MacDailyNews - Where Mac news comes first

 MacDailyNews Poll

Deal of the Day

5 Day Most Commented

Opinion Archive

Current Headlines

Latest Joy of Tech

  • Latest Joy of Tech!

MacNN

AppleInsider

Macworld UK

TUAW

MacRumors

Yahoo! Finance AAPL

iTunes Top 10 Albums

Mac OS X Downloads

Sun, Dec 06, 2009 - 04:21 AM EST  —  AAPL: 193.32 (-3.16, -1.61%)  |  NASDAQ: 2194.35 (+21.21, +0.98%)

FUD Alert: CNET spews ‘Snow Leopard could level security playing field with Windows’ lunacy
Tuesday, September 01, 2009 - 03:09 PM EST

Apple Online Store"Friday's release of the new version of the Mac OS, dubbed Snow Leopard, could include some security features that would make it secure, or at least push it closer to the level of security that Vista and Windows 7 have, experts said this week," Elinor Mills blathers for CNET.

MacDailyNews Take: What, Apple's dumping the Mac OS X kernel, adding a fargin' Registry, and opening ports at random in Snow Leopard? Give us a break, Ellie, you sound like an idiot.

Mills continues, "Contrary to popular Mac fanboy belief, Macintosh is not more secure from a software standpoint than modern Windows; it's merely safer to use because malware writers prefer to target the platform with the biggest install base, according to Charlie Miller and Dino Dai Zovi, co-authors of The Mac Hacker's Handbook, which came out this spring."

MacDailyNews Take: "Mac fanboy belief?" The idiocy abounds. So, the so-called "experts" Charlie Miller and Dino Dai Zovi wrote a book. So has Paris Hilton and Britney Spears. When these self-proclaimed "experts" Miller and Dai Zovi come up with a self-propagating Mac OS X virus, give us a call. Until then, they should stick their endless FUD where the sun don't shine.

Our firewalls are off: Bring it on, boys. Oh, what's that, all of your "expert" exploits require physical access to our Macs? Or you need us to go to a special URL without having installed the last three Mac OS X updates? So, do you want our Admin passwords, too, or should we just enable root for you? Miller and Dai Zovi are the Victor Lustigs of security experts. Fuzz that, fuzzers. Ellie's just another mark or willing accomplice.

Update: August 29, 2009, 12:23am EDT: This article was originally posted on August 27, 2009 at 11:48am. We're still here. Our firewalls are still off and we're still online with impunity.

Update: September 1, 2009, 3:09pm EDT: Yes, you guessed it, we're still waiting. Our firewalls remain off. Some experts.

Yet again — sigh — it is utterly illogical to state or imply that the Mac platform is secure via obscurity. Why, if obscurity means security, in April 2007 was there a virus for iPods running Linux (a few thousand devices total, to wildly overestimate, in all the world), but there are no viruses in nine, yes nine, years for the over 30 million Mac OS X computers that are currently online? When we hit a nice round virus-free decade will these morons finally STFU? And, why would criminals not target the most affluent personal computer users, the tens of millions of Mac users around the world?

We've asked those and similar questions for years, yet the silence remains deafening and telling. Instead we get a steady stream of lies and/or ignorance, CNET's specialty.

The idea that Windows' morass of security woes exists because more people use Windows and that Macs have no security problems because fewer people use Macs, is simply not true. By design, Mac OS X is simply more secure than Windows. Period. For reference and reasons why Mac OS X is more secure than Windows, The New York Times' David Pogue, provides a concise mea culpa on the subject of the "Mac Security Via Obscurity" myth here.

Simple logic is certainly not what AV software peddlers, Windows PC box assemblers, and the leeches affixed to the Windows ecosystem want people to hear. Fear is what they're after. The sheep must be kept in the Windows pen, no matter the cost to reputations, reality, productivity, sanity, etc. Far too many have far too much invested in Microsoft Windows for them to stand idly by and let it all slip away due to a vastly superior, vastly more secure solution from Apple. But, slip away it does nonetheless.

Every single time there is a Windows virus outbreak or a new OS release, the "Security Via Obscurity" myth gets trotted out. This is done for a reason, even though it gets more ridiculous with each passing year.

"Security via Obscurity" is a defense mechanism for the delusional and also tool for Microsoft apologists and/or those who profit from the Windows economy (see: the bulk of CNET's ads) that's designed to be used when attempting keep Windows sufferers from straying. 30 million Mac OS X installs is not "obscure" at all, but nine (9) years of Mac users surfing the Net unimpeded certainly is "secure." Besides social engineering scams (phishing, trojans; no OS can instill common sense) the only thing by which Mac users are really affected are large swaths of compromised Windows machines slowing down the 'Net with spam and nefarious botnet traffic targeted at exploiting even more insecure Windows boxes.

The. Problem. Is. Windows. Get a Mac.

Mills continues breathlessly, "A screen shot published on the Mac Security Blog of Intego on Tuesday appears to show a security feature supposedly in Snow Leopard that looks like it is detecting a Trojan in a disk image being downloaded via Safari. The post cites unnamed reports about an anti-malware feature being added. 'If it's true, it will mark a fundamental change in that Apple will be admitting that their operating system is as susceptible to malware as other operating systems,' Miller said."

MacDailyNews Take: Charlie Miller, bullshit artist. In the sidebar of his otherwise uninteresting review of Snow Leopard, USA Today's Ed Baig reports, "Macs are known for being resistant to PC viruses, a selling point in Apple ads. So reports from the Intego security software firm about an anti-malware feature in Snow Leopard raised eyebrows... Apple says Snow Leopard merely enhances the 'File Quarantine' technology, introduced in Mac OS X Tiger [emphasis added by MDN], for detecting malware. It works with files downloaded in Safari, iChat and Mail; if malware is detected, Snow Leopard suggests you move the file to Trash. Through the Mac's Software Update technology, Apple has the ability to add the 'signatures' of new malware as it learns about them, potentially avoidng spreading malicious code."

Mills continues spewing FUD in her full hit-piece - Think Before You Click™ - here.

MacDailyNews Note: Contact info:
Elinor Mills:
Scott Ard, CNET Editor in chief: contact via web form

Bookmark and Share

Always -- Free ground shipping with orders over $50 at the Apple Store.

Reader Feedback: = registered.
Unregistered users: Feedback from multiple usernames are subject to deletion. Off-topic and posts from suspected astroturfers will be removed.

Aug 27, 09 - 10:59 am Comment from: DLMeyer

It is ... interesting ... that these ... people ... continue to insist on floating the "security via obscurity" myth. Well, "myth" may be too strong a word, perhaps "exaggeration"? There are more Macs out there than there were iPods running Linux - for certain - and there are more Macs out there than there were Vista Beta-testers - I believe - yet the smaller populations were hit, NOT the Mac. We KNOW the Mac has vulnerabilities, even if the Windows folk didn't keep telling us, Apple keeps patching them. Maybe Mac users are just smarter? More cautious?

Aug 27, 09 - 10:59 am Comment from: x

What a ignorant stupid ass. And a lying ass dog as well.

Aug 27, 09 - 11:02 am Comment from: anypats

I'm so tired of the "virus writers just don't care about the Mac and would rather target Windows users" argument. Who wouldn't want the notoriety of infecting a mass number of Mac computers all because they don't run virus protection or spyware protection software?

Who pays these writers anyway? It seems that since the invention of the Internet (thanks Gore), anyone is suddenly a journalist. My seven year old is smarter than a lot of the "experts" now days.

Aug 27, 09 - 11:04 am Comment from: sparkplug

I was going to read her article, then I saw her byline photo which showed she had blond streaks in her hair. Never mind.

Aug 27, 09 - 11:07 am Comment from: db

The last time I tried to argue this with a friend who'd just bought a PC laptop (even though I'd told him not to) and was already complaining about all the troubles he was having, he totally lost it.

He went off on a rant on me, and then proceeded to tell me how Macs DO SO have viruses, and gave me a web page that listed about 12 (that's right, about 12) viruses, of which 11 were for OS 9 or earlier, and the one left was the trojan horse we've all heard about (which he vehemently argued was TOO a virus).

He got even angrier when I laughed again.

Obscurity? Puh-lease! Every university has a boon of Apple computers showing up in their classrooms. You're telling me no one in their teens and 20's (i.e. typical hacker age) has seen this?

Aug 27, 09 - 11:09 am Comment from: ChrissyOne

While they're at it they can try to attack my site as well. Plain old Mac Mini running plain old Leopard. Should be easy, right?

Aug 27, 09 - 11:10 am Comment from: Tt

I don't want to click, can someone that already clicked please publish here her email address and her bosses email address

Aug 27, 09 - 11:11 am Comment from: john

CNET is a joke when it comes to real technology news. There so bias towards Windows they must be getting paid by Microsoft.
Here's the real headline Cnet, Windows 7, trying to catch up to Tiger and failing miserably, film at 11.
Get real, no one is fooled by your fiction anymore CNET.

Aug 27, 09 - 11:12 am Comment from: ChrissyOne

@Tt

Go directly to her profile page:
http://www.cnet.com/profile/elinormills/?tag=mncol;txt

Aug 27, 09 - 11:18 am Comment from: john

Contrary to CNET, OSX has never been compromised or cost companies BILLIONS OF DOLLARS IN LOSSES BECAUSE OF LACK OF SECURITY unlike Microsoft.
Nor has OSX ever been broken into in the real world contrary to your supposed fairy tale people.

Where do these people make up such garbage?

Aug 27, 09 - 11:23 am Comment from: HMCIV

I once downloaded what I thought was a virus. It turned out to be a word processor.

Aug 27, 09 - 11:26 am Comment from: chew

CNET spoons with Ballmer (shudders)

Aug 27, 09 - 11:26 am Comment from: Falkirk

The security through obscurity myth baffles me. I even hear Apple friendly pundits endorse it. And it makes no sense.

Hackers love to hack. Look back at the time when there were dozens and dozens of operating systems competing for dominance. There were very few actual computers in existence, but there were plenty of hackers attacking them.

Second, there is a huge economic incentive to attack the Mac. It's like saying that no criminal would want to go into the richest neighborhood because it "only" constitutes 10% of the population. That they'd rather spend their time robbing the other 90% because there are more of them.

Finally, hacking the Mac is the Holy Grail of hacking! You've got to be kidding me if you think that every Tom, Dick and Harry wouldn't love to create a virus just for bragging rights alone.

OK. Enough ranting. If I'm wrong, I'm wrong. But I'd like to have someone explain to me why the three points I've made above are invalid. To me the whole obscurity v. security myth is the biggest rationalization in the world. Macs don't have viruses? Why could that be? Could it be because they're more secure? Nahhhhhhhhhhhhh.

Aug 27, 09 - 11:27 am Comment from: Mary

Why write a virus for only 8% of the world?

Aug 27, 09 - 11:29 am Comment from: dd

These so called experts are Windows experts at best. I liken a Windows expert with somebody who grew up in North Philly. They're street smart. They know where and where not to go. They're extremely aware of daily violence, including drugs, gangs, shootings, etc.
Now imagine that North Philly expert telling people that the Doylestown suburbs are just as bad because it's known that some people forget to lock their doors.
Nope. Doylestown is far safer, despite people leaving their doors unlocked.
One reason is because those people, like Apple, care about their neighborhood.
F Windows and its security nightmares. F Windows apologists. Enjoy your $399 desktop that comes free with identity theft software.

Aug 27, 09 - 11:32 am Comment from: ChrissyOne

@ Mary

To say you're the only one who can do it.

Aug 27, 09 - 11:34 am Comment from: Demon

Why don't Journalist do real research any more.

Charlie Miller and Dino Dai Zovi are NOT Security experts, Mac or Windows. I read their book most of it is full of speculation and unfounded assumptions. All the real hacks that they talk about require access to the Console or tricking the user into installing something and the Admin (root) Password. They presented nothing that shows the Mac to be insecure in fact if you read the book you'll come away with the feeling that the Mac OS is Thousands of times more secure then Windows Vista or Windows 7. Many of the security issues they talk about are assumptions and speculations that the Mac OS has the same vulnerabilities as Windows and that attack vectors and methodologies can be the same. Real Security experts will tell you that it's not the case. Because the Mac OS is designed from the ground up differently then Windows, in fact Microsoft for Windows Vista poorly copied Apple's user security model to derive the Windows UAC (the biggest advance in Windows Security todate). One of the issues with UAC in Vista & 7 is it is only skin deep, stupid and constantly required the user to allow actions. In the Mac OS X the User security is at the Kernel and file system level and rather then constantly requiring the user to approve actions/changes (the user just stops reading after the very first one), Mac OS X requires that the user authenticate the main action from that point the OS takes over and looks at what is going on, some Kernel and file system access is protected and the installer/Application is prevented from certain types of access. Hackers and Malware creators soon learned how to suppress and even intercept the UAC dialogs and approve their malware and hack installs without user intervention or knowledge. The exploit code to do it is freely available on a host of hacker sites and IRC Channels. Malware writers can't by-pass Apple's password authentication requirement because unlike Windows Vista & 7 it's not just window dressing it's real protection.

Aug 27, 09 - 11:40 am Comment from: Gosh

journalists just blog! News, facts, research, subject knowledge, competency etc are for lawyers!

It's about column inches and number of posts, that's what pays.

Aug 27, 09 - 11:48 am Comment from: Think

Hey ChrissyOne!

Good to see you on the boards.

Aug 27, 09 - 11:48 am Comment from: What the hell is she smoking?

HAHAHAHAHAHA!!

Is Elinor Mills serious? Was her article meant for April Fools day and accidently got published tragically early?

Snow Leopard could make OS X as secure as WINDOWS VISTA and WINDOWS VISTA 1 1/4: WINDOWS 7?

The mind reels. Contrary to popular paid Microsoft astroturfer lies(I'm looking at you, Ellie dear), Macs are more secure than Windows because OS X is *UNIX*, an operating system which is fundamentally designed with networking in mind, fundamentally designed to sport a multi-user environment, and fundamentally designed to be secure. By very competent software engineers. Since day one.

Gotta love the logic of Microsoft's toadies, though. Who else could come up with the idea that a platform with zero viruses is less secure than a platform with by tens of thousands of them? Many of which are still perfectly capable of infecting Vista/7.

Aug 27, 09 - 11:54 am Comment from: Big Als MBP

Elinor Mills, "So the editor said the new Windows 7 ads are all lined up and we need to say thank you to Microsoft for the business. I want a Snow Leopard hit piece.

Shit, if I knew the editor was going to whore me out like this I would have stayed at the strip club where he found me."

Aug 27, 09 - 11:55 am Comment from: @myself

"Many of which are still perfectly capable of infecting Vista/7."

With more being written every day that *specifically* infect Vista/7, I should add.

Aug 27, 09 - 12:04 pm Comment from: Spudly

C|Net = shill media

Aug 27, 09 - 12:05 pm Comment from: Mac Daddy

Elinor Mills. Bwaaaaaaaa-ha-ha-ha-ha-ha!

Aug 27, 09 - 12:11 pm Comment from: ChrissyOne

If you haven't yet, read the article comments. It looks like one of our political threads, only slightly more polite. ;P

Aug 27, 09 - 12:37 pm Comment from: dd

Sing the song — you know how it goes.
Eric Willard is a moron.
Billy Gates is a moron.
Steve Ballmer is a monkey.
Elinor Mills is a moron.

Aug 27, 09 - 12:44 pm Comment from: Spark

@ Demon
Good post. I hope you sent Elinor and email with the same message.

Aug 27, 09 - 12:47 pm Comment from: feral

wheres' ampar when you need him?

Aug 27, 09 - 12:53 pm Comment from: dix99

@ Mary
Why write a virus for only 8% of the world?

Because mary, if you did, you name would be known the World over, as the first person to do so. It seems no one wants that glory & fame I guess, so you're right, why write one. I certainly wouldn't want that on my record, being the first.

Aug 27, 09 - 12:56 pm Comment from: Buster

Blonde is as Blonde does....

Another analyst surviving of the teat of Microsoft.....

Aug 27, 09 - 12:57 pm Comment from: jjjj

Thank you, CNET, for not changing your biased ways.

Aug 27, 09 - 12:58 pm Comment from: Buster

Damnit...I meant off

Mary....the best PC virus writers get great jobs with security firms (or the government). For 9 years OSX has been touted as extremely resistant (actually impossible) to infect. Anyone who can crack it successfully could probably write his own ticket ....

Aug 27, 09 - 01:04 pm Comment from: feral

also

the other myth we could propagate is that macs are more expensive thus mac owners are richer so why wouldnt you want to write a virus for them?

sheesh

go find some clothes for the emperor already

Aug 27, 09 - 01:11 pm Comment from: Michael

Apple makes it drop dead easy to update the OS and most Mac users have the default setting to have Software Update run once a week. So it's a no brainer when security updates come along.

The fact of the matter is, Apple patches serious holes fairly quickly... and by serious, I mean open vulnerabilities that can be capitalized on remotely without user interaction. The fact is, the only way anyone has ever run rogue code under OS X was, someone had to be at the computer doing something.

Aug 27, 09 - 01:12 pm Comment from: Micro Me

Recently, I became involved in a rather prickly argument with a colleague who informed me I was "delusional" for believing there were no Mac viruses.

She'd "read somewhere" that there were already viruses for Macs, and my attempts to explain to her the differences between viruses, worms, and trojans were in vain.

But the argument taught me one thing – the notion that Macs are just as insecure as PCs is taking root. FUD works, evidently.

Aug 27, 09 - 01:21 pm Comment from: Mark II

I would register to send her an e-mail so I copied it here.

CNET is the saddest excuse for news of any kind, Your latest ridiculous rantings have shown that you and CNET are a following the folly of your god microsoft. How you can report this untrue crap and think of yourself as anything other than a complete idiot is beyond belief.

Aug 27, 09 - 01:23 pm Comment from: :rolleyes:

Why is everyone so surprised by this?

In a county where nearly half believe all the ridiculously over the top FUD about the current healthcare reform effort, why would you expect this same population to accept the TRUTH about the superior security of OSX over the pathetically insecure Windows platform?

Once you recognize that a large percentage of the US population are total morons, issues like this are actually should be expected, not surprised about.

Aug 27, 09 - 01:24 pm Comment from: wiredzen

I agree with the general feeling throughout the comments. These people clearly don't understand the exploitive mind. First, there are enough Macs in the world to justify exploiting the OS. According to MS, Mac users are rich, so they make an excellent target. And, surely there must be at least one hacker out there saying, "These Mac users are a bunch of arrogant asses who think they are so safe. I'm gonna nail 'em all with the best virus ever!" Just the notoriety for creating the first massive successful attack would be motivation alone. It will happen someday just because odds of life dictate it, but it's not going to be because Apple, Mac users, and the OS are weak. (Windows anyone?)

Aug 27, 09 - 01:37 pm Comment from: Swiss Cheese Safari

Do any of you remember which was the 1st OS to be compromised in the last hacking competition? Took minutes, if I remember correctly.

Carry on chest thumping in your alternate reality. Don't let big words like address randomization bother you.

Aug 27, 09 - 01:43 pm Comment from: ken1w

If there was ONE Mac OS X virus out there in the real world, it would prove that it's possible, and I would be mildly concerned. Since there are ZERO, I will be a "Mac fanboy" and not even think about it, at least until some dumbass journalist gets an article published claiming that Vista is more secure than Leopard. Oh please, I'm laughing so hard it hurts.

Yes, there are other types of Mac OS X malware that are NOT viruses, but they require the user intentionally download something from an unknown web site, run that something, and give permission (user name and password) for that something to be installed. Even Apple cannot protect users from their own stupidity.

Aug 27, 09 - 01:51 pm Comment from: dangerfrog

I have a new, groundbreaking story for Ms. Mills:

New steel belted radial tires being sold for some cars may make automobiles as fast and safe as horses, or at least push them closer to the level of safety and performance that horses, with their steel horseshoes, have enjoyed for decades, some experts said this week.

Aug 27, 09 - 01:57 pm Comment from: shen

"If there was ONE Mac OS X virus out there in the real world, it would prove that it's possible"

Actually it is possible, even if there isn't one. That doesn't change the fact that there isn't one, the environment is target rich, and many hackers wish they could write one, and they try.

But a UNIX based system with intelligent programers and all the real thought Apple and the BSD community put into it is a hard enough to crack target that after hitting your head on a brick wall for a few months you go back to scriptkiddie powning of easy to hit windows boxes. End of story.

Aug 27, 09 - 02:00 pm Comment from: shen

"Do any of you remember which was the 1st OS to be compromised in the last hacking competition? Took minutes, if I remember correctly."

I believe your comment was addressed in the article. Maybe if you could read you would have seen it....

Aug 27, 09 - 02:02 pm Comment from: BC Kelly

c1 Hey (z snap) GF

As my Ol' Pappy used to say ...

If folks discussing Politics always stay "polite"

Then they're doing something wrong

wink

BC

Aug 27, 09 - 02:09 pm Comment from: Lurker_PC

Nice response MDN!

Aug 27, 09 - 02:11 pm Comment from: ken1w

@ Shen

> Actually it is possible, even if there isn't one.

I said, if there was ONE Mac OS X virus, it would prove that it is possible. That is 100%. It would prove that it is possible because one example would exist. I did NOT say the lack of that one example was proof that it is impossible.

However, until someone does prove it is possible by actually doing it, I'll still be a smug and unconcerned Mac fanboy.

Aug 27, 09 - 03:07 pm Comment from: Btaylor

ah..Elinor....yeahhhh..first of all "Elinor" is spelled Eleanor..mkay..and also I'm gonna hafta go ahead 'n ask you to suck my Mac's RAM...and I've got 4gigs so it's a pretty big RAM
mkay...buh-bye

Aug 27, 09 - 03:20 pm Comment from: derekcurrie

I just went through the dumbass article and comments. WELL DONE MDN readers! I think Elinor will be limping for a week.

Here is how I slammed her stooopidity:
~~~~~~~

This is the most shameful article I've ever read at CNET. I've been studying and writing about Mac security since 2005. All I can say is:

Elinor: YOU'RE FIRED ! ! !

For those interested in reality:

The anti-Mac security FUD-fest was started in August 2005 by Symantec. They were attempting to sell their worst-in-class anti-malware program Norton Anti-virus to Mac users who smart enough not to buy it. MacAfee then joined in the FUD, but reversed course when their CEO pronounced that the best way to secure your computer was to Get A Mac.

After that point most FUD has come from hackers who have done their best to whip up a frenzy surrounding flaws they found in Mac related software, such as QuickTime, WebKit and Safari. But it is fair to say that they helped track down and patch several flaws in Mac OS X as well.

Meanwhile, the only malware that has shown up for Mac are Trojan horses, currently of 4 types of 17 varieties. Trojans require user failure, not computer failure, in order to be installed and do damage.

In spite of the FUD-fest, the hype-mongers have been effective in forcing Apple to get serious about security, which previously they were not. So folks like myself actually thank Dr. Charlie Miller and friends for their help making Mac OS X even more secure than it already was. I have Charlie's book and I look forward to his continued useful work, and even his FUD foisting.

It's worth noting that only highly ignorant people still tell the tale known as 'security by obscurity'. It is easily disproven by anyone who can perform math, i.e. any 4th grader.

If you'd like to read Mac security facts and suitably laugh at the FUD, you might find my personal commentary and coverage of interest:

http://Mac-Security.blogspot.com

:-Derek Currie

Aug 27, 09 - 03:40 pm Comment from: 3monkies

It makes sense to me to have this feature in OS X… Just because our Macs are immune to such things doesn't mean we should pass them on to our Windows slumming friends wink

Aug 27, 09 - 04:08 pm Comment from: Zeke

@SwissCheeseSafari:

Don't let little words like "chmod" and "root" bother you. You go right ahead and believe that Unix (OS X) is no more secure than Windows. You stick with your $299 laptop from WalMart and pirated software. I'm sure Apple doesn't want you as a customer.

Aug 27, 09 - 04:30 pm Comment from: aka Christian

derekcurrie: Thanks. I'm one who feels, like Kenh, that until there's an ACTUAL virus, don't bother me with this stuff. It's not always easy to find information about WHY there's no viruses, and why it would be so hard to create and propagate one.

Sadly, there are still many people out there who either don't know that Macs are virus free, even now, or who believe Macs will succumb sooner or later because, well, all operating systems are the same.

Reader feedback page 1 of 2 pages:  1 2 >

Always -- Free ground shipping with orders over $50 at the Apple Store.

Add Your Feedback:

Register or Login

Name:

Email: (optional)

Emoticons | Allowed HTML Tags

Remember my info   Notify me of follow-up comments?

Please enter the "MDN Magic Word" you see in the image below: