Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Does Sophos' Switch Argument Hold Water? 249

Posted by timothy from the 40-lashes-with-a-willow-switch-story dept.

Wednesday's press-release-borne message from security firm Sophos that the best way for Windows users to compute untroubled (or less troubled) by malware is to switch to Mac OS X drew more than 500 comments; read on for the Backslash summary of the conversation.

Several readers pointed suspicious fingers at Sophos' motive for issuing the message in the first place; no one can call a company whose products are meant to offer "protection from viruses, Trojans, worms, spyware and spam" a disinterested party in evaluating OSes. Techguy666, for instance, writes "We use Sophos at our workplace. I also use other antivirus and antispyware — often to clean up the crap that Sophos doesn't find. Speaking as someone who's familiar with Sophos, I think it's curious that Sophos is telling home users to consider buying Macs. Go to Sophos' website and try to find a home user product ... They don't seem to promote any. If I were a conspiracy theorist, I would think this is a warning shot aimed at Microsoft because of MS's sudden focus on security, to the detriment of companies such as Sophos; send Microsoft's small clientele to the enemy &mdash it's no skin off of Sophos' corporate nose. ... They're talking to an audience that they don't serve or interact with."

(To this, an anonymous reader writes "Sophos has a number of fat contracts with institutes of higher learning, like mine. Every student has access to a fully licensed copy of Sophos if they so choose — available for Windows 98-XP, Linux, and OS X.")

A subtler gripe comes from Kope, who calls the metrics used by Sophos "misleading," and writes that "[s]aying that the most common malware only effects Windows, therefore Macs are more secure is simply bad reasoning. ... I'm sure that 'out of the box' Macs are better. But it's not 'out of the box' that I care about. My concern is level of security during actual operation. I have no problem believing that Macs are more resistant to malware, but this measure doesn't show that to necessarily be the case."

ZachPruckowski agrees that Sophos's claim is based on a "dumb study," but not that there's an easy line to draw between out-of-box and long-term use: "For 75 percent of the world, 'out-of-the-box' == 'during actual operation.' It's those people who get infected by malware. Don't expect users to do any extra work beyond going straight to Office or IE or their email app. Thus, 'out-of-the-box' is a pretty important state."

Whatever the company's reason for issuing what many Slashdot readers would consider the farthest thing from a discovery, no reader's comments seemed to cast doubt on the conventional wisdom that Mac users are at present far safer from malware than are typical Windows users — the reasons behind that situation, though, are hotly contested. One version of the story is that OS X, by dint of its design (including UNIX-style multi-user orientation and compartmentalization generally) simply can't help being more resistant to viruses and spyware; Windows intentional integration of operating system components has let security flaws in one small part of the operating system (such as Internet Explorer or Outlook) become flaws in all the others, too.

Reader cwgmpls, for instance, doesn't buy the argument that OS X is safe only because it's more obscure than are the various versions of Windows.

"Even if OS X is only 5% of all PCs in the world, surely there are a good number of hackers out there who would love to release an OS X virus into the wild, just to prove it can be done. Besides, the total number of OS X installs today is certainly greater than the total number of Windows installs that existed at the time the first Windows virus was released.

Most hackers don't need a huge number of installs to stroke their ego. The opportunity to prove that OS X is just as vulnerable as Windows should be more than enough to motivate someone to release an OS X virus into the wild. Yet no one has done it.

There must be more at work here than OS X's small market share. OS X must be inherently more secure than Windows to not have a virus in the wild six years after its release. Certainly there are enough hackers out there who would love to show their prowess by writing an OS X virus, even for the relatively small number of OS X installs that exist; but nobody has been able to do it yet."

Several readers assert that the real reason has little to do with the hardware or the software used by the rival camps, and is mostly an issue of user education and sophistication. Typifying this argument is reader WombatControl's (unsurprisingly contested) conclusion that "the Mac userbase tends to be a lot more savvy than the Windows userbase." His argument, in short:

"I'd hazard a guess that the vast majority of Windows malware comes not from the inherent insecurity of the Windows platform but from users doing dumb things. Someone who installs some stupid little weather applet and gets infected with spyware got infected not because of a flaw in the system, but because they didn't bother to determine whether or not the source of their software was credible or not. Even if they got a prompt like Vista and OS X present they'll still authorize the program. There's no patch that can be applied to a system to prevent stupid users from mucking it up. ...

Macs are more secure because Mac users have a much tougher stance towards crapware. Mac users tend to be much more technically proficient than the average. If that "zero-tolerance" policy changes, I'm not so sure we'll see an increase in the amount of malware targeting Macs.

OS X does a great job of providing technical barriers against malware, but nothing can prevent malware that uses social engineering to do its work. Mac users are safer because they choose to be - but if you get a group of users who have no awareness of security and will blindly execute anything they come across, even if the system specifically tells them not to, that could change very quickly."

Several Windows users agreed with the thrust of this argument — namely, that no system is truly safe from a determined, malicious attacker unless users (or their trustworthy proxies) head off not just automated attacks, but social-engineering tricks that really have little to do with the OS a user is interacting with. Their approach is based on heading off malware.

Readers like snwod (a sometimes user of Mac, Linux, and Windows) offered a level-headed synopsis of this approach: "I run a good firewall/anti-virus combo along with using Ad-aware and the rest. I don't click on banner adds and I don't install strange pop-up programs. Pretty simple really." Result? "[I] haven't had a virus or malware problem in years."

To this line of reasoning, though, aphor says "My grandma's Mac isn't infected, and she clicks on everything! I'm calling bullshit. Please produce the infected Mac. One synthetic test does not make a real-world case. I run the system updater on my grandma's Mac about 3-4 times a year. That's probably 1/10th (liberal estimate) of the exposed vulnerability that a [Windows] box has."

Even if sophisticated trickery might fool any user, Savage-Rabbit thinks avoiding mechanically the more widespread script-kiddy attacks is nothing to sneeze at: "I bet there still is a fair number of Windows users who envy the Mac zealots for not having to waste their time pruning Norton/Panda/Macaffee/etc... anti-malware suites with monotonous regularity never mind the endless nag screens these anti-malware suites throw at you."

The status quo has a way of not staying that way in the long term, though, and reader spyrochaete contributed one of the several (and sane) cautions against hubris on the part of OS X users, though the same logic applies to Linux and other systems whose security may be real and considerable but is grounded in part on being a smaller target for online vandals and thieves than is Windows. As he writes, "They said the same thing about Firefox, but that's starting to change. Mozilla is fixing holes all the time and I'm starting to see ads that get through Adblock (stupid Mediaplex). This is just an article about security through obscurity — the best kind of security according to too many Apple fans I've talked to. ... Faith in obscurity means you'll be totally unprepared when disaster strikes."

Amen!

Thanks to all who took part in the discussion, especially those readers quoted above.
This discussion has been archived. No new comments can be posted.

Does Sophos' Switch Argument Hold Water? More

Does Sophos' Switch Argument Hold Water?

Comments Filter:

  • Slashdot now run by pointy-headed managers (Score:5, Funny)

    by Anonymous Coward on Thursday July 06, 2006 @05:30PM (#15670933)
    This story-about-a-slashdot-story idea must have come from 'management'. Soon to be featured in Dilbert.

    • Re:Slashdot now run by pointy-headed managers (Score:2, Funny)

      by Anonymous Coward
      There's a story-about-a-slashdot-comment idea [seenonslash.com] that came from fans and not management.
      • Am I the only person that can't get SeenOnSlash to render properly?

        All the actual content is outside the white area, all the way over on the right hand side. (This is with Firefox 1.0.7.

        It's odd -- I've used Firefox for a while now, and never had a problem with very many pages rendering (outside of the odd bank page or something that just refused to work). But in the past week I've run into two pages that just looked awful in Firefox, obviously poorly created, but looked okay in other browsers. Are site aut

        • Re:Seenonslash (Score:2, Informative)

          by Anonymous Coward
          try Seamonkey..really, it's better. Pages look better, load faster, stuff like that. You can just install the browser part if you want. It really is better than FF now. I run both back to back all the time just to check, every new stable release-Seamonkey wins hands down. FF has the press and all the bloated extensions, the things that can take the "small fast" browser concept they pushed into the humongous memory bloated hog that it is now. Plus, Seamonkey isn't dumbed down into kiddie candy land status in

    • Re:Slashdot now run by pointy-headed managers (Score:5, Insightful)

      by vought ( 160908 ) on Thursday July 06, 2006 @07:52PM (#15671893)
      At least this post is written in English and is comprehensible. Try making sense out of the "promote my blog" Apple non-post [slashdot.org] from earlier today.

      I think Slashdot is in serious need of maturity. This is not 1998 anymore, and stories like the one I cited make this place look like it's run by 14-year-olds - the PowerPoint deprived intellectual partners of those pointy-headed fools we love to hate. Immature 14-year-olds who are failing English, at that.

      What a joke this place has become - the commenters are as, uh, great as always, but the stories, editing, and crap that makes it to the front page are ridiculous. I mean, yay for the redesign, but pissing in a jeweled goblet doesn't make the piss taste better.

    • I have seen several dissing these new story+commentary summaries, but I have to say I like them a lot.

      I don't always get to read every last story on Slashdot (like some of the complainers, I suspect) and I even less often get to read a decent chunk of the comments. Having EDITORS filter through all that and pick out the gems saves me a lot of time and (hopefully) features the best of Slashdot.

      One personal note on the topic of malware.

      Personally, I've only ever been bitten by a hack on my Debian GNU/Li
      • I don't always get to read every last story on Slashdot (like some of the complainers, I suspect) and I even less often get to read a decent chunk of the comments.

        That's interesting. I do it the other way. If I see a catchy headline, I skip straight to the comments. You can usually figure everything else out by reading the first +5 informative comment ya run across. You can even figure out whether it's a good idea to RTFA.

  • Out of the box is one thing (Score:3, Informative)

    by Saven Marek ( 739395 ) on Thursday July 06, 2006 @05:30PM (#15670936)
    Out of the box may be one thing, but continuing use is something else.

    Don't let anyone tell you macs have no malware, it's just not true. from Renepo the rootkit, to php worms that send out spam infecting message boards, to word macro viruses to the recent oompaloompa, they affect macs as badly as they can affect windows.

    One thing that tells mac users they have fewer viruses is poor antivirus software. A friend of mine works in a mac shop and often people will come in with bizarre problems with their macs. No networking working, slow networking, random crashes, won't wake properly from sleep. Scanning with an antivirus package shows no viruses, yet a software reinstall fresh from scratch fixes many of those problems. What does that tell you caused the problems? Some malware running on the machine is what.

    When mac software gets up to scratch in detecting the worms that are out there for macs, that is the only time people will get the truth about maleware infections. Sophos need to get off their ass and make something more worthwhile for macs and then we'll see who goes saying what about security.

    • Piss off moderators. (Score:3, Interesting)

      by Anonymous Coward
      Goddammit moderators, it's this kind of moderating that makes the problem worse. I run a mac house, and word macro viruses are the bane of my existence. Word is absolutely ESSENTIAL to our business, and currently no mac antivirus software properly rids a mac of word macro viruses, fullstop. We've been through them all, and over & over we end up with client documents coming in, infecting other client documents, leaving us sending out infected files.

      It's not a nothing problem you can just sweep under the
      • By virus, we tend to mean virus, not macro-virus. It's interesting you say that, I didn't know macro-viruses were still a problem. Why not just turn off macros?

        That said, you have a few options. First, you can stop accepting Word documents. "We only take PDFs." Depending on what you are doing, that may work. Second, convert the docs to PDFs when you receive them (there must be a way to do this outside of Word). Why not use Open Office for everything, and only open in Word as a last resort?

        That said, I don

      • I used to do tech support, and I know your pain regarding word macro viruses.

        Two thoughts:

        - its Word, an MS program. Kinda amusing to see people assert that Macs are as bad as Windows because an MS app is rediculously un-sandboxed.

        - these people HAVE to trade doc files. Its business. Still, its business folks who continue to insist that they must use Word. Its not the OSes problem, its a complete social engineering problem. They're practically sharing .exes through email, hundreds, on a daily basis. No OS c
    • > yet a software reinstall fresh from scratch fixes many of those problems.
      > What does that tell you caused the problems?

      It tells me that your friend is not a competent Mac-Technician. A re-install might be the preferred way to fix a Windows sytem, but it is almost never necessary to reinstall a MacOSX-Box.
      I've used OSX since public beta and have at least a little experience in fixing OSX-boxen.

      > What does that tell you caused the problems? Some malware running on the machine is what.

      And it tells m

  • news? (Score:4, Insightful)

    by Bakadan ( 987312 ) on Thursday July 06, 2006 @05:34PM (#15670969)
    This isn't news. It's just pulp to get people riled up and screaming. Besides, it's nothing we haven't seen before.

    • Re:news? (Score:5, Funny)

      by garcia ( 6573 ) on Thursday July 06, 2006 @05:42PM (#15671045)
      Besides, it's nothing we haven't seen before.

      Oh come on now. It's not like this exact story and many of the comments were just posted earlier this week or anything.
      • Oh come on now. It's not like this exact story and many of the comments were just posted earlier this week or anything.

        Begun the flamewars have! I hope you remembered to charge your lightsaber... here comes the Microsoft droid army and they are pissed!!
      • OK, it summarizes the highlights of that 500+ comment discussion. I find that very useful. Now I do not have to wade through those 500+ blurbs in order to collect some of the most relevant remarks. For a top priority discussion I would want to do that sifting myself, but for something mildly interesting like this it's a very efficient way to get the gist of it.

    • Re:news? (Score:2, Funny)

      by eclectro ( 227083 )
      It's just pulp to get people riled up and screaming.

      It's not pulp, but small reusable pellets. Remember that slashdot is green.
  • No matter what OS exists.

    I believe the anti virus firms are doing normal users a service by keeping lists of known bad software and preventing its spread.
    That software might come in from an exploitable hole in the OS or it can come just as easily by invitation through the front door because the user believed the catch line.

    3 simple words: i love you have been enough in the past, what will it take in future...
    • ...because the user believed the catch line.

      3 simple words: i love you have been enough in the past

      So THAT's why slashdot users' machines are so secure... They would never believe such a catch line!
    • Spyware and Spam would be a maybe, but so far the Mac or Linux/*nix computers don't have any, only Windows. And what happens is a computer gets infected with malware/spyware, and then it becomes a spam bot. But if a computer can be made safe from getting malware first, which again Mac and Linux/*nix are, then spam operators wont have any spam bots, and hopefully we can then track down the sources of spam a lot easier to the server of the spammer. And yes, there are stupid users, my parents are a couple o
      • Umm....You didn't pay attention to this part...

        "Faith in obscurity means you'll be totally unprepared when disaster strikes."

        Your post indicates that you think there will never be an attack on a Mac box. Never is a very long time you know.

        "-----BEGIN PGP SIGNATURE-----
        12345
        -----END PGP SIGNATURE-----"

        Damn....Remind me to change the combination on my luggage!

        B.
    • You understand that the "i love you" thing would
      have been less effective, excepting for the Windows
      feature of hiding file extensions.

  • Well grandma... (Score:4, Insightful)

    by dedazo ( 737510 ) on Thursday July 06, 2006 @05:35PM (#15670987) Journal
    aphor's "Grandma" needs another 150 million or so people to join her in order for someone to develop an interest in creating malware for her operating system. Then it's all just a friendly "Please provide your root password" dialog away.

    Is OS X's attack surface smaller than Windows? Sure it is. Is it impervious to user stupidity? Absolutely not. No operating system is. Linux and OS X will probably eventually get there, and the complain we'll be hearing instead of M$ is teh fuxxorz will be well, what do you expect? users are stupid!!.

    Just wait, and you'll get there eventually.

    [This post is brought to you courtesy of the 300 million absolutely clueless Windows users who think it's OK to run executables in password-protected ZIP files that arrive in their inboxes with lead-ins such as "hello, teh info yuo requesteded is in the attachments". We can't wait for you to take them away]

    • Re:Well grandma... (Score:5, Insightful)

      by rjstanford ( 69735 ) on Thursday July 06, 2006 @05:45PM (#15671070) Homepage Journal
      Disclaimer: I use Windows/UNIX/OSX. I like OSX, but even with IE7 on Windows I haven't been infected. So...

      Then it's all just a friendly "Please provide your root password" dialog away.

      Hmm. I just realized that this is a potential problem -- a major potential problem -- with the OSX and now Vista (and, I believe, some Linux) GUI security paradigms. We're training people to be ready to enter their administrator passwords whenever they're prompted to. And Ma & Pa User won't know when this is a good thing. Especially when badly behaved programs like Adobe's suite raise dialog after dialog during updating. What's to stop EvilSoftCo from creating a program that, during its first-time startup, just creates a dialog box that matches the standard one, and gathers your password?

      Hmm. Not great, methinks. Although surely someone must have thought of this already...
      • We're training people to be ready to enter their administrator passwords whenever they're prompted to

        I can only speak for Ubuntu, which is the most significant Linux Distro that does this, and IIRC I am only prompted after I actively clicked on an entry in the Administration menu.

      • Re:Well grandma... (Score:3, Insightful)

        by forkazoo ( 138186 )

        Hmm. I just realized that this is a potential problem -- a major potential problem -- with the OSX and now Vista (and, I believe, some Linux) GUI security paradigms. We're training people to be ready to enter their administrator passwords whenever they're prompted to. And Ma & Pa User won't know when this is a good thing. Especially when badly behaved programs like Adobe's suite raise dialog after dialog during updating. What's to stop EvilSoftCo from creating a program that, during its first-time start

      • Nope. On modern GUIs you only get prompted for the admin password when you directly try to perform an administrative task. If I click on the printer management item in the administration menu, I expect to be asked for the root password. On the other hand, if I try to run a game I do not expect to be asked for the root password and I'm going to be alarmed if that dialog pops up. Thus my advice to people running various Linux distros or OSX with this facility: if you don't know that what you just tried to do

      • Re:Well grandma... (Score:5, Insightful)

        by TheRaven64 ( 641858 ) on Thursday July 06, 2006 @06:43PM (#15671506) Journal
        Microsoft are the only people who ever solved this problem sensibly, to my knowledge. On Windows NT, you were (I don't believe you are with XP, and it's an option with 2K) required to hit control-alt-delete before you entered your password. This key sequence sent a hardware interrupt which only something running in ring-0 (i.e. the OS) could catch. This meant that it was impossible to spoof the NT login box; as soon as the user hit control-alt-delete, control would be returned to the real login prompt (or a system dialog).

        I proposed two years ago that Apple implement something similar. Create a special key combination that would be caught by the OS and passed to WindowServer, which would then spawn an alert if the app presenting the dialog was not authorised to. This is particularly useful for Keychain access, for example. I don't mind an IM program having access to my login details, but I do object to it having root access. When I install a new version of it, I have to enter my keychain password (which is my login password, by default) in a dialog box that (hopefully) the system presents, but I have no way of verifying that it is the Keychain subsystem that is going to get the password, not the application.

        • Re:Well grandma... (Score:3, Informative)

          by Anonymous Coward
          Poppycock.

          Windows is running in protected mode at the login screen. Generating a hardware interrupt from ctrl+alt+del was a bios feature.

          ergo, if you are running NT, 2K or XP then keyboard is handled by the OS rather than the bios and there is no automatic hardware interrupt. It only works in real mode!!!

          Also, what if you are using a USB keyboard?

      • Re:Well grandma... (Score:3, Insightful)

        by someone300 ( 891284 )
        How about using a dialog box where it shows the user some image or something they set up but only programs with the appropriate permission are allowed to display it. Couple it with "Do not enter your administration password when you do not see this image" or whatever and we're *hopefully* on the right path.
    • Reader cwgmpls, for instance, doesn't buy the argument that OS X is safe only because it's more obscure than are the various versions of Windows.
      "Even if OS X is only 5% of all PCs in the world, surely there are a good number of hackers out there who would love to release an OS X virus into the wild, just to prove it can be done. Besides, the total number of OS X installs today is certainly greater than the total number of Windows installs that existed at the time the first Windows virus was released.

      Most h
    • Is OS X's attack surface smaller than Windows? Sure it is. Is it impervious to user stupidity? Absolutely not.

      Again... Not my problem. Social engineering tricks are only the fault of the user and never the OS.

      The point being is that it is very hard to hit you with invisible or automatic attacks with OS X.

      Sure I might put in an admin password or run a fungame.app which clears out my user directory, but you know... That was my fault and I should hold the blame.

      Other user's stupidity isn't my problem and if it
    • Is OS X's attack surface smaller than Windows? Sure it is. Is it impervious to user stupidity? Absolutely not. No operating system is.


      Exactly. When people talk about "insecure windows" they inevitably bring up Spyware.

      There isn't any spyware on a mac, this tells me there's a lot more credence to the "no marketshare" argument than most people think. Spyware doesn't rely on any security holes... why isn't there spyware on OSX?
    • Yes users do stupid stuff - I can agree with that. It does not give you right to call them stupid - they are probably uninformed in IT stuff same as you are uninformed (I assume) in medicine, dentistics and so on. I don't call you stupid because you (I assume) know shit about medicine and need to use a doctor in case you are sick. That is for starters.

      The real issue is that Windows is inherently insecure because of (order does NOT matter):

      - most users run as Administrators members (and Windows XP SP2 - the

  • The frustrating part... (Score:3, Insightful)

    by AKAImBatman ( 238306 ) * <akaimbatman AT gmail DOT com> on Thursday July 06, 2006 @05:36PM (#15670992) Homepage Journal
    ...is that their argument would have held water if they had done a bit more work. i.e. Instead of saying, "the top 10 viruses only work on Windows", performing an analysis of what flaws were exploited would have been more useful. Then they could have claimed that, "based on the flaws exploited by the most dangerous viruses today, it seems that Mac users will remain more secure for the time being."
    • Correction: "the top 100,000 viruses only work on Windows"

      Yes to caution, no to being silly: you can get killed in a good neighborhood, however if someone suggests you move from let's say Harlem to Beverly Hills you don't come with "Beverly Hills could be unsafe too" argument.

  • Network effects (Score:3, Insightful)

    by ThousandStars ( 556222 ) on Thursday July 06, 2006 @05:40PM (#15671024) Homepage
    I doubt Mac users are any better with computers. The more likely scenario is that it's just too hard to get a Mac virus going. If I wanted to, I could write a small program to completely overwrite a user's directory. But to get it from user to user, I'd have to use social engineering methods via e-mail or IM, and the majority of people in both mediums won't be using Macs. So even if five other people try to open Britney_Spears_naked.dmg, which will e-mail itself to everyone in their address book and then wipe their home directory, if none of those people use OS X the virus stops spreading.

    Obviously it helps that there haven't been any worms on OS X, but in principle writing OS X viruses isn't technically difficult. Spreading them is.

    In addition, Microsoft finally appears to be concerned about security, as demonstrated with XP2 and as will probably be demonstrated in Vista. So the security advantage of OS X is, I suspect, likely to dissipate over time. Still, I plan on using OS X for the foreseeable future.

    • Obviously it helps that there haven't been any worms on OS X, but in principle writing OS X viruses isn't technically difficult. Spreading them is.

      This is true for all OS's. It is the propagation mechanism(s) that are the hard part. Most malware by infection number is not spread as trojans. Especially, most is not spread as trojans not disguised as data. With Windows, it is easier to disguise a program as data and it is easier to find a remote vulnerability to exploit. As you mentioned, it is also easier

    • The reason for sex (Score:4, Interesting)

      by Colin Smith ( 2679 ) on Thursday July 06, 2006 @06:29PM (#15671416)
      I'd have to use social engineering methods via e-mail or IM, and the majority of people in both mediums won't be using Macs.


      There you go. The reason sex exist at all and why monocultures are dumb. Diversity and variation makes life very difficult for diseases.

      In fact the security advantage of OSX isn't likely to dissipate all that much, a monoculture will always be more likely to spread diseases, all it takes is a single flaw and there are going to be plenty of flaws in millions of lines of code.

       
    • so why has no one tried this? Why has no one done a dictionary attack on .mac and tried a get a some slave macs? I mean it is only maybe half a million users, but if mac users are so bad with computers, and 1% fall victim, then one has a botnet of 5000. Not a huge botnet, but not a botnet that is going have a lot of competition nor a lot of pesky spyware detectors.

      No, if it were simple to do, someone would have done it. What is protecting the mac is that the MS Windows is not the softer target. What

  • Maybe, but they're still right. (Score:3, Insightful)

    by spykemail ( 983593 ) on Thursday July 06, 2006 @05:46PM (#15671078) Homepage
    Their motives were questionable. Their evidence was lacking. But they were right. No matter how much the Microsoft trolls talk the fact remains that there is far less malicious software for OS X, even if you take into account its relatively tiny market share. It's also more secure by design, no matter how many minor flaws they find they haven't even come close to what has been (and is currently) wrong with Windows.

    I'm not really surprised that everyone supporting an illegal monopoly has been brainwashed, but it's still kind of sad.
  • The best way for Windows users to compute untroubled (or less troubled) by malware is to switch to Mac OS X

    Or in a more general sense: the best way to be safer from viruses is to use a platform that is not the mainstream one. Mac OS X is one example of something that could be used. Also, Linux, Free BSD, Solaris and various other platforms would work.

  • Why some OSes are more resistant (Score:5, Insightful)

    by Todd Knarr ( 15451 ) on Thursday July 06, 2006 @05:54PM (#15671143) Homepage

    My thought is that there's three reasons Macs and *nixen have fewer viruses.

    • It's partly the lack of market share. That's offset to a large degree by the extra l33t points accruing to the guy who manages to release the first malware to get widespread penetration into those "invulnerable" systems.
    • It's partly user sophistication. Except that Macs are targeted at people who're even less sophisticated than Windows users, who don't want to deal with things like the problems added new hardware to a Windows system. You might be able to argue that a Linux or FreeBSD user's more likely to be a geek, but not a Mac user.
    • It's in large part inherent system design. The basic design point: the seperation between ordinary users and the administrative user (root). That seperation means that, even if you do get infected with malware, the malware can't spread into the system itself. It can't tie into system libraries, it can't have itself started at system startup, it can't disable system services (like the firewall or the malware scanner) and it can't hide itself from the administrative user. This provides a two-layer defense similar to the layout of a medieval castle: once the attackers break through the outer wall, they have to start all over again breaking through the defenses of the inner keep (while being stuck in the yard between the keep and the wall, easy prey for the defenders in the keep). Changes in market share and declining user sophistication won't have any effect on this aspect of things.
    • Umm.. no. Check out a lot of major tech conference, especially in OS and Rails circles. You would be surprised how many geeks use Macs. You'd be even more surprised to hear why. Hint: It's got nothing to do with malware.
      • Well... I work in graphic design, and I interact with dozens of newspapers, printing presses, and other graphic design departments, which are almost exclusively Mac dominated. I assure you, the average Mac user is just as stupid as the average Win user, if not dumber.
    • Comment removed based on user account deletion

    • It's in large part inherent system design. The basic design point: the seperation between ordinary users and the administrative user (root). That seperation means that, even if you do get infected with malware, the malware can't spread into the system itself. It can't tie into system libraries, it can't have itself started at system startup, it can't disable system services (like the firewall or the malware scanner) and it can't hide itself from the administrative user. This provides a two-layer defense sim

    • The type of attacks follow what the system is usde for and good at. Windows is most widely used as a desktop. Lots of clueless users that will exectue software without thinking. Ok, so target that way, send e-mail, ride on top of apps they want, etc. Come in via the front door since there's lots of software flowing in that way. Also Windows hasn't historicly had good remote administration built in and it's still not really the same level as UNIX (and is usually off by default on home machines).

      UNIX systems
    • It's partly the lack of market share. That's offset to a large degree by the extra l33t points accruing to the guy who manages to release the first malware to get widespread penetration into those "invulnerable" systems.

      I don't find this argument convincing.

      These days, I believe the bulk of viruses and worms and malware are created by spam and DDoS guys. Spam is big money, and DDoS is either blackmail or spite. These aren't the same adolescent guys trying to show how cool they are, these are people who

    • Re: (Score:3, Informative)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion

      • My feeling is the guys doing this for money aren't writing the malware. Using kits built by someone else yes, but it's a lot cheaper to use something already prepared than to invest heavily in your own tame uberhackers to come up with original software. The money guys are about ROI, and the ROI on original software just isn't there.

        By tying into the system libraries, I mean tricks like the rootkits use (and that ancient DOS-based stealth viruses used) to make themselves invisible. Modify or override libc o

        • Windows NT and its derivatives (2000, XP) have always had a properly seperated user/admin security model. It's just that a all the momentum of programming in a single-user environment like DOS or Win9x has been letting devs and users flaunt the principles of privilege seperation. For example, the games that insist on installing a kernel mode driver for the sake of copy protection just to run an application, something that non-idiot unix users would never permit. Sony's rootkit wouldn't work without admin pr
          • It's also organizational, and technological. Part of the reason why programmers avoid really dealing with Windows's security mechanism is because it's so goddamn complex. I've done Windows programming for years, and to this day I completely ignore the lpfnSecurityBlahBlahBlah parameter that seems to be at the beginning of every single Win32 call, because it's just so damn intrusive. If you're dedicated to coming up with a comprehensive security policy, Windows gives you the tools to do it, but for most uses

  • My girlfriend's computer is infected... (Score:5, Funny)

    by TexasDex ( 709519 ) on Thursday July 06, 2006 @06:08PM (#15671262) Homepage
    ...with anti-spyware programs!

    She currently runs:
    • a-squared
    • xoft spy
    • Ad-aware
    • Windows Defender
    • Symantec anti-virus corporate edition
    • spybot S&D
    • BigFix
    and her computer runs almost as slowly as it would with a nasty case of malware. She doesn't want to uninstall any of the programs, so she has the cleanest, and possibly the slowest, windows XP machine I've seen. You just can't win. *sigh*

  • It's hard to measure what they are saying. (Score:4, Interesting)

    by Anonymous Coward on Thursday July 06, 2006 @06:11PM (#15671282)
    Well we're talking about relative amounts. I'm a linux zeolot that owns a few macs and loves them, just for the record.

    When you talk about security things and security software people like to have numbers, it makes them feel good. Like the Snort IDS has 3000 signatures (I'm not sure what the latest number is but I imagine it's around 3k) or Norton AV detects 50,000 viruses where non-Norton AV may only detect 20,000 known viruses and some other IDS may only have 100 signatures. Does that make Snort and Norton AV better because they have bigger numbers? For certain types of audits it might be better but for real security it doesn't matter that much. At any given time you're probably only realistically concerned with a smallish handful of IDS signatures or viruses. The old "stoned" viruses for example (of which there are dozens of variants) simply aren't interesting or even terribly important today. This has a direct correlation to desktop security. Basically, the number of holes as a raw metric isn't so interesting, you're really concerned about the holes you have that people don't know about (or maybe they do) Fundamentally though, at any given time there are only a handful of interesting viruses that are active or interesting exploits that people are really using, big databases of them look better but don't mean much.

    Mac OS X isn't built using some exotic technology (or maybe not exotic, Ada or Java would be exotic for an OS) that somehow creates fewer bugs. It's in C, C++ and Objective-C, not that different from windows. It has gone through some porting which might lead to better code and coding practices. Relatively speaking the bug densities should be fairly similar. Apple is different from MS in a somewhat larger way though, they don't have the same resources and so they probably generate a lot less code. They also have to please Steve and rather than adding feature after feature which has kind of been the MS way, they've taken a much more simple route. Less code is less bugs. More features probably does mean more bugs but I'm not sure I've seen that really established as a general truth anywhere.

    The crapware point is an interesting one. Personally, since I've been Mac OS Xing it, my taste and tollerance has changed. I don't know that it's particularly more secure but I do expect things to work and I think I have a higher standard than I have in the past. I know on windows (which I don't use much) I've been less expectent of things working. In the wildwildwest days of Linux I got really use to v0.4 and 0.7 of various things working enough to get some stuff done. On OSX I pretty much demand that things work, I demand that apps are "good." (TM) There are some emotional things that may result in better security, I don't just willy-nilly install stuff, I like some vendors better than others, Apple for example has a track record of building really good software for OS X, I'm more likely to use their shit. Nagware is simply a no-go. To be completely honest, there isn't that much stuff that I really *have* to install on it to get it up and running and productive. I can't remember not "enhancing" a Linux install or windows install before it was "useable"

    Maybe the other biggest thing and I couldn't back this up with real science anywhere, MS has a tremendous legacy to support. Simply removing DCOM or OLE or Active-X might fix a ton of security problems but windows wouldn't keep working. I think Apple may have learned some of those lessons form AppleTalk back in the day; I don't even know if you can make OS X do it, I really have no need.

    • Apple is different from MS in a somewhat larger way though, they don't have the same resources and so they probably generate a lot less code. They also have to please Steve and rather than adding feature after feature which has kind of been the MS way, they've taken a much more simple route. Less code is less bugs. More features probably does mean more bugs but I'm not sure I've seen that really established as a general truth anywhere.

      This is a big issue. Apple has a few hundred programmers total. Microsoft
  • I think there are good technical reasons why MacOS/X is more secure than MSWindows. (the fact that Sophos didn't bother to cite them nonwithstanding).

    The fact of the matter is that more people are going to believe a simple quantified statement than an abstract technical discussion; so Sophos is making the argument that will convince the most people, rather than an argument that would convince, say, the more technical folks on Slashdot.

    Oh, you want the technical reasons? Okay, here goes my list:

    • MacOS/X has a much more stable and mature core Operating System base (Mach). Mach is MUCH older (circa 1985) than the windows NT core (circa 1993), and has been changed less. For example NextStep, released in 1989, was based on Mach, and already did much of what MacOS/X does.
    • Mach (the underlying OS) was designed with security in mind. Note however, the Mach layer doesn't define security policy, it just gives you tools with which to implement such policies. That said, if the current MacOS upper layers [apple.com] get the policies wrong, flexible tools are there to fix it. Contrast that with Windows which has serious design flaws [com.com] in its interprocess communication mechanism.
    • The MacOS command-line code, so far, also seems to have a lower bug-density (similar to Linux) in fuzz testing [wisc.edu] than the MS code, although GUI code is unfortunately sucky in both OS-es.

    • Re:Perhaps not watertight, but not a sieve, either (Score:4, Informative)

      by TheRaven64 ( 641858 ) on Thursday July 06, 2006 @06:55PM (#15671574) Journal
      Mach does very little in XNU (the OS X kernel). It handles threading, scheduling, and VM. Everything else is handled by IOKit (device access) or the BSD subsystem. The BSD subsystem is a weird hybrid, originally forked from 4.2BSD (I believe) and recently injected with NetBSD (in the Rhapsody era) and FreeBSD (more recently) code.

      The fact that Mach was designed with security in mind is why no one sane used it. Mach checked port rights on every message send, which made a Mach system call and order of magnitude slower than a BSD system call. While people might be willing to sacrifice 10-20% of their power for security, 90% is too expensive. This was exacerbated by the fact that Mach required a lot of context switches to get anything done. On OS X, this is irrelevant. The entire XNU kernel runs in a single address space, losing the memory protection benefit that a multi-server Mach-based OS (like Mach/HURD) gains. In addition, Mach messages are only used at the Mach layer (and for a few low-performance things, like notifying the GUI of kernel-related changes), removing this benefit.

    • MacOS/X has a much more stable and mature core Operating System base (Mach). Mach is MUCH older (circa 1985) than the windows NT core (circa 1993), and has been changed less. For example NextStep, released in 1989, was based on Mach, and already did much of what MacOS/X does.

      If you want to go back to the OSes NT and OSX are based on, the NT core is based on VMS [windowsitpro.com]'s design (almost as much as OSX from Mach, though OSX actually uses code from Mach, whereas NT has VMS's developers) and VMS was first released in 1

  • Let's take a look at the arguments. (Score:4, Informative)

    by Anonymous Coward on Thursday July 06, 2006 @06:31PM (#15671426)
    The article and the thread still spout the same uninformed reasoning about why there aren't OS X viruses. Let's take a look at each of the bogus reasons.

    "It's because there aren't many OS X machines."
    Bogus. 4% might be a small percentage, but there are tens of millions of Macs out there. Not only that, Apple users tend to be smug and Apple itself puts out a constant vibe of superiority, plus a very visible chain of elitist boutique retail stores. Is there not a hacker on Earth motivated to take down those arrogant Mac users?
    On top of that, with millions of OS X machines out there, the number of self-propagating viruses in the wild should be greater than zero. But the number is actually zero.
    Surely something more than "security through obscurity" is at work here.

    "Mac users are more sophisticated."
    Bogus. Aren't Macs supposed to be the computer "for the rest of us," the non-technical, the artsy-fartsy, the writers, the musicians, the English majors? Those people are NOT technically savvy, yet they are the Mac's core users.
    Macs have fewer viruses even though their users are not technically oriented and are not security savvy.

    "All you have to do is trick a Mac user into entering their root password."
    Bogus. The root user is not enabled by default in OS X. The non-technical users mentioned above are not going to know how to turn it on.
    You might be confusing the root and administrative passwords, since there isn't that much of a barrier between the two in Windows.

    The Mac is safer because of the nature of Unix architecture and Apple's own safeguards, not because of obscurity or user sophistication. There are things you can get away with in Windows, like certain e-mail-based viruses, that are simply not allowed in OS X. Mac OS X is not invincible, but clearly there are structural advantages to how OS X is set up for security.

    Remember, the number of viruses in the wild for Mac OS X is not proportional to market share, user base sophistication, or anything. It's pretty hard to correlate the number of viruses to any single cause when the number is ZERO.

  • Intel switch resets clock on Mac viruses (Score:5, Insightful)

    by SuperKendall ( 25149 ) on Thursday July 06, 2006 @06:45PM (#15671518)
    We all know a lot of exploits make use of weaknesses in code like buffer overflows to run the attackers code instead.

    Well what happens now that the whole Mac architecture is shifting to Intel? It's substially harder (almost impossible) to write a buffer overflow attack that works on two different processor architectures. You have to choose which architecture your attack is going to execute code for.

    So then if there are not enough Macs around to write exploits for today, it stands to reason that there will not be any significant Mac exploits until the number of mac users at least doubles from current figures, possibly even more.

    Yes there are also attacks that attempt social engineering on a user but they often work in conjuction with more classic code exploits to gain more permission than they would have otherwise.

  • I'm in the "Macs are better designed" camp (Score:5, Insightful)

    by MBCook ( 132727 ) <foobarsoft@foobarsoft.com> on Thursday July 06, 2006 @07:04PM (#15671621) Homepage

    No question in my mind. I'm not saying they are invulnerable. Heck, the community is so tight knit that if you could get something downloaded (say that MacSaber program a few weeks ago) and put something in it, you could get the virus out there. It may be found fast, but you got it out there and by then you may have done damage.

    That said, if I were to run MacSaber for the first time (or some little game or widget or whatever) and I suddenly got a box asking for my root password, you can bet I would be stopped dead in my tracks. You just DON'T SEE those boxes unless you are doing system updates or installing software like Office. If you just download a program and double click on it and get that, you have to wonder what it's doing.

    Now before I switched last year, I had a PC and I ran AV and all that stuff, but it never did any good. The fact is I had a clue and could have run with nothing but my firewall and been fine. You are not guaranteed to get malware on Windows. But let's talk about my little sister and my parents. They download stuff. And since they don't know where the reputable sites are, who to trust, which programs are good, etc... they find that stuff easily. Every time "the computer is broken", it is almost inevitably malware. That or they turned something off I installed they shouldn't have (Disk Keeper, for example, which is practically required to run Windows IMHO). Same thing with neighbors I help. Even if they are somewhat savvy and can use the computer and install hardware, it still happens to them. It's pathetic. There have been viruses that you just have to preview in Outlook to get your OS infested. That is just plain bad design.

    After using my Mac, it is clear to me that any idiot who sits down and uses a Mac day to day is less likely to end up with Malware. From the root prompts, to the fewer security holes, I think there is a clear reason for this divide. Mac users are not smarter. There is a very sizable portion of them that are just like introductory Windows users. They do the same stupid things. The fact they aren't ravaged by malware says something.

    Now I won't deny that the Mac's market share has played a part, you'd be an idiot not to. However, I think the virus-in-the-wild count for OS X (hint: 0) means something. It means instant fame for the first person to make a good virus for OS X. You get it out there, even if it doesn't do much but change people's wallpaper or whatever and you get your name EVERYWHERE. Slashdot, Digg, all the Apple sites, the mainstream computer media (PC World, et all). That is a REAL tempting target. Let's not forget that every time a story like that gets published, it is just someone publishing a big bulls-eye on the Mac. But the market share helps with the pop-up ad problem. How many ads do you see on the 'net that look like a Windows dialog box telling you "Your computer is infected, click here". Guess what, people do. In my house people do, my neighbors have. It tricks 'em. Most people on a Mac wouldn't be fooled by that (just because it looks different). So that kind of thing does make a difference. That report the other day that 80% of users can't tell the difference between a real toolbar and a picture of one was scary.

    Macs aren't immune. The OS is better designed.

    As for Linux, it's better designed too, but it also has some other influences (for example, it would be tough to make a virus that worked reliably across different kernel versions and distro configurations). But again, there are SO MANY Linux servers out there that there must be enough run by idiots that if it was just as bad as Windows we would see a reasonable number of viruses out there (ie.. more than next to none).

    There was a report in my PC World today (I think it was) that was basically scare tactics about viruses ("10 Myths That Make You Vulnerable" or some such). The one about Macs and Linux being safe really made me mad. While they are not immune, Windows for the average computer user is a leaper colony compared to running Mac or Linux.

    • That said, if I were to run MacSaber for the first time (or some little game or widget or whatever) and I suddenly got a box asking for my root password, you can bet I would be stopped dead in my tracks. You just DON'T SEE those boxes unless you are doing system updates or installing software like Office. If you just download a program and double click on it and get that, you have to wonder what it's doing.

      That is a most excellent observation

      • Well that is one of the arguments about asking the user questions. When you ask the user too much, they just say yes. I've done that and gotten into trouble once or twice. When Windows constantly asks "Are you sure you want to delete this shortcut", "Are you sure you want to show all files", "Are you sure you want to download from this site", "Are you sure..." you learn very fast to just say yes because it is too much of a hassle. The only thing those dialogs did was annoy me. When they added them to OS X a

  • We'd have a plurality of systems: 33% Windows, 33% Mac, 33% Linux. Or even 60-20-20. Or any combination. The more the better. Diversity breeds resistance.

    AND

    We'd have more secure OSes. Microsoft is already borrowing from OS X and Linux, which is good

    AND

    We'd have better educated users. This takes patience and persistence. People need to keep plinking away at friends/family.
  • If they were serious, the next update that a virus checker made to a Windows box would be a download of something like Ubuntu ...

    Of course, I would love for the virus checkers and Microsoft to kill each other with their last dying act.

    Now back to my Debian testing desktop with XFCE and Firefox and OpenOffice and Rhythmbox and ...

  • It's simple (Score:3, Interesting)

    by jav1231 ( 539129 ) on Friday July 07, 2006 @09:40AM (#15674797)
    Sure, OSX could/can have viruses. Yes, Word on a MAC can introduce macro viruses. Yes, PHP exploits can run on a Mac. But folks, the proof is in the pudding. If you switch to a Mac, at least now, you will have less virus and malware trouble. It's a fact. Whatever the reason, it's a fact. And people should be doing it. I'm encouraging everyone I know to do it. I've spent countless hours rebuilding systems and/or cleaning them when I can see that if they had a Mac their problem never would have happened. Windows is a sloppy, virus nursery. Yes, OSX or even Linux may/will one day have their share of viruses but today, July 7, 2006 switching is the quickest way to rid yourself of virus and malware issues.

Slashdot Top Deals

THEGODDESSOFTHENETHASTWISTINGFINGERSANDHERVOICEISLIKEAJAVELININTHENIGHTDUDE

Close