack, are on the rise, according to a report from Symantec (SYMC). The report says "It is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various Unix-based operating systems." An Apple spokesman said the co would have no comment on the report.
It's rather low of Symantec to pass this off as news, but they've at least got a blatant ulterior motive. But for news sources such as Reuters and InPlay to do so is irresponsible journalism.
Quotejimothy wrote:
But for news sources such as Reuters and InPlay to do so is irresponsible journalism.
And, it's why people like the government use tools like video news releases that we've been hearing so much about lately but that have been around (especially in the corporate sector) for years.
If the media is willing to report your "spin" why not take them up on it?
Perception is reality, right?
while I agree that a lot of the users here are unquestioning apple dweebs... I think Hackers hate Macs less than microsoft, so they are less likely to attack Macs.. also Macs have a lot more security in their operating system.. Its not just because there are less macs, although I concede this may be a factor.. the fact is even if the Mac market share doubles, its still pretty insignificant in the grand scheme of things.
QuoteGuest wrote:
You guys are idiots. Go bed down with your mac's some more. What Symantec is saying is perfectly logical and factual truth. The more mac systems that get out there, the more targets are available, making it a more lucrative system for hackers. It's plain and simple LOGIC. You don't need evidence to back this one up. It's LOGIC. Use your brain. Your mac users, so you're supposed to be all smart, hip, and artsy, so why can't you use logic? Symantec is also not trying to say mac's are bad or you should stay away from them. Let me prove it.
"The report was clear to say that while the number of vulnerabilities in Mac OS X is expected to increase, they will likely be outnumbered by vulnerabilities in other operating systems, such as Microsoft Windows, for some time to come."
Also, he's not just talking about viruses in the article, he's talking about all kinds of security concerns. Like exploits in web browsers, not just viruses.
""We saw a large increase over the past six months in security attacks as the market share for Mozilla-based browser climbed," he said. "Their have been 21 documented security concerns with Mozilla in the past six months, which is more than (Microsoft) Internet Explorer.""
So did any of you even read the article? See, this is why mac people suck. Bunch of wannabe hipsters.
Wed Mar 23, 2005 2:54 pm Subject: lets address the last issue first!
Yep, I read the story, actually the first iteration of it more than a week ago in fact. I'm no wannabe hipster, I'm a communications professional who, through research and 15 years of experience, know where to put my faith in technology. And I don't go around telling people they suck. That's just classless.
""We saw a large increase over the past six months in security attacks as the market share for Mozilla-based browser climbed," he said. "Their have been 21 documented security concerns with Mozilla in the past six months, which is more than (Microsoft) Internet Explorer.""
Considering MS actually abandoned IE for the Mac, of course the number of concerns with Mozilla would outpace it. It's a dead product. Microsoft was probably tired of getting slammed every single day up to that point. It's called lies, damned lies, and statistics. They were only updating it every few months anyway. Mozilla updates at a much faster rate to fix problems. It's called responsiveness.
Why is anybody at Symantec even discussing exploits in Web Browsers? They don't do anything with them to begin with, so what's their point? Symantec is an ANTIVIRUS company, not a web browser or operating system company.
And what you call "factual truth" is a joke, even they admit it's speculation. Sure, the attempts may increase. Is that logical? Of course. But put out there that Mac OS X is now four years old and there has YET to be a single successful virus introduced to the world that actually works and gets into the system. Not one. Yet Symantec reports more than 68,000 viruses for Windows.
That statistic points out very well how badly MacOS X is hurting their programmers business. That's not speculation. That's real.
And that's why this article is so bogus.
Wed Mar 23, 2005 2:58 pm Subject: I'm still waiting ... still ... waiting ... still ...
I have been expecting a genuine virus/worm/trojan to appear on OS X for a couple of years now. Yet, all I keep hearing about are "potential" problems. I have no doubt that anybody with the slightest bit of social engineering savvy could easily port one of the many Linux-based malware worms into a tricky-to-detect wrapper and unleash it onto a macintosh software site. I still have not ever heard of much beyond that fake-Windows Office trojan that was floating around, and I don't think that one really infected too many people anyway.
Opener wasn't widespread. Heck, I don't think it was even discovered on more than a couple of machines.
I have no doubt in my mind that someone could write software that could rip my machine a new one and then run off looking for another machine to victimize, but I have not yet heard ample evidence of the existence of such a monster.
The real question we need to ask ourselves is this:
Why have there been no widespread attacks on Mac OS X?
a.) the platform doesn't have enough units in the field - sorry, but hackers don't just attack based on the size of the victim. They do it because they can, and I'm sure there isn't a hacker out there who wouldn't love to see all the OS X users running for cover and crying about the mean people who beat them up after school
b.) virus writers simply aren't bothering to learn how to exploit OS X - this one makes a lot more sense to me, but it still doesn't completely prevent the situation described in 'a'.
c.) OS X has better security settings by default - I actually think this is closer to the truth. It isn't that Windows systems are potentially less secure. I think it's that many Windows systems had default settings that left them more subject to attack. OS X requires you to activate ports and access levels after the install.
d.) Mac users are smarter the Windows users - Sorry, I don't buy this one either. The only way this logic could be rearranged to approximate something close to the truth would be to say, "There are more easily fooled Windows users than there are easily fooled Mac users." - The only thing is that if Mac does increase market share, it's hard to tell how many of the new Mac users will be security-savvy users and how many will be "I don't wanna think about security - I'm fed up with it!"-users.
Are there other points I might be missing? It's something I've heard quite a bit of discussion about, but I still am not completely satisfied with the possible answers I've heard or come up with myself. Symantec's arguement is based on one reading of why Mac's haven't been attacked, but are there others that Symantec isn't taking into account?
QuoteGuest wrote:
You guys are idiots. Go bed down with your mac's some more. What Symantec is saying is perfectly logical and factual truth. The more mac systems that get out there, the more targets are available, making it a more lucrative system for hackers. It's plain and simple LOGIC. You don't need evidence to back this one up. It's LOGIC. Use your brain. Your mac users, so you're supposed to be all smart, hip, and artsy, so why can't you use logic? Symantec is also not trying to say mac's are bad or you should stay away from them. Let me prove it.
"The report was clear to say that while the number of vulnerabilities in Mac OS X is expected to increase, they will likely be outnumbered by vulnerabilities in other operating systems, such as Microsoft Windows, for some time to come."
Also, he's not just talking about viruses in the article, he's talking about all kinds of security concerns. Like exploits in web browsers, not just viruses.
""We saw a large increase over the past six months in security attacks as the market share for Mozilla-based browser climbed," he said. "Their have been 21 documented security concerns with Mozilla in the past six months, which is more than (Microsoft) Internet Explorer.""
So did any of you even read the article? See, this is why mac people suck. Bunch of wannabe hipsters.
With such a wonderful command of the "when to use an apostrophe" rule, you must realize that most of us "idiots" just dismiss your views as the ramblings of an illiterate fool. Thanks for the laugh, troll. Maybe you should have paid more attention in school.
-Ken P
QuoteGuest wrote:
You guys are idiots. Go bed down with your mac's some more. What Symantec is saying is perfectly logical and factual truth.
There's nothing factual about it. It's pure conjecture. If it were factual, Symantec would have specific numbers, examples, and other facts to support their assertion. They have none.
QuoteThe more mac systems that get out there, the more targets are available, making it a more lucrative system for hackers. It's plain and simple LOGIC. You don't need evidence to back this one up. It's LOGIC. Use your brain.
Let me forward an alternative idea that is also based on logic (no caps please, that's childish) and equally as valid as yours in every way: Because Macs are harder to penetrate relative to other operating systems, hackers will continue to pick the other low-hanging non-Mac fruit simply because it's easy. A greater number of targets does not immediately make those targets more "lucrative". There is a cost / benefit analysis that occurs.
QuoteAlso, he's not just talking about viruses in the article, he's talking about all kinds of security concerns. Like exploits in web browsers, not just viruses.
""We saw a large increase over the past six months in security attacks as the market share for Mozilla-based browser climbed," he said. "Their have been 21 documented security concerns with Mozilla in the past six months, which is more than (Microsoft) Internet Explorer.""
Safari is not a Mozilla-based browser. It's based on KHTML. Firefox is not a Mac-speficic browser, so including it as a Mac-specific vulnerability is a straw man. Whatever point you were trying to make here is invalid. Safari, as noted in the article, has zero vulnerabilities.
QuoteSo did any of you even read the article?
You apparently didn't bother to read it, or learn anything about Macs before posting.
I realize I'm probably feeding a troll. The reason I find this story ridiculous and a bit annoying is because Symantec says that an increase in Mac market share that hasn't happened yet will result in an unquantified increase in unspecified attacks, for which Symantec coincidentally happens to sell the antidote. They admit outright that there is no data, instead relying on assumption when valid examples to the contrary and logical arguments of equal rhetorical weight exist to indicate the opposite. The complete lack of data here precludes the validity of assertions made on either side of this issue.
QuoteGeez you know I was about to mock you, talking about how obviously we all know that as the user base increases so will the possibility of an attack and how your statement of obvious facts is not worthwhile... but then I noticed all these people actually disagreeing with your statement. So I will not mock you. I guess there are a bunch of idiots here. How can anyone argue against the concept of risk increasing as user base increases? Is that not a simple and obvious concept?Guest wrote:
You guys are idiots. Go bed down with your mac's some more. What Symantec is saying is perfectly logical and factual truth. The more mac systems that get out there, the more targets are available, making it a more lucrative system for hackers. It's plain and simple LOGIC. You don't need evidence to back this one up. It's LOGIC. Use your brain.
But, at the same time its also obvious that this is just a PR stunt by Symantec. Its so obvious just from the carefully chosen wording of their press release. But then at the same time you have to feel for these guys. They want to dump Mac since there is almost NO business, but then at the same time they don't want to dump Mac now that the market is starting to expand and seems destined to go much higher.
Wed Mar 23, 2005 4:53 pm Subject: Rendezvous - potential problem
Ya know, I really have occasionally wondered if Rendezvous (or whatever it is going to eventually be called) is a possible danger to OS X.
I'm sure I would have read something about it if it was possible to exploit it, but I have often wondered if there might be some characteristic of it that would basically make it a magnet for OS X malware.
Does anybody have any details about the protocol? I'm fairly certain that it is active when you install OS X.
Instant networking - it sounds great until you find a bunch of uninvited guests in your house.
This is just the old "security through obscurity" myth repackaged. It has been thoroughly debunked, but just refuses to go away. (One good review of the technical reasons OSX is more secure is at http://www.baltimoresun.com/technology/custom/pluggedin/bal-mac082803,0,1353478.column. A Google search of "security through obscurity myth" will find you more.)
Too many analysts won't state the obvious - Macs have fewer problems because the technology is simply more secure - because it sounds like they're taking sides, and no longer unbiased. (Either that, or they just can't be bothered to learn the facts. However, I prefer to think more positively.)
As others have said above, however, what is truly unforgivable is that a vendor's completely unsupported claims are widely reported as fact. If ADT announced as fact that there was going to be an increase in home break-ins without any supporting data, would we this as a lead news item all over the web?
Rendezvous itself is a DNS protocol adapted for service discovery. Short of unusual buffer overruns, it is unlikely to create any security issues in and of itself.
The possible concern is if Rendezvous happily advertises how to connect to some ports that you would rather not have advertised. However, this is more an issue of making sure those ports cannot be exploited, as someone with a port scanner could find them without Rendezvous.