MacDailyNews - Where Mac news comes first

Apr 23, 09 - 09:03 am Comment from: Virus Free

ANY COMPUTER IS SUSCEPTIBLE TO MALWARE IF THE USER INSTALLS IT USING THEIR ADMINISTRATIVE PASSWORD.

What separates OS X and Windows is that on Windows, malware installs itself from everyday activity, like surfing the web, emailing, exchanging files etc.

On OS X, one doesn't need anti-spyware or anti-virus.

On Windows you do.

Apr 23, 09 - 09:05 am Comment from: breeze

CNN: experts??????

"We get... an agenda, a particular specialty of CNN's."

You can fscking say that again. MSNBC might be slightly worse, but both totally lack any semblance of journalistic integrity.

Right, teabaggers?

Apr 23, 09 - 09:12 am Comment from: Virus Free

On Windows you live in constant fear of being infected, losing files, losing credit card or other valuable data to thieves invading your machine.

On OS X you don't.


On Windows you need the support of a IT person, either a whole department, a paid guru or a trusted friend willing to help.

On OS X you don't.


On Windows you need to check constantly that your machine is not infected, then run another anti-malware to check to see if your current anti-malware hasn't been disabled by a new virus if was unable to detect.

On OS X you don't.


On Windows you encounter hardware and software glitches from so many companies making PC's, lousy drivers and compatibility issues between softwares.

On OS X you don't.


On Windows your constantly being bombarded with drive by installs, altering your programs.

On OS X you don't.



the list goes on and on....

@Virus Free
Brilliant Post. I'm going to repeat it.

On Windows you live in constant fear of being infected, losing files, losing credit card or other valuable data to thieves invading your machine.

On OS X you don't.


On Windows you need the support of a IT person, either a whole department, a paid guru or a trusted friend willing to help.

On OS X you don't.


On Windows you need to check constantly that your machine is not infected, then run another anti-malware to check to see if your current anti-malware hasn't been disabled by a new virus if was unable to detect.

On OS X you don't.


On Windows you encounter hardware and software glitches from so many companies making PC's, lousy drivers and compatibility issues between softwares.

On OS X you don't.


On Windows your constantly being bombarded with drive by installs, altering your programs.

On OS X you don't.



the list goes on and on....




MW: Seems - It seems that Windows users believe these problems to be normal computing issues. DUMB!

CNN and other mainstream media don't just distort and misinform.

They are also guilty of consistent censorship.

Here is just one of many examples:-
http://www.911blogger.com/node/19899

Apr 23, 09 - 09:31 am Comment from: ron

Preaching to the choir. All this needs to be on a Windows site.

@Virus Free

Bravo!

To everyone in general, my only contribution to this discussion is that I am worried about those Mac users who use an account with administrative privileges as their normal, everyday account. The account one sets up when you first turn on your brand new Mac is such an account. In some cases, the system may not prompt you for an admin password to install software simply because you *are* running as an admin.

What I've done for all my family's computers is set up their computer as usual, then immediately setup another, standard user account for them to use as their everyday account. The only thing the admin account is used for is software installs & updates, and system backups. True enough, that's another account & password to keep track of on each machine. But I do, and it works.

Of course, they can still install from their standard user accounts IFF they know the admin account & password. Then MDN's warning really applies. But we all know that if the system unexpectedly requests an admin account name & password, the response is to stop right there and triple check to make sure you know what you are doing.

""Security via Obscurity" is a defense mechanism for the delusional"

You couldn't be more right, just not how you think. Any security expert will tell you those who rely on it are deluded.

Apr 23, 09 - 09:33 am Comment from: Jay-Z

@ dd:

"It seems that Windows users believe these problems to be normal computing issues."

Until they try a Mac.

Apr 23, 09 - 09:35 am Comment from: Jay-Z

@ Kevin:

That is good advice for everyone and not common knowledge. In Snow Leopard, Apple should explain this, have users set up an admin account, THEN have them set up their account for every day use.

Apr 23, 09 - 09:36 am Comment from: Virus Free

Do not steal software. Do not download and authorize the installation of applications (Trojans) from untrusted sources. No OS can protect users from themselves (or we wouldn't be able to install any software). Those who grant attackers access to their Macs, should not be surprised to find their Macs are compromised in any number of ways, including being subsumed into botnets

I hate to say this, but Apple is primarily responsible for trojans.

First off, it's a severe security issue giving your administrative password to ANY application that doesn't involve altering OS X itself in some manner, like cloning softwares, OS X customizing etc. Something you have the most trust in.

Early in OS X days, the only way to install most applications was by "drag and drop" into your Applications folder. No administrative password was needed.

Now it seems every darn application demands a administrative password (the keys to root) for a simple install into your applications folder.

When you give a application install your admin password, who knows what it is doing? What devious resentful third party programmer has put some malicious code in there? What nosey marketing department wants to know about your surfing habits? Or how about just plain shoddy programming?

95% of exploits are in applications!

The reason this continues is because a company has spent it's wad developing a application, it doesn't want to pay to fix any security issues that arise after the sale, it cuts into profits.

Some apps that depend upon updates will fix bugs, but it's constrained. Buy the new update.

Apple is dependant upon hardware sales, this is why OS X has great security.

However that security gets thrown to the wind if third party developers are free to compromise it.

Unless software is from a reputable source, I will not enter my admin info for an install. If a developer does not know how to create the drag and drop "install," I won't waste my time.

"What separates OS X and Windows is that on Windows, malware installs itself from everyday activity, like surfing the web, emailing, exchanging files etc."

Macs have been vunerable to the same attacks for a long time, but those hacking for money go where the user base is. A self propagating worm targeting only Macs would starve to death.

In the same way as most Mac fanboys will never find anyone to breed with, a worm will never find enough Macs to transfer to.

Since most home users sit behind the strong firewall in their ISP vendor's modem, which acts like a strong layer in front of Mac OS's security, small islands of home users are hard to infect by direct connection. Trojans and web based malware, at least as the initial attack vector are the only real approach there. And the last two Pwn2Owns have shown that when somebody actually bothers to try, the Mac always goes down first.

Apr 23, 09 - 09:49 am Comment from: Demon

The only way to have gotten the Trojan was to install the affected Bait Application. In this case a Stolen Copy of iWork. In the old days the bait application was a warzed copy of Photoshop. interesting that this is even still a story. It's not like this Trojan is self replicating or even spreading, In fact the last estimates I say showed that the Botnet created by the Trojan was down to just a few hundred systems and continuing to shrink rather quickly.
Indications are that the Mac OS botnet was sponsored by... Wow! there's lat
Gun fire outside....BRB

Apr 23, 09 - 09:52 am Comment from: MizuInOz

Let's see.... I think I will diagnose the problem with CNN's "expert" - he has rectalcranialosis... it means he has his head firmly planted up his... well you get the idea.

Why do I say this? Because the article is based on old news and BS from so long ago and is continually perpetuated that it is starting to be believed by the purveyors of the BS.

I have NEVER had any type of corruption on my system. I am even sus of some legitimate software. And if I don't get a warm fuzzy feeling about a product, I will not download or install it.

I have never had a piece of "free" or "archived" software on my system. I can't afford the grief and it is kind of hypocritical since I patent or copyright all of my work.

Cheers.

It's CNN so I'm certainly not surprised. Those turds are so damn biased and inaccurate that I quit watching their so called "news" network long ago.

Apr 23, 09 - 09:57 am Comment from: HMCIV

I've been crafting a Mac Trojan that looks like a free music player but secretly becomes a word processor.

Apr 23, 09 - 10:01 am Comment from: jjjj

funny that the story was big news on CNN.com the day earnings was announced. I'd bet that someone shorted the stock. Suckas!

"Rational"

STFU, troll.

The other reason "security through obscurity" is stupid is that pre OS X Macs had plenty of viruses.

Apr 23, 09 - 10:22 am Comment from: Virus Free

Macs have been vulnerable to the same attacks for a long time, but those hacking for money go where the user base is. A self propagating worm targeting only Macs would starve to death.

Yes the larger user base of Windows and it's easily infected OS is a more tempting target. OS X gets bragging rights. And a worm for OS X would starve to death because other Mac's don't have a "open window" policy of ports like Windows XP does.


In the same way as most Mac fanboys will never find anyone to breed with, a worm will never find enough Macs to transfer to.

troll of course.

Since most home users sit behind the strong firewall in their ISP vendor's modem, which acts like a strong layer in front of Mac OS's security, small islands of home users are hard to infect by direct connection.

Not all ISP modems are routers, that seems to be the new trend though, a combined device. Which does force the user into extra protection. Then if the combined router/modem is directly connected to one machine, does the router function (with firewall) kick in by default or not is the question.

Trojans and web based malware, at least as the initial attack vector are the only real approach there. And the last two Pwn2Owns have shown that when somebody actually bothers to try, the Mac always goes down first.

With the Pwn2Own, it's about bragging rights to see who can bring down the mighty Mac. The exploit was already written ahead of time using a current web based exploit, thus it was targeted first naturally to gain the prize.

Trojans and web based avenues of attack are the way into a Mac box, the web based attack method is universal across all browsers.

Ever since word got out that the FBI is using web based exploits (put there on purpose perhaps?) to install spyware to monitor suspects, it's been a hay-day for crackers.

I applaud their efforts, because only through this method can the the holes be sealed, and trust restored.

If the FBI wants to search my machine, get a warrant, monitor the ISP, I've got nothing to hide.

But if a web based security hole is left purposely open, then anyone could leave damaging evidence, and with a Mac user, using a supposedly "hack proof" computer as widely advertised, would have a hard time explaining how damaging evidence appeared on their machine.

Microsoft has taken in billions of dollars for a virus called Windows.

LOL! I guess Micro$quish realizes new ad campaign isn't working so well. Seems like they are resorting to they're same old dirty tricks again. CNN, put down the paycheck!

@ Kevin:

The original login created during the install does have administrative privileges, but that does not mean the account is run as an 'admin'. The account created is a normal user account, except that it is added to an 'admin' list. So whenever an administrative task needs to be performed by a user, that list is referenced. If that particular user is on the list then he/she is asked for a password. If not, then he/she is asked for both an admin account name and the password or sometimes flat out denied, depending on he task.

As an 'admin' the only time you're not asked for a password is if the task happens to fall within a security session; in OS X when you give your password to do an administrative task, a security session is set up for that account which has an expiration or some other timing mechanism. You can continue to perform other administrative tasks without the need to re-enter your password for each task, as long as the session hasn't timed-out or expired.

This security timing mechanism is most noticeable in iTunes... If you've ever authorized a purchase by entering your password, you'll notice you can continue to make purchases within a certain amount of time without the need to re-enter your password for each purchase. If you wait long enough between each purchase, the session will expire and you'll be asked to enter your password again.

wanted to add...

The only account on a Unix system that has free-reign over a system is the account with a user id of 0, usually named "root". By default OS X disables the root account, which is one of the biggest steps towards securing a Unix system.

I believe the biggest issue with Windows and why it was considered so venerable, was because of two problems... The first being, all the unsecured networking ports that were open by default and the second was the users used admin accounts as their normal everyday accounts (once logged in as an admin, you had complete control the entire time you're logged in), which left the entire system open. If malware were to find its way into an open network port it could take over the entire system. This of course made networked Windows machines extremely easy system to take advantage.

Apr 23, 09 - 12:00 pm Comment from: Think

CNN - "Complete Narcissistic Nobodies"

Hope they go the way of NY Times.

Soon, very soon...

Apr 23, 09 - 01:30 pm Comment from: Zeke

@Rational:

Two things are obvious from your post.

#1 You're jealous and wish you could afford a Mac.
#2 You know zero about Unix (OS X) system security and design.

The pwn2own Mac "success" story required a pre-written malware app and physical access to the machine. Oooooo, scarey!

Nice to see CNN is once again cutting edge and first with a story. This particular one was reported on january 26th 2009 by Ars Technica.

Apr 23, 09 - 01:44 pm Comment from: Anonymous©

Is this an iReport?

By default OS X disables the root account, which is one of the biggest steps towards securing a Unix system.

Root is disabled by default on OS X, that's true.

However that's the "root user", root is still running and can be accessed via the administrative password utilizing "sudo root" (meaning "super user do" which root is the super user)

This is how OS X updates are performed, without having to enable and then log into the "root user" using a root level password.

So giving a installer your admin password is just like giving the root password, it CAN DO ANYTHING IT WANTS TOO!!

This is why trojans work on OS X, and why we will be seeing a lot more trouble in the future from malicious apps.

"Then if the combined router/modem is directly connected to one machine, does the router function (with firewall) kick in by default or not is the question."

It always does. ISPs have learned that having that one simple feature enabled does so much to protect naive users from compromise.

"
With the Pwn2Own, it's about bragging rights to see who can bring down the mighty Mac. "

What's your point? Because Macs are easy to exploit first that they're more secure?

"By default OS X disables the root account, which is one of the biggest steps towards securing a Unix system."

But any admin user can re-enable it and set it's password. Hmm. Doesn't that mean getting admin means getting root?

"The first being, all the unsecured networking ports that were open by default and the second was the users used admin accounts as their normal everyday accounts (once logged in as an admin, you had complete control the entire time you're logged in), which left the entire system open."

That's a nice description of how it worked on Windows boxes 5-10 years ago.

"#1 You're jealous and wish you could afford a Mac."

This is written on my Mac. An expensive one.

"#2 You know zero about Unix (OS X) system security and design."

No, I've spent enough time hacking and securing Windows and Unix boxes to not be as deluded as you about Mac OS X's invulnerability.

But, you know what, it really doesn't matter to me if you do get hacked. It's not like you haven't been warned enough.

Some people they see a guy walk up to a Mac, click on an arbitrary link and own the box, and say to themselves "this could never happen to me", "They only went after the Mac first because they wanted a Mac" and "no-ones doing this in the real world" and stuff like that as if they're trying to believe the attacks never succeded.

Can Macs be attacked in the same way as PCs? Sure. That's now beyond all doubt. If you believe otherwise you should go join the flat earth society or pick up and champion some other dated and disproven idea.

The only next step, as always happens, is for those attacks to start showing up in the real world.

I think a Mac should come with a separate Admin account out-of-the-box. It's a small precaution that many mainstream users would not know about or think to take. But a Mac should make that trivial, just as they backup trivial with Time Machine, by giving users best-practice as the default.

Apr 23, 09 - 04:49 pm Comment from: derekcurrie

Symantec FUD goes on forever. CNN licks it up out of ignorance.

The fraudulent 'security by obscurity' myth has an origin vortex. That origin is Symantec. They created the anti-Mac security FUD campaign in August of 2005. Their purpose: Sell Symantec Norton Whatever. Their anti-malware software remains to this day infamously buggy and a CPU hog. Rather than rewrite the monstrosity they consistently choose FUD instead.

The 'security by obscurity' myth was put in the grave several years ago. You can read the tombstone I wrote for it over at my Mac-Security blog:

mac-security.blogspot.com

The myth is a quick and easy litmus test for whether any 'security expert' is a pretender or the real thing.

Super hilarity: I recently read that one of the executive FUD mongers at Symantec had decided the turning point for no longer being 'obscure' was 15% market share. And where did he pull that number from? You don't want to know. You don't want to go there.

There are two good things about anti-Mac security FUD:
1) It gets a good laugh every time!
2) It has motivated Apple to exponentially increase their attention to Mac OS X security, resulting in a very much safer operating system.

One thing always accompanies FUD: Desperation. When honesty fails to sell your rubbish, go for the last resort: LYING.

"The 'security by obscurity' myth ...
The myth is a quick and easy litmus test for whether any 'security expert' is a pretender or the real thing."

Absolutely because they will know the original definition of Security By Obscurity as opposed to yours.

There is no-one in the security community who believes Security By Obscurity is a real defense to anything. Yet Mac users depend on it every day.

"Can Macs be attacked in the same way as PCs?"

No.

But please continue lying.

And to put the security through obscurity myth to bed for the Nth time, the original Mac OS had somewhere in the neighborhood of 70 viruses for it.

Since OS X is waaaaaay less obscure than the original Mac OS, then it should certainly have more viruses for it than a grand total of ZERO, right? Well, it doesn't. The grand total IS zero.

I eagerly await the year 2017 when I dig this Mac out of the closest, take it online just for fun, and read about how the impending Apple malware disaster is still going to strike ANY DAY NOW!!11!!!1.

And if you think 2017 sounds farfetched, hey, I've been reading about the impending Mac apocalypse for 8 years so far. Why not make it another 8?

"That's a nice description of how it worked on Windows boxes 5-10 years ago."

And there are still alot of those Windows boxes out there - being sold at garage sales or flea markets for real cheap prices. The average home PC user is still ignorant of all the steps they must take to secure their computer. And why should they? They were told that Windows XP was the most stable and secure operating system ever - that is exactly what it says on my upgrade box for XP.

As a long time Windows user I finally tried a Mac 6 years ago and will never go back. I still have an XP machine but it will never connect to the internet again.

And honestly, if there were a 100 viruses discovered for OS X tomorrow, I would still use a Mac. The user experience with Apple's OS is miles ahead of anything Microsoft will ever come up with.

We have like, what, 30 million Macs connected to the internet nowadays? Let's say that there are at least 29 of these that have no form of virus protection whatsoever. Also, Mac users are generally richer than PC users, right?

So how the heck is it not an attractive target to hackers if it really was just as vulnerable as Windows? You'd be catching a huge number of unprotected users off-guard.