Industry


Ads by TechWords

See your link here


Preston Gralla's picture
Preston Gralla

Seeing Through Windows

Researchers: Macs are less secure than Windows PCs

For years, Apple fans have claimed that Macs are invulnerable to attack, while belittling Windows as being full of security holes. Now the tables are turned --- not only has a Trojan infected Macs and created a botnet, but several well-known researchers warn that Mac OS X is less secure than either Windows or Linux.

In the last few days, there's been a great deal of publicity about the discovery of the world's first Mac botnet. When Mac users downloaded a pirated copy of iLife, their machines were taken over by a Trojan. At that point, according to Symantec experts Andy Cianciotto and Angela Thigpen:

When the Trojanized installer is executed, it also runs the malicious program iworkservices. The Trojan, OSX.Iservice, targets the Mac OS and is compiled as a Mach-O multi-architecture binary. This allows the Trojan to run natively on both PowerPC and x86 architectures.
...
The Trojan acts as a back door and opens a port on the local host for connections. It then attempts to connect to the following remote hosts:
69.92.177.146:59201
qwfojzlk.freehostia.com:1024.

Symantec notes, in its description of the Trojan, that the threat of being infected by this malware is low. Still the mere fact of its existence, and a botnet run by it, shows that the claims of Mac folks that Macs are invulnerable to attack, are simply false.

If that news wasn't bad enough for Mac fans, the New York Times reports that security researcher Dino A. Dai Zovi claims that Macs are less secure than either Windows or Linux machines.

It's no idle claim; Dai Zovi won the Pwn2Own hacking contest in 2007, and is author of the Mac Hacker's handbook.

He told the Times that

"I have found that Macs are less secure than their current Windows and Linux counterparts. At least for the last several years, Apple has lagged behind in security, largely because the threat hasn’t been there."

He's not alone. Mac security expert Rich Mogull told the Times the same thing. The most recent versions of Mac OS X are "inherently less secure than the latest versions of Windows," he told the newspaper. Mogull says that several years ago Mac OS X was more secure than Windows because it has a UNIX foundation. But new kinds of attacks means that "all the Unix protections can be circumvented."

So for those in the Mac community who believe the Mac is invulnerable, there's this simple message: You're living in the past.

What People Are Saying

The author forgot to mention

The author forgot to mention that the malware he discussed was distributed with a cracked software release and the user grants the malware access to the OS' system files in order for it to infect the system.

So unless you can develop an artificial intelligence that can deduce whether the cracked program you are deliberately giving root access will be harmful to your computer, you are vulnerable to attacks. And I simply don't see how this is the OS' fault.

Can you tell that it is always a similar user error that cause a Windows computer to be infected? I think not.

Beg to differ

He DID mentioned it was a cracked copy.
"When Mac users downloaded a pirated copy of iLife, their machines were taken over by a Trojan."

And you don't need A.I. to protect against such a thing, although it was a user mistake especially since it is Apple software they could have easily sent a hash of the .DMG file to apple servers, and if there is a mismatch which there would be because the script would change the hash alert the user.

Oh, please....

The only time I see the statement that Macs are invulnerable to attack are in Mac-bashing articles where the writer is setting up a straw man argument.

Saying that my Macs have never been attacked (which I can truthfully say), is not the same as saying that they are invulnerable to attack.

all os is insecure

Let me tell you this, the reason why macs are/were/is secure is from the simple fact before you install any major app that requires root it requires a password to even install. This is the same as in linux and more recently vista(UAC anyone?). The security is not an issue it is the person behind it. It is easy to write any exploit for any os, but it is the installation on the host that is the hard part. In xp it was simple because users didn't know better and would install, and exe can install because the installation doesn't have to be verified from the user and it is granted administration rights. Once you have admin rights any thing and everything can happen. The reason why linux users don't have that much issues is because of the person who uses it, they are the traditional geeks who not only are able to install, but compile from source programs.

The article is flawed because it did not explain how the trojans were installed. The crack program required root privileges and prompted the user to input the password and that is how the trojan got installed; through IGNORANCE. It is the user who let this install, os x would not, but trusts the user a bit more.

The biggest security hole in any OS is not the os it self, but the browser. Back in the day browsers were just simple HTML render programs, but now there is java, asp, php, and other things that it has to do and there are program plugins up the wazoo. These have really good access to the computer and apple and microsoft have their respected sandboxing to help prevent this. If you read the Dai Zovi on how he hacked it you will find out that it was an exploit in safari, but to let that happen he had to email the user and the user had to click on it. This proves that it was not the OS but a third party program. In the end it is the end user that has to be educated.

"Let me tell you this, the

"Let me tell you this, the reason why macs are/were/is secure is from the simple fact before you install any major app that requires root it requires a password to even install."

Oh, like my Windows machine? No wonder I don't feel the need to use AV or antimalware software of any kind. And have NEVER suffered an infection of ANY kind, ever. Truth.

Yes, indeed, that Apple OS is genius, pure genius.

If you have never installed

If you have never installed AV, how do you know you haven't been infected?

I think that you are write,

I think that you are write, if the mac users never has downloaded an Anti Virus how they can know that their machines are "clean" and in good state. I want see all your face when hackers start making more and more malware to the macs.

I normaly use an old laptop

I normaly use an old laptop with Ubuntu,but I am using my son's MacBook Pro,I would rather suck worms than use Windows even if it is suposed to be more secure !!

Oh come on, seriously

Uhh. Hello? Any operating system that you allow to run a piece of software is going to be vulnerable. If you download an illegal copy of iLife, and it has a trojan packed for ANY operating system, chances are you will be infected. Windows does have the advantage of constantly being bombed by these items, so IF you are running an anti virus program, you MAY catch the thing after the fact, but there are anti virus software available for the mac too. I'm not so much concerned about user-ran viruses that do secretive things behind the scenes. This is a UNIVERSAL problem and not something you can pin down to a fault of an operating system.

If you want to talk about serious concerns, you should look at exploitations of arbitrary code that allow the program to do root-like privileges (also known as root kits) without having elevated rights, or look at software in general and how many exploitations are available, especially remotely.

Every operating system suffers the above, as no programmer is perfect no matter how awesome their SDK is. The question is how much software are you running, what are the program's track records on creating patches and getting it to their users, and how much time is it between this?

An advantage of a *nix like system is it gives you control on what you want or don't want to install. You don't have to download patches for internet explorer even if you never have used it once. Hell, in a linux-like environment, you can actually UNINSTALL internet explorer. You also have a ton of options as to solutions of the software you want to run. This means that when a specific outbreak occurs that targets a specified program, you potentially wont' be running it, and the infection isn't as serious.

I'm not a huge fan of Ubuntu due to it's growing popularity, however it does offer a packaging system that if you install products through this, you are automatically updated patches to your various pieces of software, even if it isn't directly created by the Ubuntu team. This is something Microsoft should note and consider, as this does give Ubuntu (This is carried through many distributions, by the way, such as most BSD, gentoo, SUSE, etc) the ability to keep their users fully patched.

Those are what you should measure security on. Not on a small botnet outbreak that is ran via the user allowing it to execute.

Mac/PC/Linux? It doesn't matter, and here's why...

Y'all are missing the BIGGER point: The HUMAN factor, and it applies across the board, regardless of the OS. Us "geeks" see the world through our "tech-colored" glasses, with tunnel vision, and we miss the whole picture.

Software of any kind, be it an operating system or an application, is written by HUMANS. Humans make mistakes; humans miss seeing things; that's what makes us who we are. Humans also tend to be a trusting bunch, and that's what gets us into trouble as well. Social engineering has been going on for millenia; you don't believe me, look up the definition of "Trojan horse".

Whether OSX's latest security breach requires human interaction doesn't matter; the fact that it exists shoots a huge hole into the Mac fanboi's argument that "Macs don't get viruses." Whatever your opinion of Windows and Microsoft is, the superiority complex of the Mac brigade is annoying and getting quite old. And, the *Nix boys aren't that far off from their Mac conterparts either; sure, you are constantly hassled for a root password, but what IF an "amateur" downloads and installs a Linux Trojan (and, before you say they don't exist, it's not a question of IF, but rather WHEN), and they type that root pwd, it's GAME OVER. That's what I mean by the human factor.

Until such time as we humans become perfect(which you'll be waiting a LOOOOONG time), these issues will crop up.

Skynet anyone????