4 ms·

Apple's arrogance and their security theater puts their customers in danger because it creates a false sense of security. It's just a matter of time before hack

Apple's arrogance and their security theater puts their customers in danger because it creates a false sense of security. It's just a matter of time before hacktivists make an all assault on Mac OS and iOS just to make Apple consumers more conscious about security.

randomdata 14y ago
I've never understood why this hasn't happened. It seems like being the first to create a widespread Mac (or Linux, etc.) virus would be much more appealing to write than just yet another Windows virus. Everyone and their brother have already done that.
- nl 14y ago
  There are plenty of *nix viruses around, except they are usually known as worms. The first author[1] of a successful worm[2] did become quite famous from it, later did a startup[3] and even later went on to be one of the co-founders of this thing called YCombinator[4]. [1] http://en.wikipedia.org/wiki/Robert_Tappan_Morris http://en.wikipedia.org/wiki/Robert_Tappan_Morris [2] http://en.wikipedia.org/wiki/Morris_worm http://en.wikipedia.org/wiki/Morris_worm [3] http://en.wikipedia.org/wiki/Viaweb http://en.wikipedia.org/wiki/Viaweb [4] Seriously?
  - cantankerous 14y ago
    FWIW, the Morris worm was a Unix worm from the 80's. It's not quite on par with the malware you'd see roaming around on Linux machines today, if such malware does exist and is, in fact, roaming around. The existence of the Morris worm doesn't really say much about the resilience of today's Linux to worms or viruses.
    - nl 14y ago
      I'm not sure what your point is. Yes, malware can be a lot more sophisticated now than it was in 1988. In many cases it doesn't need to be though. For example, there was a comparatively recent case of a botnet infecting Linux-based routers which lacked front end authentication[2](!!). Exploitable software runs on many platforms. The existence of the Michelangelo virus[1] doesn't really say much about the resilience of today's Windows to worms or viruses. [1] http://en.wikipedia.org/wiki/Michelangelo_(computer_virus) http://en.wikipedia.org/wiki/Michelangelo_(computer_virus) [2] http://lwn.net/Articles/325434/ http://lwn.net/Articles/325434/
  - deleted 14y ago
    [deleted]
- esbwhat 14y ago
  There are OS X viruses out there. Linux would be harder because of an increased fragmentation and systems being more up-to-date generally (especially since linux is commonly used on servers, and thus held up to a different standard of security in first place) On windows or mac, getting a virus to run is generally just a matter of packaging it with some downloadable software. In linux, pretty much everything is available through package managers. You can't just throw a virus into a torrent for photoshop or whatever. That being said, I'm by no means an expert.
  - randomdata 14y ago
    They certainly exist, but nobody has successfully created one that has spread to the levels seen on Windows system. That's really what I'm referring to: Something that would cause panic in the media, so to speak. Code that attacks a small handful of systems isn't particularly interesting to anyone, no matter what platform it targets, Windows included.
    - jpxxx 14y ago
      I respectfully disagree. Fully functioning and frequently self-replicating malware does now exist in the wild for the Mac platform. I've seen drive-by website infections, malicious software installs using social attacks, and malicious attachments infecting Office. When Flashback alone infecting the better part of one million Macs, it is now newsworthy.
thomasnext 14y ago
What "security theater?" They have an iron fist when it comes to the app store, but they aren't telling you to input your SSN or taking blood samples.
- excuse-me 14y ago
  "security theater?" = there's no need to worry about security because the app store guarrantees that. What if there is a hack/mistake/bug in the appstore ? There's no need to worry about security because the app store guarrantees that.
  - LargeWu 14y ago
    That's not really what "security theater" means. Security theater refers to highly visible actions that make it seem like enhanced security, but ultimately have no effect. Think: the ticking agent asking you if you are bringing bombs onto the plane in your luggage. The Apple review process, draconian as it may be, almost certainly has a real, strong effect in actually preventing malware.
    - excuse-me 14y ago
      Security theatre is also putting all your faith in some security authority who claim that it must be safe because they are the security authority - but you aren't allowed to look under the hood. It's exactly like the TSA having magic terrorist detectors - but you can't be told how they work because of security
    - larrys 14y ago
      "Think: the ticking agent asking you if you are bringing bombs onto the plane in your luggage." Actually average people would probably know enough to think "someone could just lie when asked - that doesn't provide protection". To me "security theater" is doing things that seem to appear to lock something down in the eyes of an average uninformed person. Average is not Bruce Schneier or an 8 year old. It's a typical traveler who believes they are secure because they see checkpoints, have to take their shoes off, and have to have their laptop scanned.
voidr 14y ago
Actually iOS has more security than you could ever get on a Windows platform with an anti virus. The only way to run executable code on iOS is to install it via the AppStore, to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware. Even if your malware gets trough you are still stuck in your apps sandbox and once Apple realizes what you have done, they can remotely pull all instances of your app and the police will be waiting for you outside. So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware.
- arkitaip 14y ago
  "to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware. Let's hope no one sets up The International Obfuscated Objective-C Code Contest; or that the code reviewers at Apple are competent and experience enough to work with advanced software security threats. "Even if your malware gets trough you are still stuck in your apps sandbox" Sandboxes can and are exploited. Recently [1] "So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware." Sure on HN we all know that security is more than (anti) viruses. [1] http://www.techspot.com/news/47731-google-rushes-out-chrome-patch-for-sandbox-exploit-other-still-lurks.html http://www.techspot.com/news/47731-google-rushes-out-chrome-...
  - pooriaazimi 14y ago
    ?! Just because Chrome's sandbox was exploited, doesn't mean sandboxes will always be exploited, so they're not effective.
  - cantankerous 14y ago
    Let's hope no one sets up The International Obfuscated Objective-C Code Contest; or that the code reviewers at Apple are competent and experience enough to work with advanced software security threats. Apple isn't doing thorough code reviews of every app they get. They're just checking sanity and adherence to "the rules". Even if the code was obfuscated and they wanted to review your code, they could write you an email that says "your code is unreadable, make it better or you're not going to get on the app store". Sandboxes can and are exploited. So are you saying that because Chrome was exploited, that the sandbox model in iOS some how makes the system less secure? The notion doesn't follow. Yes, sandboxes can be exploited, but it's NOT EASY TO DO THIS. The idea behind good, secure design is not to try to secure from every attack vector possible, but to eliminate low hanging fruit entirely, and make elaborate breaches very, very expensive to find and create. Apple is doing all of this here with the sandbox design, and it works quite well for them. Sure on HN we all know that security is more than (anti) viruses. Case-in-point: iOS. Quite secure, doesn't require anti-virus software to be as secure as it is.
bradleyland 14y ago
Here's the thing, A/V software is just one more thing to work around. There's no inherent aspect of an operating system that should require A/V, and there's nothing about A/V that suddenly makes a system invulnerable to exploit. Yes, security should be managed in layers, but the management of those layers should be trusted to the "right" person. A/V companies believe that they are the right person. Apple believes that they are the right person. If you're going to levy the "security theather" attack at Apple, we could just as easily fire that shot in the direction of A/V companies. When "malware" came on the scene, A/V companies were completely unprepared. Their response was that "malware isn't a virus". From a technical perspective, they're correct, but from the user's perspective, it was a huge failing. Virtually everyone I know who has been affected by malware said the same thing: "But I pay for Kaspersky/McAfee/Avast/Whatever anti-virus, how did I get infected!?" I'm supposed to believe that these are the "right" people with whom to entrust the security of my computer?
- tjoff 14y ago
  There's no inherent aspect of an operating system that should require A/V... Most operating systems allow you to install software. If the user installs software from untrustworthy sources an A/V is the only thing that can protect him/her. No it isn't perfect but few claim it to be.
  - gurkendoktor 14y ago
    > If the user installs software from untrustworthy sources This has never been an inherent possibility on mobile operating systems.
    - cantankerous 14y ago
      Well, you can do it on Android, but they make it hard enough that you really have to know that you want to. There have been isolated instances of this being a source of malicious problem for users, though.
  - bradleyland 14y ago
cantankerous 14y ago
You do know that anti-virus software is most definitely security theater at its finest, right? It gives users around the world a false sense of security. "I'm safe because I'm running McAfee/Kaspersky/Norton/what-have-you." I'd say pretty much every infected machine I've dealt with has had anti-virus software on it.

randomdata 14y ago

I've never understood why this hasn't happened. It seems like being the first to create a widespread Mac (or Linux, etc.) virus would be much more appealing to write than just yet another Windows virus. Everyone and their brother have already done that.

nl 14y ago
There are plenty of *nix viruses around, except they are usually known as worms. The first author[1] of a successful worm[2] did become quite famous from it, later did a startup[3] and even later went on to be one of the co-founders of this thing called YCombinator[4]. [1] http://en.wikipedia.org/wiki/Robert_Tappan_Morris http://en.wikipedia.org/wiki/Robert_Tappan_Morris [2] http://en.wikipedia.org/wiki/Morris_worm http://en.wikipedia.org/wiki/Morris_worm [3] http://en.wikipedia.org/wiki/Viaweb http://en.wikipedia.org/wiki/Viaweb [4] Seriously?
- cantankerous 14y ago
  FWIW, the Morris worm was a Unix worm from the 80's. It's not quite on par with the malware you'd see roaming around on Linux machines today, if such malware does exist and is, in fact, roaming around. The existence of the Morris worm doesn't really say much about the resilience of today's Linux to worms or viruses.
  - nl 14y ago
    I'm not sure what your point is. Yes, malware can be a lot more sophisticated now than it was in 1988. In many cases it doesn't need to be though. For example, there was a comparatively recent case of a botnet infecting Linux-based routers which lacked front end authentication[2](!!). Exploitable software runs on many platforms. The existence of the Michelangelo virus[1] doesn't really say much about the resilience of today's Windows to worms or viruses. [1] http://en.wikipedia.org/wiki/Michelangelo_(computer_virus) http://en.wikipedia.org/wiki/Michelangelo_(computer_virus) [2] http://lwn.net/Articles/325434/ http://lwn.net/Articles/325434/
- deleted 14y ago
  [deleted]
esbwhat 14y ago
There are OS X viruses out there. Linux would be harder because of an increased fragmentation and systems being more up-to-date generally (especially since linux is commonly used on servers, and thus held up to a different standard of security in first place) On windows or mac, getting a virus to run is generally just a matter of packaging it with some downloadable software. In linux, pretty much everything is available through package managers. You can't just throw a virus into a torrent for photoshop or whatever. That being said, I'm by no means an expert.
- randomdata 14y ago
  They certainly exist, but nobody has successfully created one that has spread to the levels seen on Windows system. That's really what I'm referring to: Something that would cause panic in the media, so to speak. Code that attacks a small handful of systems isn't particularly interesting to anyone, no matter what platform it targets, Windows included.
  - jpxxx 14y ago
    I respectfully disagree. Fully functioning and frequently self-replicating malware does now exist in the wild for the Mac platform. I've seen drive-by website infections, malicious software installs using social attacks, and malicious attachments infecting Office. When Flashback alone infecting the better part of one million Macs, it is now newsworthy.

thomasnext 14y ago

What "security theater?" They have an iron fist when it comes to the app store, but they aren't telling you to input your SSN or taking blood samples.

excuse-me 14y ago
"security theater?" = there's no need to worry about security because the app store guarrantees that. What if there is a hack/mistake/bug in the appstore ? There's no need to worry about security because the app store guarrantees that.
- LargeWu 14y ago
  That's not really what "security theater" means. Security theater refers to highly visible actions that make it seem like enhanced security, but ultimately have no effect. Think: the ticking agent asking you if you are bringing bombs onto the plane in your luggage. The Apple review process, draconian as it may be, almost certainly has a real, strong effect in actually preventing malware.
  - excuse-me 14y ago
    Security theatre is also putting all your faith in some security authority who claim that it must be safe because they are the security authority - but you aren't allowed to look under the hood. It's exactly like the TSA having magic terrorist detectors - but you can't be told how they work because of security
  - larrys 14y ago
    "Think: the ticking agent asking you if you are bringing bombs onto the plane in your luggage." Actually average people would probably know enough to think "someone could just lie when asked - that doesn't provide protection". To me "security theater" is doing things that seem to appear to lock something down in the eyes of an average uninformed person. Average is not Bruce Schneier or an 8 year old. It's a typical traveler who believes they are secure because they see checkpoints, have to take their shoes off, and have to have their laptop scanned.

voidr 14y ago

Actually iOS has more security than you could ever get on a Windows platform with an anti virus. The only way to run executable code on iOS is to install it via the AppStore, to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware. Even if your malware gets trough you are still stuck in your apps sandbox and once Apple realizes what you have done, they can remotely pull all instances of your app and the police will be waiting for you outside. So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware.

arkitaip 14y ago
"to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware. Let's hope no one sets up The International Obfuscated Objective-C Code Contest; or that the code reviewers at Apple are competent and experience enough to work with advanced software security threats. "Even if your malware gets trough you are still stuck in your apps sandbox" Sandboxes can and are exploited. Recently [1] "So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware." Sure on HN we all know that security is more than (anti) viruses. [1] http://www.techspot.com/news/47731-google-rushes-out-chrome-patch-for-sandbox-exploit-other-still-lurks.html http://www.techspot.com/news/47731-google-rushes-out-chrome-...
- pooriaazimi 14y ago
  ?! Just because Chrome's sandbox was exploited, doesn't mean sandboxes will always be exploited, so they're not effective.
- cantankerous 14y ago
  Let's hope no one sets up The International Obfuscated Objective-C Code Contest; or that the code reviewers at Apple are competent and experience enough to work with advanced software security threats. Apple isn't doing thorough code reviews of every app they get. They're just checking sanity and adherence to "the rules". Even if the code was obfuscated and they wanted to review your code, they could write you an email that says "your code is unreadable, make it better or you're not going to get on the app store". Sandboxes can and are exploited. So are you saying that because Chrome was exploited, that the sandbox model in iOS some how makes the system less secure? The notion doesn't follow. Yes, sandboxes can be exploited, but it's NOT EASY TO DO THIS. The idea behind good, secure design is not to try to secure from every attack vector possible, but to eliminate low hanging fruit entirely, and make elaborate breaches very, very expensive to find and create. Apple is doing all of this here with the sandbox design, and it works quite well for them. Sure on HN we all know that security is more than (anti) viruses. Case-in-point: iOS. Quite secure, doesn't require anti-virus software to be as secure as it is.

bradleyland 14y ago

Here's the thing, A/V software is just one more thing to work around. There's no inherent aspect of an operating system that should require A/V, and there's nothing about A/V that suddenly makes a system invulnerable to exploit. Yes, security should be managed in layers, but the management of those layers should be trusted to the "right" person. A/V companies believe that they are the right person. Apple believes that they are the right person. If you're going to levy the "security theather" attack at Apple, we could just as easily fire that shot in the direction of A/V companies. When "malware" came on the scene, A/V companies were completely unprepared. Their response was that "malware isn't a virus". From a technical perspective, they're correct, but from the user's perspective, it was a huge failing. Virtually everyone I know who has been affected by malware said the same thing: "But I pay for Kaspersky/McAfee/Avast/Whatever anti-virus, how did I get infected!?" I'm supposed to believe that these are the "right" people with whom to entrust the security of my computer?

tjoff 14y ago
There's no inherent aspect of an operating system that should require A/V... Most operating systems allow you to install software. If the user installs software from untrustworthy sources an A/V is the only thing that can protect him/her. No it isn't perfect but few claim it to be.
- gurkendoktor 14y ago
  > If the user installs software from untrustworthy sources This has never been an inherent possibility on mobile operating systems.
  - cantankerous 14y ago
    Well, you can do it on Android, but they make it hard enough that you really have to know that you want to. There have been isolated instances of this being a source of malicious problem for users, though.
- bradleyland 14y ago

cantankerous 14y ago

You do know that anti-virus software is most definitely security theater at its finest, right? It gives users around the world a false sense of security. "I'm safe because I'm running McAfee/Kaspersky/Norton/what-have-you." I'd say pretty much every infected machine I've dealt with has had anti-virus software on it.