3 ms·

i can think of some reasons. if you could compromise a macosx machine, your trojan wouldn't have to fight for internet bandwidth and cpu time against all the o

i can think of some reasons. if you could compromise a macosx machine, your trojan wouldn't have to fight for internet bandwidth and cpu time against all the other installed trojans, as is the case on a windows box. i've heard that there are windows trojans that seek out and disable antivirus programs: well, there's no need for that on a macosx box, because mac users never install antivirus programs. and so on. in other words, there are all the same good reasons as going into any new field with few or no competitors.

tptacek 18y ago
Trojans disable antivirus programs as an F-U to antivirus vendors. There are two kinds of malware authors: the people who do it for fun, and see themselves in competition with the security vendors, and the people who do it for money. The people who do it for money couldn't give 2 shits about any of this. But they're supplied by a market of malware arms dealers who are in feature-for-feature competition with each other. As for the bandwidth thing, that just doesn't make any sense. Everything is in competition for bandwidth with everything else.
- allenbrunson 18y ago
  no, they disable antivirus programs so that those programs won't eradicate them. you tend to turn any conversation you're in into a flamewar, so that's the last i'm going to say about it.
  - tptacek 18y ago
    Look, Allen, I could be wrong, but I don't think your arguments are very good, and I'm not going to pretend they are just to save your feelings. Antivirus programs are corporate standards in every Fortune 500 company. And yet those companies are rife with botnet infections and, yes, viruses. From a CS perspective, antivirus simply cannot work: you'd have to solve the halting problem to do it. Consumer Reports contracted ISE (Avi Rubin's company, a competitor of ours) to test AV software and found that none of it was effective against the simplest permutations of existing viruses. AV software is not the reason Macs have fewer viruses than Windows.

tptacek 18y ago

Trojans disable antivirus programs as an F-U to antivirus vendors. There are two kinds of malware authors: the people who do it for fun, and see themselves in competition with the security vendors, and the people who do it for money. The people who do it for money couldn't give 2 shits about any of this. But they're supplied by a market of malware arms dealers who are in feature-for-feature competition with each other. As for the bandwidth thing, that just doesn't make any sense. Everything is in competition for bandwidth with everything else.

allenbrunson 18y ago
no, they disable antivirus programs so that those programs won't eradicate them. you tend to turn any conversation you're in into a flamewar, so that's the last i'm going to say about it.
- tptacek 18y ago
  Look, Allen, I could be wrong, but I don't think your arguments are very good, and I'm not going to pretend they are just to save your feelings. Antivirus programs are corporate standards in every Fortune 500 company. And yet those companies are rife with botnet infections and, yes, viruses. From a CS perspective, antivirus simply cannot work: you'd have to solve the halting problem to do it. Consumer Reports contracted ISE (Avi Rubin's company, a competitor of ours) to test AV software and found that none of it was effective against the simplest permutations of existing viruses. AV software is not the reason Macs have fewer viruses than Windows.