I'm a Daniel Eran Dilger fan. I've enjoyed bantering with him in the past over at ye olde Mac Advocacy Usenet newsgroup for many years. He writes one of my favorite blogs called RoughlyDrafted Magazine.
Yesterday Dan posted a great article called "The Mac Malware Myth". Being my notorious self, I posted a few replies to the article. Seeing as the replies are directly applicable to Mac Security, I decided to toss them here as well. My replies are a bit redundant of previous stuff I have written, but I also find them to be nice little summaries of useful information. So here goes:
Reply #1:
HISTORY: ‘The Sky Is Falling’ FUD started in August of 2005. The first perpetrator was our old pal Symantec. Who else. McAfee fell in line by the end of the year. But oddly, the CEO of McAfee was then quoted as saying the single best way to avoid malware on computers was to, you guessed it, use a Mac.
In the following three years there was an actually wonderful event: The FUD got to Apple and they got seriously serious about Mac OS X security. Believe me, Apple had NOT been serious about it previously. As a result there was an exponential increase in Apple Security updates. There was also one enormous revelation: Apple QuickTime was a massive security hole. If you review the security improvements in Quicktime over the last year you’ll realize this is a fact. The problems first became obvious in December 2006 when one of its vulnerabilities was exploited by hackers at MySpace who managed to use a cross site scripting hole in Quicktime to hack thousands of MySpace pages. Apple rapidly provided a fix and got to work cleaning up the rest of their messed up code.
In October 2007, the very very very first Mac OS X malware in-the-wild showed up in the form of a porn site Trojan horse masquerading as a Quicktime component you were supposed to install in order to watch a website porn video. That was over TWO YEARS after ‘The Sky Is Falling’ FUD began. Then over the last year a horrifying TRICKLE happened. While Windows was flooded with thousands of new malware, including real life viruses, Mac OS X was made slightly damp with another seven Trojan horses. Did I feel a drop?
Reply #2:
“Security By Obscurity”
… Is a joke, always was, and I suspect always will be. I wrote a shocking article, over at my Mac-Security blog, about how to prove it is a joke to all but the most dimwitted among us. It uses mathematics, which apparently confuses dunderheads and trolls.
Why is there no such thing as ‘Security By Obscurity’ for Mac OS X?
Because Mac OS X is UNIX. It’s certified! Look it up! UNIX was built from day one to be profoundly secure. Windows never was. That’s why Microsoft, to this day, have the single least secure operating system commercially available. Very sad. Very true.
Do not ever expect Mac OS X, even if it becomes as popular as Windows, to have any amount of malware as massive as Windows. Mac OS X is, here’s that word again, PROFOUNDLY more secure than Windows. There is no such thing as perfect security. Mac users have no excuse for not paying attention to security. But never let any joker, dimwit or troll fool you that there is such a thing as ‘Security By Obscurity.’ What really exists is solid state Mac OS X security that prevents hacking and cracking far better than anything Microsoft will ever come up with. That is literally why they have 99.99999999% of the malware and Mac OS X users statistically have next to nothing. And yes, they’ll hate you for telling them the truth. Just smile back.
;-Derek
Reply #3:
OK, so you want to be a responsible Mac OS X user, and want to be prepared for any Mac malware lingering out there in the wild. What do you do?
1) Never install anything that you have not verified as 100% legitimate software. That means specifically two things:
A) Never believe any notice anywhere that says you must install something being offered to you. Go check it out and download it from a reputable site that checks out software and provides user reviews. These include Versiontracker, MacUpdate, Download.com, TuCows, etc.
B) Never install pirated software. The most recent Trojan for Mac OS X specifically hides inside pirated software installers, pretending to be an installer package, installed right along side the legitimate installer packages.
2) Go get a decent free anti-malware program. (The term ‘anti-virus’ is out of date). My only recommendation for a FREE program is ‘iAntiVirus’ free edition from PC Tools. It is up to date. Do NOT bother with ClamXav. It is well over a year out of date regarding Mac malware. (I have personally attempted to improve this situation but found it fruitless).
Of the commercial/shareware anti-malware programs, the only one I recommend is Intego’s VirusBarrier. It works great. I own it. Got a nice deal on it too. Downside: You have to pay every year for updated malware definitions. Not worth it! See #1 above. Go get iAntiVirus.
3) Keep up with security updates. Always install Apple Security Updates when they are provided via Software Update for your Mac. Always install updates to applications and plugins. Quicktime has security holes. Adobe Flash has security holes. RealPlayer has security holes. Etc.
4) Use security tools and techniques. This includes working as a ‘Standard User’ on any network, not as an Administrator. You can also encrypt your account using Apple’s provided File Vault. You can also lock down your Mac using a Firmware password. There are loads of other security utilities on the net. Three I like are 1Password, Little Snitch and Gnu Privacy Gaurd (which is free!)
5) The #1 Rule of Computing, repeat after me:
Make
A
Backup.
If you don’t, you get what you deserve. Cruel. Reality.
That’s my list!
The end.
--
In the following three years there was an actually wonderful event: The FUD got to Apple and they got seriously serious about Mac OS X security. Believe me, Apple had NOT been serious about it previously. As a result there was an exponential increase in Apple Security updates. There was also one enormous revelation: Apple QuickTime was a massive security hole. If you review the security improvements in Quicktime over the last year you’ll realize this is a fact. The problems first became obvious in December 2006 when one of its vulnerabilities was exploited by hackers at MySpace who managed to use a cross site scripting hole in Quicktime to hack thousands of MySpace pages. Apple rapidly provided a fix and got to work cleaning up the rest of their messed up code.
In October 2007, the very very very first Mac OS X malware in-the-wild showed up in the form of a porn site Trojan horse masquerading as a Quicktime component you were supposed to install in order to watch a website porn video. That was over TWO YEARS after ‘The Sky Is Falling’ FUD began. Then over the last year a horrifying TRICKLE happened. While Windows was flooded with thousands of new malware, including real life viruses, Mac OS X was made slightly damp with another seven Trojan horses. Did I feel a drop?
Reply #2:
“Security By Obscurity”
… Is a joke, always was, and I suspect always will be. I wrote a shocking article, over at my Mac-Security blog, about how to prove it is a joke to all but the most dimwitted among us. It uses mathematics, which apparently confuses dunderheads and trolls.
Why is there no such thing as ‘Security By Obscurity’ for Mac OS X?
Because Mac OS X is UNIX. It’s certified! Look it up! UNIX was built from day one to be profoundly secure. Windows never was. That’s why Microsoft, to this day, have the single least secure operating system commercially available. Very sad. Very true.
Do not ever expect Mac OS X, even if it becomes as popular as Windows, to have any amount of malware as massive as Windows. Mac OS X is, here’s that word again, PROFOUNDLY more secure than Windows. There is no such thing as perfect security. Mac users have no excuse for not paying attention to security. But never let any joker, dimwit or troll fool you that there is such a thing as ‘Security By Obscurity.’ What really exists is solid state Mac OS X security that prevents hacking and cracking far better than anything Microsoft will ever come up with. That is literally why they have 99.99999999% of the malware and Mac OS X users statistically have next to nothing. And yes, they’ll hate you for telling them the truth. Just smile back.
;-Derek
Reply #3:
OK, so you want to be a responsible Mac OS X user, and want to be prepared for any Mac malware lingering out there in the wild. What do you do?
1) Never install anything that you have not verified as 100% legitimate software. That means specifically two things:
A) Never believe any notice anywhere that says you must install something being offered to you. Go check it out and download it from a reputable site that checks out software and provides user reviews. These include Versiontracker, MacUpdate, Download.com, TuCows, etc.
B) Never install pirated software. The most recent Trojan for Mac OS X specifically hides inside pirated software installers, pretending to be an installer package, installed right along side the legitimate installer packages.
2) Go get a decent free anti-malware program. (The term ‘anti-virus’ is out of date). My only recommendation for a FREE program is ‘iAntiVirus’ free edition from PC Tools. It is up to date. Do NOT bother with ClamXav. It is well over a year out of date regarding Mac malware. (I have personally attempted to improve this situation but found it fruitless).
Of the commercial/shareware anti-malware programs, the only one I recommend is Intego’s VirusBarrier. It works great. I own it. Got a nice deal on it too. Downside: You have to pay every year for updated malware definitions. Not worth it! See #1 above. Go get iAntiVirus.
3) Keep up with security updates. Always install Apple Security Updates when they are provided via Software Update for your Mac. Always install updates to applications and plugins. Quicktime has security holes. Adobe Flash has security holes. RealPlayer has security holes. Etc.
4) Use security tools and techniques. This includes working as a ‘Standard User’ on any network, not as an Administrator. You can also encrypt your account using Apple’s provided File Vault. You can also lock down your Mac using a Firmware password. There are loads of other security utilities on the net. Three I like are 1Password, Little Snitch and Gnu Privacy Gaurd (which is free!)
5) The #1 Rule of Computing, repeat after me:
Make
A
Backup.
If you don’t, you get what you deserve. Cruel. Reality.
That’s my list!
The end.
--
