toggle

AAPL Stock: 562.29 ( -3.03 )

MacNN News

Symantec warns about Mac OS X security, hacker threat

updated 08:15 am EST, Mon March 21, 2005

Mac OS X security warning

Security vendor Symantec has warned that Mac OS X is increasingly and that Mac users are complacent about security issues. ZDnet Australia reports that Symantec's seventh bi-annual Internet Security Threat Report reveals that security researchers have discovered at least 37 serious vulnerabilities in the Mac OS X system over the past year. "As Apple increases its market share--with new low cost products such as the Mac mini--its userbase is likely to come under increasing attack. 'Contrary to popular belief, the Macintosh operating system has not always been a safe haven from malicious code. Out of the public eye for some time, it is now clear that the Mac OS is increasingly becoming a target for the malicious activity that is more commonly associated with Microsoft and various Unix-based operating systems."

by MacNN Staff

(36)

TAGS :

Apple

Share the Article

Facebook Twitter Delious Slash Dot Digg

toggle

Comments

chabig
Addicted to MacNN

Joined: Jun 1999

0

03/21, 08:40am | report spam | close Reply |
This may be true, but

This may be true, but it's hard to take seriously the words of a company that's trying to convince you of a need to buy its product.

MacMoose
Fresh-Faced Recruit

Joined: Mar 2003

0

03/21, 08:44am | report spam | close Reply |
Just be smart

Hey, ...

We are Mac users but are also pretty well educated. I would like to think that if indeed some very intelligent hackers, decide to do the nasty and start exploiting OS X weaknesses, then the security companies, Apple and others will rise to the occasion and do what they can. Everyone knew this could happen someday. But at least with OS X, there is the admin password and other things in place to make it much more secure than it's Windows equivalent systems.

Hey.... a new market for companies to make money could arise and that means more security, even someone else makes a profit. Lets not jump and say the sky is falling quite yet though.

MacMoose

pbriggs
Fresh-Faced Recruit

Joined: Dec 2001

0

03/21, 08:44am | report spam | close Reply |
Norton - Malware

Since I stopped installing Symantec Software my Macs have run a whole lot better! Norton is the best example of Malware for Macs I can think of.

All Symantec are doing is trying to instill F.U.D. in new Mac users, who may have just switched from Windows and can't believe they don't need a virus killer, spyware killer etc. Yes, OSX will surely come under fire from Virus writing idiots, but the market share isn't going to double or treble overnight even if Apple could keep up with demand.

MacScientist
Junior Member

Joined: Feb 2000

0

03/21, 08:47am | report spam | close Reply |
Marketing FUD

Symantec is getting desparate. For all of the alarm, Symantec was able to name exactly one vulnerability in the last six months. The Opener script named was not so much a MacOS X vulnerability, but a Unix bash script that could affect unprotected Unix computers in general.

For the first time in my memory, Symantec has accepted that time-worn 1999 Microsoft excuse that large marketshare makes vulnerabilities. Leaving aside the fact that Norton Antivirus patches weaknesses in Windows's design and not its marketshare, marketshare is not uniform. Accepting the argument that a virus needs a critical mass of targets in order to propagate, this critical mass is available in certain markets where the Mac has a large following. Yet, you don't see the publishing industry, the computer graphics industry, or any other Mac stronghold brought low by external threats.

alabamer
Fresh-Faced Recruit

Joined: Jan 2005

0

03/21, 08:50am | report spam | close Reply |
...if Symantec says it?

Contrary to popular belief? I guess my last 4 years of being free of virus/adware/malware/spyware/crapware is 'contrary to popular belief'?

I know the mac is not invulnerable, but don't spread information that is completely inaccurate.

Vulnerabilities? Yes. But mac systems are also patched immediately via software updates. (Immediate in my mind is where the vulnerability is patched before anything bad could've happened)

Also, because the macs have such a good uptodate mechanism, virus and malware writers would never have much luck writing their code, anyway. If they were actually able to come out with some sort of exploit, the OS becomes updated so fast that their window of opportunity to take advantage of a hole doesn't give them much 'bang for the buck'. i.e. They spend all that time coding only to be thwarted by having the OS updated to remove the vulnerability. Granted, it's the same way on the PC side, however, with Grandma Jones and Sister Sue's MS-based computers, do you think they actually ever click on the "There are updates ready for your computer" icon? Every one I come into contact closes every window they can because they are so afraid of unleashing a virus on their computer. They don't know the difference between an email and a Microsoft 'update' and so nothing is updated on their machines.

Me�vv
Fresh-Faced Recruit

Joined: May 2001

0

03/21, 08:53am | report spam | close Reply |
Rise and fall

Norton Disk Doctor used to be the best Mac program that existed. Symantec's current suite causes more problems than it could potentially fix. Meanwhile no other companies are making competing products since the threat levcel is so low. What do we do in the unlikely event that the worst happens? Virex is painfully slow and useless. Please Symantec, make a NAV version 10 that is worthy of your good old name. Make it less bloated, fast, non-intrusive, and for God's sake make it completely possible to uninstall and turn off.

trevc
Fresh-Faced Recruit

Joined: Mar 2000

0

03/21, 08:59am | report spam | close Reply |
So....

... does Tiger offer more 'security'. Is there firewall, etc.?

macbarry
Junior Member

Joined: Aug 2002

0

03/21, 09:03am | report spam | close Reply |
Norton a no no on my Macs

I gave up installing Norton on my new Macs long ago because I found more problems and issues with that software than I ever had with malware/viri. Just say no to Norton and their fear mongering marketing targeted at former Windows users.

galarneau
Senior User

Joined: Sep 2002

0

03/21, 09:07am | report spam | close Reply |
Agreed: Pure FUD

When an independent auditor tells me that the Mac platform is becoming more vulnerable to attack, I'll believe it.

When someone who has an obvious interest in selling me their c*** product tells me I need it, well... I think they're just being shysters.

zro
Mac Elite

Joined: Nov 2003

0

03/21, 09:08am | report spam | close Reply |
To trevc

There's a firewall now.

The source of this info is highly suspect. Mac market share hasn't grown that much and "hackers" will continue to focus on what's easiest to harm, not necessarily what's more common.

Feeling_Macish
Fresh-Faced Recruit

Joined: Mar 2004

0

03/21, 09:09am | report spam | close Reply |
Use ClamXav

It's free, works and doesn't muck your system up.

do a google search.

resuna
Fresh-Faced Recruit

Joined: Jan 2005

0

03/21, 09:11am | report spam | close Reply |
Symantec's thrashing...

Symantec's thrashing about trying to get people to install A/V on anything but Windows.

There's a certain amount of truth to the marketshare argument, but it's far from the biggest reason viruses target Windows. The biggest reason is that the way Internet Explorer, Outlook, Media Player, and the Desktop are tied together through the HTML control is a huge and inherently unfixable first-contact vulnerability. There's nothing like it on any other platform.

Apple shouldn't be complacent. There are aspects of LaunchServices, and things like Internet Enabled Disk Images, that hey really need to back down from... and I'm a little concerned about Dashboard... but there's nothing like ActiveX, Active Scripting, and Active Desktop in Mac OS X and, so far as I can tell, no prospect of any.

eldarkus
Fresh-Faced Recruit

Joined: Feb 2004

0

03/21, 09:14am | report spam | close Reply |
In other news...

In other news, 48 hackers were arrested in Russia today after the government traced them through receiving payment from Symantec. According to our reports, Symantec had hired the hackers to crack the Macintosh OS "at all costs". Symantec has quoted declining sales on the Macintosh platform as the main reasoning for hiring the hackers. "That's what Apple gets for choosing to give away Virex over Norton AV to it's .Mac membership customers." said the Symantec rep.

Glasspusher
Fresh-Faced Recruit

Joined: Oct 2000

0

03/21, 09:14am | report spam | close Reply |
not complacent

I, as a mac user, am not complacent, but I do feel better using OSX than a windoze box! Puh-lease. BTW, many posters have nailed it- if I do have a virus problem, I sure won't be using Symantec's POS products to fix it!

technohedz
Fresh-Faced Recruit

Joined: Jul 2000

0

03/21, 09:19am | report spam | close Reply |
dashboard no concern

Just because it doesn't play in a sandbox (ex: central), doesn't mean it isn't safe. While Apple may have built in safeguards, there is a certain point where they will start to hinder the user. Konfabulator is done well. People who think you can't rm -rf * things..oh sorry for those ppl -fr don't get it. Sym-Virus is just pointing out 'hey, it's unix. It's been hacked way back when...it's becoming more popular so it will become more of a target'. Why disagree w/ protection. Ebola may be rare, but people are still trying to cure it. Even if Macs are scarce, people will still try to crack it. The converse works as well. Mac OS X: It exists, therefore people will try as hard as they can to hack, crack, and otherwise thrash it /. away at the semantics here. How many people have downloaded freeware from versiontracker that asks for your password and typed it in? HINT: stop distributing w/ installers, smart people don't trust you. Stick w/ known evaluation boards (versiontracker, macupdate, etc) and let someone else try the 'product' first. That and clam x is probably the best bet since Norton and Virex suck.

hayesk
Professional Poster

Joined: Sep 1999

0

03/21, 09:40am | report spam | close Reply |
Re: dashboard no concern

"How many people have downloaded freeware from versiontracker that asks for your password and typed it in? HINT: stop distributing w/ installers, smart people don't trust you. Stick w/ known evaluation boards (versiontracker, macupdate, etc) and let someone else try the 'product' first. That and clam x is probably the best bet since Norton and Virex suck."

None of the shareware or freeware that I've downloaded has ever asked for a password. Most is "drag to apps folder". Also, you can use Apple's or other companies' installers without requiring a password.

There's already a huge incentive to write and distribute a MacOS X virus - fame and reputation. Imagine the press having a field day when someone succeeds in writing the first MacOS X virus. Long before that happens we'll see lame attempts at AppleScripts attached to emails that email to everyone in AddressBook and then delete the user's home folder. And as long as it can't run from within the message window, most people will be safe.

ddukes
Junior Member

Joined: Aug 2000

0

03/21, 10:06am | report spam | close Reply |
Re: dashboard no concern

Anyone on a *nix system can run "rm -fr". That doesn't mean it will delete *all* files in a destructible manner. Only the root user is dangerous running that command.

hayesk
Professional Poster

Joined: Sep 1999

0

03/21, 10:10am | report spam | close Reply |
Re: Re: dashboard no con

"Anyone on a *nix system can run "rm -fr". That doesn't mean it will delete *all* files in a destructible manner. Only the root user is dangerous running that command"

That's not exactly true. It's still dangerous if you don't keep backups. You can still delete all of your own files, which for more people, are worth a lot more than the system files. But of course, this danger becomes only an annoyance if you keep backups.

ddukes
Junior Member

Joined: Aug 2000

0

03/21, 10:18am | report spam | close Reply |
Re: dashboard no concern

That's exactly my point hayesk. You can "delete all of your own files". Not critical files. That's the point of having your own account--so that you can do as you please with your own files.

ecrelin
Junior Member

Joined: Oct 2000

0

03/21, 11:29am | report spam | close Reply |
bullshit,

not enough mac users out there? There are plenty on line all the time to catch and spread viruses, that is just hogwash. Why does the number of machines have anything to do with it anyway? There are two big reasons to crack systems (lots of little sick ones too), one is to show how good you are (hayesk is right there's fame in it) and the other is to get valuable information in quantity. Hacking contests always score higher for cracking a Mac or a UNIX box, the best guys are there and not succeeding, the lower level virus writers are just making trouble with the least amount of knowhow and work. Big banking concerns and other information warehouses are where the real crooks want to go and they aren't successfully cracking too many UNIX systems (except idiots that don't close two year old security holes in their web apps right T-Mobile?).
Phishers are platform independent and don't count. Also, downloading a program, installing it and releasing malware is not a virus, its a trojan and its the operators fault no matter what. Even M$ can't be faulted for trojan attacks, maybe for how easy it is to do damage with one but not for their existence.
When one of those "proven concepts" gets released after there are "enough" macs then I'll do something about it, but it won't be a Symantec solution, I think they have found their home cracking cold ones with Drinkin' Buddy Ballmer at the wheel of the M$ Valdez. (or is that "Sweating Buffoon, Developer Monkedance Ballmer?)

SomeToast
Senior User

Joined: Jan 1999

0

03/21, 11:37am | report spam | close Reply |
New markets

With Microsoft adding virus protection to the operating system (now there's a novel idea: the producer of an OS with exploitable holes adds a layer to alert you to when those holes have been exploited), it's good to see Symantec on the early offensive to scare up some replacement customers.

jpellino
Fresh-Faced Recruit

Joined: Oct 1999

0

03/21, 12:20pm | report spam | close Reply |
Ok, except that...

(1) Apple responds to these vulnerabilities in an arguably more timely fashion than MS and

(b) OS X has the full power of the open source community available to help plug such holes.

But thanks for the heads-up, Symantec.

scotty321
Fresh-Faced Recruit

Joined: Nov 1999

0

03/21, 12:28pm | report spam | close Reply |
Symantec

Yeah, like we'll believe anything Symantec says -- a company that can't even make working disk utility software for the Mac.

OtisWild
Junior Member

Joined: Feb 2005

0

03/21, 12:56pm | report spam | close Reply |
Back in the old days.....

... During system 6 and 7, there were _plenty_ of viruses on the Mac platform. In fact, Macs could get a virus by merely mounting a floppy! When I was a Mac/PC/VAX/Sun university lab guy I ran Virex and Norton on Macs several times a day for users' floppies.

I suppose during the mid nineties (when Win95 came out) interest in Mac viruses tapered off as Windows began its climb up the marketshare mountain, and when Macro/VB viruses became possible it was much easier to exploit the Windows platform so you got the combination of marketshare and ease-of-development for virus writers.

There are significant structural reasons why OS X is more virus-resistant than Windows.

Going beyond the respective kernel hardening (Unix having 30+ years of networked development vs. maybe 10-15 in the NT world) and system-level security, at the user level OS X is far more secure and less vulnerable simply because it doesn't do as much stupid c***. Email viruses were a 'net hoax circa 1993-4, I remember "getting" one at that time, google usenet for it. Leave it to Microsoft to be so retarded as to make them a possibility.

It is this user-level retardation (VBscript/Macro viruses) along with embedding flaky/insecure stuff like MSHTML.DLL and the graphics renderer (JPEG buffer overflow leads to root sploit?!?! WTFingF!?!?) in the kernel that make Windows both easy and fun to crack. These are horrible design decisions taken by MS, they are not inevitable computer science eventualities.

It may well be possible to sploit OS X, using FreeBSD vectors, as well as attacking Quartz and other subsystems. Attacks common to all OSes include attempting to overwrite running user-level applications' memory areas, common buffer overflows, and attacking 3rd party apps. The inherent design of OS X for the most part reduces the efficacy of these attacks, and the opensource peer-review of Darwin (and the underlying BSD infrastructure) helps keep that layer of the OS secure. Apple's decision not to do retarded things like letting Mail.app launch AppleScripts without user intervention or embedding Safari into the OS with a kernel-level privilege prevent the most stupid, dangerous and easy cracks.

I'm sure at some point there will be a sploit for OS X, and I'm equally sure we'll see a Software Update for it before it goes public.

OtisWild
Junior Member

Joined: Feb 2005

0

03/21, 01:00pm | report spam | close Reply |
oh, btw

It would behoove Apple/Freescale/IBM to add support for a NX (no-execute) bit to the PowerPC ISA. That would pretty nearly kill the whole buffer-overflow vector. AMD introduced it into their AMD64 architecture and Intel cloned it for its ripoff of AMD.

It would be a great addition to OS X security.

hayesk
Professional Poster

Joined: Sep 1999

0

03/21, 02:41pm | report spam | close Reply |
Re: Back in the old days

I remember those days.

There were about 30 known Mac viruses. The freeware Disinfectant was all that was needed to stop them all.

It wasn't until MS came out with their thoughtfully planned macro language that created the need for Virex, or Norton AV.

Loquetis
Fresh-Faced Recruit

Joined: Mar 2005

0

03/21, 04:08pm | report spam | close Reply |
Symantic warning?

Well, the biggest writer of malware seems to be from themselves or disgruntled workers, at least on PC's. Maybe we could BE "SAFE" if we use their products or have our ISP's use them....

Just a "IMO"..... :-)
Have a nice day...

NetworkShadow
Mac Elite

Joined: Nov 2002

0

03/21, 04:19pm | report spam | close Reply |
Symantec scare tactic

I think they are just trying to get all the new Mac users to buy their software. We are a long way away from becoming the next windows XP, I don't think we'll have to worry for a long while.

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

03/21, 04:34pm | report spam | close Reply |
Re: oh btw

It would behoove Apple/Freescale/IBM to add support for a NX (no-execute) bit to the PowerPC ISA. That would pretty nearly kill the whole buffer-overflow vector. AMD introduced it into their AMD64 architecture and Intel cloned it for its ripoff of AMD.

This brings up one of those points I've always wondered about. Has anyone actually heard of, through sample code or what (apparently not a virus, since, hey, OS X don't have any viruses [as of this writing]), of an actual buffer overflow attack on OS X? I've read security bulletins that warned of the possibility, but I also thought I read somewhere that, due to the PowerPC's architecture, writing a buffer overflow exploit was much harder to do then on x86 systems (I think it had something to do with OS X keeping code and variable stacks separate, so overwriting a variable couldn't just add code to your stack and have it execute).

BTW the NX bit isn't a panacea nor catch-all. It works in some cases, but not in others. Plus, it has to be coded (if I read the overviews correctly), so all the existing Windows c*** out there is still in trouble. Only new stuff would be 'safe' (or safer, which is sort of like saying "Hey, there used to be 50 sharks circling me in the ocean, but now there's only 10! Wow, I can let my guard down now!")

testudo
Fresh-Faced Recruit

Joined: Aug 2001

0

03/21, 05:13pm | report spam | close Reply |
Re: To Trev

There's a firewall now.

Yeah, but wouldn't it be nice if OS X, oh, I don't know, turned it on by default when you installed the OS? MS got slammed because of the same thing, but people just kind of blow it off with OS X. Of course, it used to be in XP that you had to turn on/off the firewall based on your network interface. I set up a co-workers laptop and turned on the firewall (or so I thought), only to have them infected by some virus, which turned out to have connected to her computer when she had dialed in, rather than using the network interface. Doh!

pixelhead11
Fresh-Faced Recruit

Joined: Sep 2002

0

03/21, 08:19pm | report spam | close Reply |
" The Net"

Reminds me of the movie "The Net"

Filburt
Junior Member

Joined: Aug 2001

0

03/21, 09:13pm | report spam | close Reply |
NAV's protection

Dear Symantec,

Please provide us with a list of viruses that your product will protect us (Mac users) from.

just a poster
Fresh-Faced Recruit

Joined: Jun 2004

0

03/21, 09:28pm | report spam | close Reply |
Symantec is desperate

Microsoft will put them out of business soon.

aristotles
Grizzled Veteran

Joined: Jul 2004

0

03/22, 12:57am | report spam | close Reply |
Firewall?

Even with the firewall off (default install setting), there are no services turn on by default so there is nothing to attack.

Stay away from Norton products. They hurt more than help.

wrecklass
Fresh-Faced Recruit

Joined: Mar 2005

0

03/22, 04:00am | report spam | close Reply |
Firewall...

In fact the firewall in OS X is ON by default. However, ports are open by default, so it isn't terribly secure as it ships.

Me, I'm behind a firewall, so I prefer to have it the ports open. For folks who don't have the money (or sense) to install a stand alone firewall on their network, the default probably should be to block more ports on the Mac.

blidd
Fresh-Faced Recruit

Joined: Sep 2003

0

04/01, 01:38am | report spam | close Reply |
Firewall

And what ports would that be? A newly installed MacOS X does not have the firewall turned on as default, but It hasn�t turnd websharing, filesharing Windows File Sharing and SSH on either. The firewall is activated the instance you activate any of these services. Runing a port scan on your own machine, you will find 4 or 5 open ports 25 and 80 are open for you to retrieve mail and webpages. Another port is open for rendevouze, but rendevouze only works on your own subnet and are thus inside an effective firewall. I have a port open that enables me to streame music from my iTunes but that is a local ability as well limited by the extent of my airport network.

Show More Comments

Login Here

toggle

Network Headlines

05/25	Sotheby to auction Jobs Atari memo,...
05/25	Apple hiring new chip engineers for...
05/25	Third-gen iPad coming to Philippines...
05/25	Apple to integrate Baidu search into...
05/24	Apple submits surprise optical stylus...

Show All

05/25	Sotheby to auction Jobs Atari memo,...
05/25	Apple to integrate Baidu search into...
05/25	Google picks up webOS Enyo team, Open...
05/24	Apple submits surprise optical stylus...
05/24	Yahoo releases Axis 'visual search'...

Show All

05/25	Sotheby to auction Jobs Atari memo,...
05/23	Google launches redesigned Search app...
05/22	Leaked next-gen iPod touch part hints...
05/22	Hulu Plus updates with iPad Retina...
05/22	TiVo Stream to push TV to iPhones,...

Show All

03/02	Save $330 on refurb. 15.4-inch, 2.4GHz...
03/01	Pre-owned 8GB iPod touch 2G, drops...
02/29	$150 off Nikon Coolpix S80 Compact...
02/28	Plantronics BackBeat 903 Bluetooth...
02/27	Refurb. Seagate 1.5TB GoFlex Portable...

Show All

toggle

Symantec warns about Mac OS X security, hacker threat

updated 08:15 am EST, Mon March 21, 2005

Mac OS X security warning

Related Articles

Recent Articles

This may be true, but

Just be smart

Norton - Malware

Marketing FUD

...if Symantec says it?

Rise and fall

So....

Norton a no no on my Macs

Agreed: Pure FUD

To trevc

Use ClamXav

Symantec's thrashing...

In other news...

not complacent

dashboard no concern

Re: dashboard no concern

Re: dashboard no concern

Re: Re: dashboard no con

Re: dashboard no concern

bullshit,

New markets

Ok, except that...

Symantec

Back in the old days.....

oh, btw

Re: Back in the old days

Symantic warning?

Symantec scare tactic

Re: oh btw

Re: To Trev

" The Net"

NAV's protection

Symantec is desperate

Firewall?

Firewall...

Firewall

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace