9 ms·

As someone who used to sell Mac computers, I used to get asked the question "Is it true macs never get viruses?", to which I replied "No that's not true." (It

As someone who used to sell Mac computers, I used to get asked the question "Is it true macs never get viruses?", to which I replied "No that's not true." (It was just an apple reseller store afterall so I was never compelled to bend the facts.) I'd try to explain the caveats a bit: a smaller market share and the unix based operating system requiring more permissions, yada yada, being "prohibitive" to an attack but still vulnerable. Still, for 3 years that question came up a few times a week, even as apple started taking off (2006-2009 ish) and grabbing more and more of the market. I guess it was just amazing to me how disinformation like that flows so freely. It probably started out with the caveats but eventually got boiled down to "Macs never get viruses". And what computer company is going to publicly correct that statement?

Xuzz 15y ago
The interesting part is that I still haven't seen one traditional "virus" — even is thing appears to still be just social engineering users to install it, by pretending to be Flash Player. I can't imagine it's that much more difficult to actually find an OS X vulnerability to propagate with, but I still haven't seen any. Edit: It appears this uses a Java vulnerability, rather than the fake-Flash Player-installer that it was originally reported using (possibly an older variation of the same malware). So that's no longer accurate!
- cooldeal 15y ago
  Doesn't it use a Java exploit? From the article: >..the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant. >..the malware installs itself after you visit a compromised or malicious webpage, so if you're on the Internet, you're potentially at risk. Where is the social engineering part?
  - mbreese 15y ago
    Well, it does have to get the user's permission to install it first... From the F-Secure site: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb... On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done. If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.
    - cooldeal 15y ago
      Did you even read the page you linked or the text you pasted? It specifically states that the malware will infect the machine even if the user does not give permission.
      - mbreese 15y ago
        Well, I feel stupid. I just skimmed it after going through the detection steps. I missed the part where it installs itself to a different location if it doesn't get the user's password.
- FireBeyond 15y ago
  And almost no Windows "malware" in the last decade has been a traditional "virus" either. Trojans, social engineering, all so much easier.
  - ZephyrP 15y ago
    Exploit kits are big these days!
  - eli 15y ago
    I disagree. Visiting a malicious website or opening an email that exploits a vulnerability in your os or software is very common.
    - FireBeyond 15y ago
      Citation? The last thing along those lines I'd heard of was the PNG(?) exploit.
      - eli 15y ago
        Well, for one, the Java vulnerability discussed in linked article is actively being exploited on Windows to install that obnoxious fake "Antivirus 2012" malware.
    - DanBC 15y ago
      And those are not viruses unless they self-replicate.
  - enfoster 15y ago
    I would consider the series of Sasser and Bagle worms during 2004 to be a traditional virus.
- rmc 15y ago
  The interesting part is that I still haven't seen one traditional "virus" Originally, when it was just us geeks using computers, 'virus', 'malware', 'trojan', etc. where different terms for different things. Now a days, 'virus' is used by the general public & media to refer to any sort of bad programme that should be removed.
barista 15y ago
Well this had to happen at some point. Though it has a small marketshare and is based on unix, given the kind of demographic that uses a mac, (richer, more connected, etc) it is very lucrative for trojans to infect a mac and steal personal information, identity. It's unfortunate that people have this misunderstanding that macs don't get viruses and are actually not careful when using a mac.
phillco 15y ago
Didn't Apple used to claim that Macs didn't get viruses? I can't remember. (This would be at least several years ago, when Mac malware was still fully theoretical.) It's possible they never stated it directly, and the phrase was spread by fans. To be fair, their slogan is currently "Macs don't get PC viruses" [1]. Which is true. Although, devilishly close enough to blur the two in somebody's mind. [1] http://www.apple.com/why-mac/better-os/ http://www.apple.com/why-mac/better-os/
- craigmccaskill 15y ago
  I was going to post the exact same thing, but spent the last five minutes searching site:apple.com virus for a direct quote. Seems they've changed their lingo as I definitely remember (around the time of the whole mac vs pc campaign) a definite statement about not getting viruses at all.
  - rudyfink 15y ago
    Maybe this ( https://www.youtube.com/watch?v=GQb_Q8WRL_g https://www.youtube.com/watch?v=GQb_Q8WRL_g ) (MAC v. PC advertisement on viruses) is what you were thinking of?
- philaquilina 15y ago
  Whoa, no kidding. The majority of people are not going to stop on those two letters and consciously differentiate "virus" from "PC virus."
  - pazimzadeh 15y ago
    "A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers." Pretty clear.
    - mindrag 15y ago
      It's not at all clear. It's deliberately ambiguous. If they wanted it to be clear they would have said "Macs are only susceptible to a fraction of the number of viruses plaguing Windows-based computers."
superuser2 15y ago
Yes, it is correct that Macs can get viruses. Where people get upset is when you generalize this to say that because >1 virus exists, OSX presents no significant advantage over Windows. Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage. OSX is still dramatically safer in terms of your actual risk of a random remote attack. Whether this is economics or superior engineering, or how Windows and OSX stand up to deliberate attackers, I will not pretend to know.
- vectorpush 15y ago
  Viruses are not a fact of life for Mac users. Neither are trojans, and that is exactly why this trojan has manifested so successfully. Windows users are mostly hardened to the basic threats of the internet (don't open a random exe etc), and are cognizant of the reality that malicious software does target them. Non-technical Mac users have been lulled into a false sense of security that will eventually make them a more vulnerable target than a Windows user (as Win7 and OSX pretty much stand shoulder to shoulder in terms of security). OSX is still dramatically safer in terms of your actual risk of a random remote attack. What is your evidence for this?
  - superuser2 15y ago
    I've done ~15 Windows reinstalls in the last few years, and every single one of them was malware masquerading as anti-virus software. OSX's reputation may make Mac users feel invincible, but Windows users' knowledge of their vulnerability opens them to pretty effective scare tactics. In fact, it hit my house twice, and I'm not exactly incompetent: Win7, Security Essentials, kept on top of Windows Update, no admin privileges for little brother or mom, updated Firefox, etc. The last time, it turned out we were behind on Java updates - it popped up in the systray 5 or 6 times a day for a few months and the few times my dad tried to allow the update, it failed. I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off. Did a scan... MSE was showing me 20 different Java exploits and "Anti"virus 2012 wouldn't let me open Firefox again outside of safe mode. Not something my parents would be able to deal with when I'm not there; they would have had to pay somebody. Its replacement will be a Mac; they like OSX better anyway. I worked for a small-business IT firm for 3 summers and have never seen or heard of OSX malware except from the blogosphere/HN/media. We took our clients' security pretty seriously - corporate domains, enforced Automatic Updates, no idiots with local admin, corporate endpoint antivirus, antivirus in the spam filter, Sonicwalls, Firefox wherever possible, etc. Still, we got virus calls pretty frequently. I would usually babysit the reinstalls at a reduced rate, but when I wasn't interning, businesses were shelling out $150/hour for that. To be fair, most were XP, but there were a few virus calls for Win7. I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data. Again, just as many family friends running OSX as Windows; I've had Macs die (my MBP's motherboard gave out right after 4 years), I've had Macs run out of disk space, I've had the PowerPC/Intel switch lose my family a lot of money because perfectly good ~2006 machines can't run a modern OS or Flash/Firefox/iTunes, but I've never seen malware for OSX.
dsrguru 15y ago
I don't think small market share was ever really a reason that Mac OS X didn't get traditional viruses. UNIX-based servers have always had a huge market share, and since servers are presumably a more desirable target of infection and cracking than home computers are, we would have seen traditional viruses hit UNIX machines a long time ago if it were realistically doable. Also, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible. But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses. Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering, but I feel it's still not too much of a semantic exaggeration to say "Macs don't get viruses."
- felipeota 15y ago
  There are a lot more Windows desktops than UNIX servers. Just picture that every UNIX server is in average serving more than one Windows machine. Also, it is way easier to attack a desktop than a server. Desktop users are more careless than server admins and have many more different applications malware can use to gain access: im apps, browsers, media players, pdf viewers, flash runtimes, etc. To attack a server you have to find an exploit using an http, ftp or ssh request to a limited and more secure, in general, set of programs. Apple is growing very fast and it is finding itself in that position now. You can see that in the new security measures of the Mac App Store. By limiting what apps itself can do you limit what malware gaining access to those apps can do. Maybe Microsoft should have done something similar to prevent Windows from being the virus hub.
- cooldeal 15y ago
  This virus spreads from visiting malicious websites or websites with malicious ads. Since not much browsing happens on servers, there is no reason to target them. >lso, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible What? Does that mean that some Windows viruses were written by Mac fanboys to make Windows look bad? > But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses How? Can you explain what you mean by Windows having a unique vulnerability that is not present on a Mac? > Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering, Again, this is a drive by exploit from a web page, not social engineering. Why is this so hard to grasp?

Xuzz 15y ago

The interesting part is that I still haven't seen one traditional "virus" — even is thing appears to still be just social engineering users to install it, by pretending to be Flash Player. I can't imagine it's that much more difficult to actually find an OS X vulnerability to propagate with, but I still haven't seen any. Edit: It appears this uses a Java vulnerability, rather than the fake-Flash Player-installer that it was originally reported using (possibly an older variation of the same malware). So that's no longer accurate!

cooldeal 15y ago
Doesn't it use a Java exploit? From the article: >..the most recent variant from earlier this week targeted an unpatched Java vulnerability within Mac OS X. That is, it was unpatched (at the time) by Apple—Oracle had released a fix for the vulnerability in February of this year, but Apple didn't send out a fix until earlier this week, after news began to spread about the latest Flashback variant. >..the malware installs itself after you visit a compromised or malicious webpage, so if you're on the Internet, you're potentially at risk. Where is the social engineering part?
- mbreese 15y ago
  Well, it does have to get the user's permission to install it first... From the F-Secure site: http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_i.shtml http://www.f-secure.com/v-descs/trojan-downloader_osx_flashb... On execution, the malware will prompt the unsuspecting user for the administrator password. Whether or not the user inputs the administrator password, the malware will attempt to infect the system, though entering the password will affect how the infection is done. If infection is successful, the malware will modify the contents of certain webpages displayed by web browsers; the specific webpages targeted and changes made are determined based on configuration information retrieved by the malware from a remote server.
  - cooldeal 15y ago
    Did you even read the page you linked or the text you pasted? It specifically states that the malware will infect the machine even if the user does not give permission.
    - mbreese 15y ago
      Well, I feel stupid. I just skimmed it after going through the detection steps. I missed the part where it installs itself to a different location if it doesn't get the user's password.
FireBeyond 15y ago
And almost no Windows "malware" in the last decade has been a traditional "virus" either. Trojans, social engineering, all so much easier.
- ZephyrP 15y ago
  Exploit kits are big these days!
- eli 15y ago
  I disagree. Visiting a malicious website or opening an email that exploits a vulnerability in your os or software is very common.
  - FireBeyond 15y ago
    Citation? The last thing along those lines I'd heard of was the PNG(?) exploit.
    - eli 15y ago
      Well, for one, the Java vulnerability discussed in linked article is actively being exploited on Windows to install that obnoxious fake "Antivirus 2012" malware.
  - DanBC 15y ago
    And those are not viruses unless they self-replicate.
- enfoster 15y ago
  I would consider the series of Sasser and Bagle worms during 2004 to be a traditional virus.
rmc 15y ago
The interesting part is that I still haven't seen one traditional "virus" Originally, when it was just us geeks using computers, 'virus', 'malware', 'trojan', etc. where different terms for different things. Now a days, 'virus' is used by the general public & media to refer to any sort of bad programme that should be removed.

barista 15y ago

Well this had to happen at some point. Though it has a small marketshare and is based on unix, given the kind of demographic that uses a mac, (richer, more connected, etc) it is very lucrative for trojans to infect a mac and steal personal information, identity. It's unfortunate that people have this misunderstanding that macs don't get viruses and are actually not careful when using a mac.

phillco 15y ago

Didn't Apple used to claim that Macs didn't get viruses? I can't remember. (This would be at least several years ago, when Mac malware was still fully theoretical.) It's possible they never stated it directly, and the phrase was spread by fans. To be fair, their slogan is currently "Macs don't get PC viruses" [1]. Which is true. Although, devilishly close enough to blur the two in somebody's mind. [1] http://www.apple.com/why-mac/better-os/ http://www.apple.com/why-mac/better-os/

craigmccaskill 15y ago
I was going to post the exact same thing, but spent the last five minutes searching site:apple.com virus for a direct quote. Seems they've changed their lingo as I definitely remember (around the time of the whole mac vs pc campaign) a definite statement about not getting viruses at all.
- rudyfink 15y ago
  Maybe this ( https://www.youtube.com/watch?v=GQb_Q8WRL_g https://www.youtube.com/watch?v=GQb_Q8WRL_g ) (MAC v. PC advertisement on viruses) is what you were thinking of?
philaquilina 15y ago
Whoa, no kidding. The majority of people are not going to stop on those two letters and consciously differentiate "virus" from "PC virus."
- pazimzadeh 15y ago
  "A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers." Pretty clear.
  - mindrag 15y ago
    It's not at all clear. It's deliberately ambiguous. If they wanted it to be clear they would have said "Macs are only susceptible to a fraction of the number of viruses plaguing Windows-based computers."

superuser2 15y ago

Yes, it is correct that Macs can get viruses. Where people get upset is when you generalize this to say that because >1 virus exists, OSX presents no significant advantage over Windows. Viruses are not a fact of life for Mac users. Talk to anyone who uses or services Macs; you'll be hard-pressed to find anyone who's even seen an OSX virus. Whereas for Windows power-users, cleaning viruses for friends/parents is practically a rite of passage. OSX is still dramatically safer in terms of your actual risk of a random remote attack. Whether this is economics or superior engineering, or how Windows and OSX stand up to deliberate attackers, I will not pretend to know.

vectorpush 15y ago
Viruses are not a fact of life for Mac users. Neither are trojans, and that is exactly why this trojan has manifested so successfully. Windows users are mostly hardened to the basic threats of the internet (don't open a random exe etc), and are cognizant of the reality that malicious software does target them. Non-technical Mac users have been lulled into a false sense of security that will eventually make them a more vulnerable target than a Windows user (as Win7 and OSX pretty much stand shoulder to shoulder in terms of security). OSX is still dramatically safer in terms of your actual risk of a random remote attack. What is your evidence for this?
- superuser2 15y ago
  I've done ~15 Windows reinstalls in the last few years, and every single one of them was malware masquerading as anti-virus software. OSX's reputation may make Mac users feel invincible, but Windows users' knowledge of their vulnerability opens them to pretty effective scare tactics. In fact, it hit my house twice, and I'm not exactly incompetent: Win7, Security Essentials, kept on top of Windows Update, no admin privileges for little brother or mom, updated Firefox, etc. The last time, it turned out we were behind on Java updates - it popped up in the systray 5 or 6 times a day for a few months and the few times my dad tried to allow the update, it failed. I didn't know about that until I was in the room while my brother was using the machine and I saw a dialog that looked an awful lot like Windows reminding you to install AV but not quite right. No way anyone else would have noticed that the background gradient was just a bit off. Did a scan... MSE was showing me 20 different Java exploits and "Anti"virus 2012 wouldn't let me open Firefox again outside of safe mode. Not something my parents would be able to deal with when I'm not there; they would have had to pay somebody. Its replacement will be a Mac; they like OSX better anyway. I worked for a small-business IT firm for 3 summers and have never seen or heard of OSX malware except from the blogosphere/HN/media. We took our clients' security pretty seriously - corporate domains, enforced Automatic Updates, no idiots with local admin, corporate endpoint antivirus, antivirus in the spam filter, Sonicwalls, Firefox wherever possible, etc. Still, we got virus calls pretty frequently. I would usually babysit the reinstalls at a reduced rate, but when I wasn't interning, businesses were shelling out $150/hour for that. To be fair, most were XP, but there were a few virus calls for Win7. I don't have statistics, but if you're going to claim OSX has fallen as far as Windows in terms of infection rate, I think the burden is on you to show some data. Again, just as many family friends running OSX as Windows; I've had Macs die (my MBP's motherboard gave out right after 4 years), I've had Macs run out of disk space, I've had the PowerPC/Intel switch lose my family a lot of money because perfectly good ~2006 machines can't run a modern OS or Flash/Firefox/iTunes, but I've never seen malware for OSX.

dsrguru 15y ago

I don't think small market share was ever really a reason that Mac OS X didn't get traditional viruses. UNIX-based servers have always had a huge market share, and since servers are presumably a more desirable target of infection and cracking than home computers are, we would have seen traditional viruses hit UNIX machines a long time ago if it were realistically doable. Also, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible. But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses. Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering, but I feel it's still not too much of a semantic exaggeration to say "Macs don't get viruses."

felipeota 15y ago
There are a lot more Windows desktops than UNIX servers. Just picture that every UNIX server is in average serving more than one Windows machine. Also, it is way easier to attack a desktop than a server. Desktop users are more careless than server admins and have many more different applications malware can use to gain access: im apps, browsers, media players, pdf viewers, flash runtimes, etc. To attack a server you have to find an exploit using an http, ftp or ssh request to a limited and more secure, in general, set of programs. Apple is growing very fast and it is finding itself in that position now. You can see that in the new security measures of the Mac App Store. By limiting what apps itself can do you limit what malware gaining access to those apps can do. Maybe Microsoft should have done something similar to prevent Windows from being the virus hub.
cooldeal 15y ago
This virus spreads from visiting malicious websites or websites with malicious ads. Since not much browsing happens on servers, there is no reason to target them. >lso, before Mac OS X became as popular as it is now, there were lots of Windows users who hated Apple fanboys and would have loved to write a wide-spread virus that targeted Mac OS X if possible What? Does that mean that some Windows viruses were written by Mac fanboys to make Windows look bad? > But it seems like Windows, especially pre-NT and pre-Vista and pre-7, but even now, has a unique vulnerability to traditional viruses How? Can you explain what you mean by Windows having a unique vulnerability that is not present on a Mac? > Obviously, Mac OS X can still get hit by trojans if people use intelligent social engineering, Again, this is a drive by exploit from a web page, not social engineering. Why is this so hard to grasp?