Breaking News - The Worm Turns

[VanMac]

From CNN.
BREAKING NEWS A worm shut down computers running Windows 2000 software across the United States. More soon.
www.cnn.com

Man, I feel so happy that I just bought a mac :)

[wiz7dome]

Ok. Now everybody pay attention to how quickly they say "Macintosh computers not effected."

[AJ Muni]

My iBook is sitting back watchin the cnn report sippin' his margarita....what a life! :)

[Doctor Q]

This one is serious!Among those hit were offices on Capitol Hill and media organizations, including CNN, ABC and The New York Times.They are calling this one worm-rbot.cbq and they say it may have been derived from the Zotob (http://www.microsoft.com/security/incident/zotob.mspx) worm.

I will continue merrily working while my coworkers are scurrying around installing patches.

[wiz7dome]

Nothing new. One of the anchors just said that "even if your using a mac you're not safe"

Good grief.

*edit* spelling errors.

[Doctor Q]

Nothing new. One of the anchors just said that "even if your using a mac you're not save"It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:

[mad jew]

Steve's evil plan (http://forums.macrumors.com/showthread.php?t=144192) is all falling into place.

[mjstew33]

My step mom aka C R A Z Y step mom runs Windows 2000, and works for John Deere (she's a programmer) and she would be FREAKING out right now if her machine got shut down, but it's not because she has a Deere's security, and damn, it's good security, as all I know from her, she tells me how many labs they have of security and stuff, quite interesting.

[dmw007]

Yet another virus invasion for poor afflicted peecee users....

...Oh well, I am just glad that I am smart enough to use Mac OS X! :)

[CoMpX]

I love when this kind of thing happens...because it just makes me feel sooooo proud of my Macs, and I just LOVE to rub it in PC users face's! :D

[zflauaus]

Well, I'm glad I switched. Now, to start working on the rest of the family. Hee hee hee.... :D

[dmw007]

I love when this kind of thing happens...because it just makes me feel sooooo proud of my Macs, and I just LOVE to rub it in PC users face's! :D

Same here :)

[dmw007]

. Now, to start working on the rest of the family. Hee hee hee.... :D

Best of luck on your worthy crusade my friend. :)

[goodtimes5]

Woo hoo! Good times! (for us, of course).

[zflauaus]

Best of luck on your worthy crusade my friend. :)
Thanks, I'll need it. I'll just say two sentences to my family members, "Guess What is awesome about the Mac? No spyware, no viruses, no problems."
:D

[dmw007]

Thanks, I'll need it. I'll just say two sentences to my family members, "Guess What is awesome about the Mac? No spyware, no viruses, no problems."
:D

The same phrase that I love to tell people-
they usually just stare at me and utter in amazement, "no viruses!!!"

[wdlove]

It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:

Very good Doctor Q, that was quick thinking. It gave me a nice chuckle. When will they learn. Guess that CNN anchor didn't receive the memo about a Mac.
:D

[AJ Muni]

It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:

lol thats hilarious doc

[Heb1228]

It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:
Ha. the only thing to worry about when viruses are released :D

[The_Man]

It really give you a nice warm feeling knowing that you have a mac. I like to see stories like this to help wake up the PC world. Someone today was asking me about a laptop and I recommonded an iBook. She was astounded by the fact that it cant get virus'. I might have switched her.

[dmw007]

It really give you a nice warm feeling knowing that you have a mac. I like to see stories like this to help wake up the PC world. Someone today was asking me about a laptop and I recommonded an iBook. She was astounded by the fact that it cant get virus'. I might have switched her.

Good job on the potential convincing of someone to switch!

[hayduke]

...you had the virus? The article states:

"Symptoms include the repeated shutdown and rebooting of a computer."

Isn't that the NORMAL operating mode? ;) Is that really a symptom? This "virus" sounds benign to me! :eek:

[florencevassy]

...you had the virus? The article states:

"Symptoms include the repeated shutdown and rebooting of a computer."

Isn't that the NORMAL operating mode? ;) Is that really a symptom? This "virus" sounds benign to me! :eek:


:) :cool: :D Good point! So glad I am a Mac user..... :cool:

[jamesW135]

I switched when i heard that macs dont get viruses.

[Sharewaredemon]

...you had the virus? The article states:

"Symptoms include the repeated shutdown and rebooting of a computer."

Isn't that the NORMAL operating mode? ;) Is that really a symptom? This "virus" sounds benign to me! :eek:


hahaha!

so true!

well put!

[Applespider]

The same phrase that I love to tell people-
they usually just stare at me and utter in amazement, "no viruses!!!"

Yeah, people do find it hard to believe. One of the guys at work was telling me about this virus today and asked if I was all up to date. I shrugged and said that it wouldn't affect me. When I told him that I had a Mac so didn't get viruses, he looked at me like I was an idiot and said 'yeah, except for Mac viruses'. When I explained there weren't any of those either (aside from the old Office macros), he refused to believe me until he went off and googled. He's now seriously considering a back-up Mac

[4God]

It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:


BWAH-HA-HA-HA :D That's great! BWAH-HA-HA-HA-A=HA.........

[dsharits]

I laughed out loud when I got the CNN breaking news update yesterday. This kind of hysteria is just so funny to me, because we can just sit here and watch it all safely.

[Sharewaredemon]

It's really interesting when you think of how serious people take these outbreaks, they make it seem like it's a real virus. Which might be why I find it so surreal that I can sit and watch without having to worry about getting infected...

[xsedrinam]

This one is serious!They are calling this one worm-rbot.cbq and they say it may have been derived from the Zotob (http://www.microsoft.com/security/incident/zotob.mspx) worm.

I will continue merrily working while my coworkers are scurrying around installing patches.
The most scary scenario in this: [they're still using Windows 2000]"on Capitol Hill? :eek:
X

[Mr. Anderson]

The most scary scenario in this: [they're still using Windows 2000]"on Capitol Hill? :eek:
X

There is a severe lack of non Windows machines on Capitol Hill. Its been that way for a while, unfortunately, with no real change in sight. It would be nice if continued threats like this make them look for alternatives, but the PC/Windows machines as so very much intrenched in the Hill that it will take a huge effort to get rid of them.

The FBI has a lot of Macs because of the security advantages though.

D

[camomac]

The most scary scenario in this: [they're still using Windows 2000]"on Capitol Hill? :eek:
X

the even scarier part is it goes all the way back to windows 95!

that must be some 'hole'

[dmw007]

There is a severe lack of non Windows machines on Capitol Hill. Its been that way for a while, unfortunately, with no real change in sight.
D

Hopefully, there are at least a few renegade lawmakers that use their PowerBook G4s that they sneak into and out of their offices each day..........

.........wonder what type of computer George W Bush (or perhaps Hillary Clinton) uses? ;)

[iSaint]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?

[dmw007]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?

Yes, both points, yours & his, have some truth behind them.

[Dr. Dastardly]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?
But you have to ask yourself this when someone uses the "tiny marketshare" arguement. The Mac community is big enough (millions of users) and doesn't have one single virus. If someone were to write a virus for the Mac, don't you think they would get ALOT of attention. And at the end of the day thats all virus writers want.

[GKThursday]

To answer a question up there somewhere, Bush is a Mac user. I think, but am not positive, that he has a powerbook. Incidentally, Kerry is also a Mac user.

GK

[dmw007]

To answer a question up there somewhere, Bush is a Mac user. I think, but am not positive, that he has a powerbook. Incidentally, Kerry is also a Mac user.

GK

Makes you feel a little bit better to know that the man
at 1600 Pennsylvania Ave uses a Mac.

[VanNess]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?

Ask the experts (http://www.computerworld.com/securitytopics/security/story/0,10801,97157,00.html)

[zflauaus]

Makes you feel a little bit better to know that the man
at 1600 Pennsylvania Ave uses a Mac.
Thank goodness. If not, boycott! :D :D

[dmw007]

Ask the experts (http://www.computerworld.com/securitytopics/security/story/0,10801,97157,00.html)

A nice example of how Mac OS X is so very, very safe & secure! :D

[dmw007]

Thank goodness. If not, boycott! :D :D

Agreed. We only want a President that is a Mac user.

Its time for no more Dells in the White House! :)

[punkbass25]

i dont get what kind of arguement people are trying to make when they say, the mac doesnt ahve any virus' because its obscure...

well who ****in cares how it happened all i care about is that there is no virus' as opposed tot eh thousands and thousands of ones for windows.. so at the end of the day, even if supposing mac OSX isnt any more secure, i still dont have to deal with pesky virus' and anti spyware, and anti virus software.

[ajampam]

It's true. We could be hit by panicked Windows 2000 users running down the street! :eek:
That is real funny....very profound that coz I was just about enter my lab yesterday when my anxious labmate literally ran into me to call for tech support as PC was infected!!!!! :D

[ajampam]

But you have to ask yourself this when someone uses the "tiny marketshare" arguement. The Mac community is big enough (millions of users) and doesn't have one single virus. If someone were to write a virus for the Mac, don't you think they would get ALOT of attention. And at the end of the day thats all virus writers want.
Absolutely!!! This has been my fundamental argument with al my PC friends who sneer from behind the dumbest excuse I have ever heard....any given day what is it that hackers and virus writers want? Attention and some sense of false pride....when so many articles are being published showing mac osx to be so secure would it not be their first instinct to try and break it down??? It is like savoring a victory by beating a real, worthy opponent....small market share...bunch of trash!!!!!!

[dukeblue91]

For most PC users Windows is like being in a abusive relationship
that you know you need to get away from but you are to scared to actually do it.

I don't support my friends and family running windows anymore
and just tell them to get a Mac when they buy there next computer and they won't have to worry about stuff like this.
But guess what happens when the time comes to buy a new computer, they buy another PC and when asked why they'll give you the story of this is what they know or the computer was on sale.

So as far as I'm concerned from that point forward they get exactly what they deserve.

[dsharits]

For most PC users Windows is like being in a abusive relationship
that you know you need to get away from but you are to scared to actually do it.

I don't support my friends and family running windows anymore
and just tell them to get a Mac when they buy there next computer and they won't have to worry about stuff like this.
But guess what happens when the time comes to buy a new computer, they buy another PC and when asked why they'll give you the story of this is what they know or the computer was on sale.

So as far as I'm concerned from that point forward they get exactly what they deserve.
Very cruel, but an extrememly good policy. I like it! :D

[XNine]

Hopefully, there are at least a few renegade lawmakers that use their PowerBook G4s that they sneak into and out of their offices each day..........

.........wonder what type of computer George W Bush (or perhaps Hillary Clinton) uses? ;)

Neither are smart enough to use a Mac in the first place, what, with George W having an 8th grade level in English and Hillary thinking she's gonna be President.

[Crikey]

Hopefully, there are at least a few renegade lawmakers that use their PowerBook G4s that they sneak into and out of their offices each day..........

.........wonder what type of computer George W Bush (or perhaps Hillary Clinton) uses? ;)

Etch-A-Sketch, probably.


Crikey

[tuartboy]

Neither are smart enough to use a Mac in the first place, what, with George W having an 8th grade level in English and Hillary thinking she's gonna be President.

Did you mean to use "gonna" in the same sentence as your Bush judgement? :p

[Stampyhead]

For most PC users Windows is like being in a abusive relationship
that you know you need to get away from but you are to scared to actually do it.
Awesome. Very true. That's the best analogy I've heard yet.

[Crikey]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?

Typically, you don't get to be a Computer Science grad without learning about Unix. There are/have been both viruses and worms for Unix systems -- the original "Internet worm" (the Morris worm) infected Unix machines. Apple certainly takes the potential seriously, otherwise they wouldn't release security updates like they did the other day.

I think there is something to the "small market share" argument, but there is more to the lack of Mac viruses than that. First of all, people write viruses for the platforms they have access to. If virus writers follow the normal distribution of system usage, 97% of them have PCs, therefore at least 97% of viruses should be written for PCs.

I give some credence to the "Windows as abusive relationship" theory. Mac users tend to *like* their computers, and have fewer frustrations and hostile feelings to work out against them. Windows users are used to dealing wtih Windows hassles, and apparently some of them want to create more. Other plaforms that people use because they like them (OS/2, Linux, BeOS), rather than because they are the standard, also saw and see less malware.

Certainly, Apple tries to stay on top of the potential vulnerabilities in its product. MacOS X may have fewer inherent vulnerabilities than Windows for this reason, and because the BSD Unix it's based on has a reputation for solid code and decent security from design through execution and decades of debugging.

I also think there is an advantage in offering a product that has the reputation of being expensive, even if in reality it's little or no more expensive than comparable options. When I was a starving student and learning about hacking, I was buying PCs. Now that I'm not starving any more and I'm using Macs, I also have a better perspective on how valuable my time is and I'm less likely to waste it writing malware.

If you're interested in writing a virus or worm, you want it to propagate. Regardless of the inherent security or insecurity of the respective platforms, you're going to want to target the one that has 97% of the market because there are more systems to provide your code with "critical mass".

I think a lot of factors play into the lack of Mac viruses. I think market share is a big one, but I think psychology and demographics are at least as important.


Crikey

[kamper]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?
Ask the experts (http://www.computerworld.com/securitytopics/security/story/0,10801,97157,00.html)
That article was dumb. The idea that linux accounts for more security breaches than windows is simply ridiculous. Security aside, there simply aren't enough linux boxes out there. They could all be breached 5 times and there still wouldn't be as many as windows.

That said, macs do benefit very much from security by obscurity. Not only is there little benefit in targetting the platform because there aren't many users, a worm could never spread itself over the internet because there isn't a critical mass of machines to target (as was just pointed out).

Claiming that "the Unix base of OS X" gives you an automatic shield from all harm is silly. The name "UNIX" (as Apple marketing likes to throw around so much) isn't some magic wand that gives you perfect reliability and security. Sure, it's a better model than windows where the average user is running with admin privileges all the time, but if someone is determined they can hack just about anything. Again, it's just not worth anybody's time to hack os x when there are plenty of windows vulnerabilities with free exploit code.

The attraction to hacking something is not glory, as you're all supposing. There is a very serious industry based on delivering adware and spyware to the desktops of computer illiterate people. Again, security by obscurity: crack every mac out there and you have a few million victims, crack a small percentage of windows machines and you have many more which = more profit.

It's all fine and good to gloat that we're sitting safe behind our macs (because we are very safe, comparatively speaking), but please don't claim that the differences in engineering between mac osx and windows are the only (or even primary) reason. A reasonably savvy windows user who uses a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us.

[berkleeboy210]

This worm supposedly hit computers in Disney World, and actually shut down rides.

[patrick0brien]

This worm supposedly hit computers in Disney World, and actually shut down rides.

-berkleeboy210

Oh dear GOD!

"It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world..."

[berkleeboy210]

-berkleeboy210

Oh dear GOD!

"It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world..."

lol, that ride annoys me the most. I'd hate to be stuck on that with the music playing over and over again :eek:

[dmw007]

-berkleeboy210

Oh dear GOD!

"It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world after all...It's a small world..."

I needed therapy after going on that ride. ;)

[dmw007]

Etch-A-Sketch, probably.


Crikey

:eek: lol. That is hilarious Crikey. Thanks for the laugh. :D

[dotdotdot]

Of course, everyone is forgetting this is Windows 2000 being affected - not XP, the most recent release.

[dmw007]

Of course, everyone is forgetting this is Windows 2000 being affected - not XP, the most recent release.

It affects Windblows 2000 & early versions of XPee.

[Xapplimatic]

Well, I'm glad I switched. Now, to start working on the rest of the family. Hee hee hee.... :D

I feel lucky.. My entire family switched two years back.. and except for my mental sister-n-law that nobody listens to who thinks a 100 MHz Compaq Presario on dialup was a good time, nobody misses Winblows at all.. :)

[VanNess]

That article was dumb. The idea that linux accounts for more security breaches than windows is simply ridiculous. Security aside, there simply aren't enough linux boxes out there. They could all be breached 5 times and there still wouldn't be as many as windows.

That said, macs do benefit very much from security by obscurity. Not only is there little benefit in targetting the platform because there aren't many users, a worm could never spread itself over the internet because there isn't a critical mass of machines to target (as was just pointed out).

Claiming that "the Unix base of OS X" gives you an automatic shield from all harm is silly. The name "UNIX" (as Apple marketing likes to throw around so much) isn't some magic wand that gives you perfect reliability and security. Sure, it's a better model than windows where the average user is running with admin privileges all the time, but if someone is determined they can hack just about anything. Again, it's just not worth anybody's time to hack os x when there are plenty of windows vulnerabilities with free exploit code.

The attraction to hacking something is not glory, as you're all supposing. There is a very serious industry based on delivering adware and spyware to the desktops of computer illiterate people. Again, security by obscurity: crack every mac out there and you have a few million victims, crack a small percentage of windows machines and you have many more which = more profit.

It's all fine and good to gloat that we're sitting safe behind our macs (because we are very safe, comparatively speaking), but please don't claim that the differences in engineering between mac osx and windows are the only (or even primary) reason. A reasonably savvy windows user who uses a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us.

Well, if you think the article was "dumb" you can't possibly know who mi2g is. (Hint: they are acknowledged world-wide as digital risk specialists).

And the "security through obscurity" rationale as the exclusive reason Mac's haven't seen virtually a single instance of virus infections/trojans/spyware/malware, et al., just doesn't pass the smell test. The installed based numbers compared to windows might seem small - comparatively - but the Mac user base isn't that insignificant. You need only ask, ironically, Microsoft. Bill Gates himself said earlier this year that Office for the Mac has been very profitable for Microsoft. Suddenly, it seems it's not a such a small installed base after all, if Microsoft can easily justify developing for it. All in all, the market share exclusion theory just doesn't explain why there has been virtually nothing in the way of viruses, trojans or spyware to date on the platform. There is certainly a large enough target (millions and thus, newsworthy) of a rather notorious installed user base to ring at least one malware author's bell, but there's been nothing.

And the glory-seekers, are in fact still out there, happily coexisting with Spyware Marketing Solutions, Inc. Sven Jaschan, author of the Sassar and Netsky worms (two of of most disruptive viruses ever written), was a teenager arrested sitting at his Mom's home computer. His reason, according to investigators, was to "gain fame as a programmer"

The fact is, the are very real differences between OS X and Microsoft Windows of any version. Whereas Microsoft designed it's OS architecture to be interdependent with Explorer, Word, WMP, et al., the Mac OS X system and inclusion of the Unix architecture was designed with security at the forefront, not application interdependency. That alone raises the barrier to unauthorized, malicious entry. OS X requires an administrator password to install software, update the system, make certain configuration changes, and so on. The differences between OS X and Windows are much more significant than market share. No one is claiming the Unix foundation of OS X is a guarantee of immunity; no OS will ever be hack-proof, but OS X is proof that an ounce of prevention is still worth a pound of cure.

By the way, I wish CNN, ABC, the US Government, and countless other large corporations knew that "reasonably savvy windows user[s] who use a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us." Now you tell them, lol.

[iMeowbot]

That article was dumb.
Well yeah, consider the source. mi2g are well known for sensationalism and, at times, outright fabrication.

Hysteria roll call: mi2g (http://vmyths.com/resource.cfm?id=64&page=1)
Security Through Soundbyte: The 'Cybersecurity Intelligence' Game (http://www.infowarrior.org/articles/2002-12.html)
Why is mi2g so unpopular? (http://www.theregister.co.uk/2002/11/21/why_is_mi2g_so_unpopular/)

[Xapplimatic]

A reasonably savvy windows user who uses a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us.

That couldn't be farther from the truth. Wether or not it's "security through obscurity" is irrelevant. That phrase shouldn't even be used in an honest forum because it smacks of anti-Apple bias since there's nothing "obscure" about the Macintosh platform, Mac OS, or Apple... As much as Microsoft has traditionally tried to pretend that Apple is obscure, it isn't anymore obscure than the press decides it is.. Mac usership hasn't changed that much, but has remained relatively stable over the long haul now on the increase. The iPod decided for the press that Apple was nolonger "obscure". How quaint.

As you know, there are no true viruses on Mac OS X. The only purported trojan horse was a stunt by a security firm ("Integro" if memory serves) to sell Mac users their anti-malware which basically only focuses on keeping Windows viruses out of emails sent from Macs to Windows machines. That exploit was fixed within less than a month by Apple itself. Compare that to literally several new real viruses every day on Windows.. over 100,000 known viruses in the wild, do the math. Obscurity if valid couldn't even begin to account for that stark of a contrast. Truth be told: It doesn't matter if you use Internet Exploiter or FireFox, it's still Intel code under a sketchy Windows OS. Pure engineering explanation. Windows has already exploited flaws that still exist unpatched. Some things go unpatched for months, even years on Windows. Mac OS X's only known exploits aren't generally known pretty much until the patches are already released for them detailing what the exploits were.

Good engineering deploys high levels of public scrutiny to find flaws and provide feedback for corrections. Microsoft lacks this step in product development. Their code review is all inhouse, closed door. So from a purely engineering point of view, UNIX is always going to be more secure and less bug-plagued than Windows anything until Microsoft changes their closed-source practices.. Any *nix is going to be more secure than Windows because anybody (including all the independent security firms) out there can review the collective sourcecode of all the various apps that comprise the system and report flaws/potential exploits privately to the parties concerned to generate a patch before a hacker finds out about it on some website. While its true that hackers also have more access to find things too to exploit, the reality is that it rarely works this way. Usually if a hacker spots a problem for malicious exploit, by the time they see it, someone with more well-meaning intent has also found it and reported it for prompt patching. WIth Windows, only hackers will have the source code for it because genuine security firms aren't legally allowed to use copies of "stolen Windows source code". That's not a good situation at all.

Windows users must wait 100% on Redmonds to do everything for them. Redmonds has to become aware of the flaw, decide that it's worth fixing, and then handle generating the patch code 100% on their own since their OS isn't based upon open source projects at any level. Apple on the other hand may find most of its OS flaws are already corrected for them by the open source community by the time management becomes aware of the need for a patch. They simply incorporate the new versions of code into their code tree for OS X and voila, patches are in place without much effort on Apple's part. The advantage of that is obvious. The open source community and all its resources and millions of eyes and brains are a resource shut off from Redmonds.. Microsoft will shun the favor of public review while Apple welcomes it. Smart move for Apple.

Windows will never have the advantage of peer review because Redmonds forbids access to nearly everyone outside to review their source code (save for court order that is). Furthermore, they don't even let any one department examine the entire source tree for Windows (Bill Gates is ultra paranoid didn't you know), as each department manages its own segment of Win code. That way (Gates thinks) no one engineer can be paid off by an outside company to steal the source code for Windows because nobody save a priveleged few have access to all of it.. geeeez.. and people wonder why Windows still has so many security holes, bugs, and why Longhorn is taking years to complete.. It's because its like the tower of Babel over there! How is a setup like that ever going to agree on anything or effectively create a cohesive, coherent product? Please.. don't ever tell me that engineering doesn't have a primary role in this problem, because buzz words and "obscurity" side-show distractions aside, engineering still plays the major role in this disastor or there would have been at least one good success at targetting Macs by now.

Obviously advertising dollars does not dictate why Macs aren't targetted. This is also a really off-base assessment of the issue at center because not all hackers hack for money. In fact, most of the ones hacking for money, contrary to your implication about advertising, are in fact getting paid by means of EXTORTION.. Banks have been handing over millions of dollars every month, black mailed by hackers to keep quiet about the credit and account information stolen from them. (Bank of America comes to mind). Many hackers hack systems just because they can. For some it is a form of art to prove their own sophistication. Some do it to take revenge on their ex-employers. Others may have more terrorist ideas in mind. There are lots of reasons why there are hackers. Targetted economics as a defacto reason is an extreme oversimplification and an attempt to support the obscurity argument with blinders when in fact that argument itself obscures the deeper truth that engineering really is the core of the security issue (and ultimately therefore the management which decided to deploy that failed system of engineering). Always has been. Always will be. Dollar bills can't blow holes through cement.. Engineer a tough enough OS and no amount of hacker-for-hire employment can change the fact that it is tougher to hack.

If you still don't believe that engineering is the key issue.. do you remember OS 9 and before? Let's take a trip down memory lane! The Mac had viruses before System X came around.. it had hundreds! They weren't nearly of the class and caliber of what Windows users suffer, but they did exist. What was the only difference between OS 9 and OS X? Wasn't obscurity! It was engineering! One (System 9) was closed source 100% just like Windows. Now with that in mind, it kind of takes the air out of the sales of the "obscurity" argument now doesn't it? Obscure would be deploying some has-been like STOS, Amiga OS or BeOS.. Otherwise you are calling Unix as a whole obscure, because Mac OS is based upon unix source code. The parts that aren't (like the user interface) don't matter much because they usually have little to do with security.

There were a few reasons why Apple dropped its closed-source OS for a new OS based upon open-source BSD. One of them was security. Clearly open-source stimulates faster discovery, reporting, and patching of exploitable code problems. Open source gives any company smart enough to use it a much larger virtual engineering department to work with than any one private company would ever have the resources to employ on its own. This makes their OS more secure, and bolsters their bottom line. Open source is cheaper after-all. It makes financial sense and engineering sense to use it. Why do you think "little ol' Apple" was able to maintain a seperate source code for OS X on Intel the entire time since OS 10.0.0? Because it doesn't take as many resources when a large portion of the OS is already written for you by the open source community for nearly every processor type imaginable..

Microsoft (and its supporters) still just don't get it. Even now after the disappointing Dell Downturn and Harrowing Prediction at HP, Microsoft tries to blame its lackluster XP upgrade sales on piracy.. whatever. How about people don't want to shell out money for a half-broken product. If Microsoft had something respectable to offer the public, more people would be willing to pay for it. Perhaps they (like take a queue from Apple eh?) should worry less about piracy and more about product security and performance.. Microsoft will spend untold amounts upon engineering complicated and cumbersome validation and activation schemes that are nearly instantly hacked the second they are put out and don't deter anyone except potential customers who don't want to be bothered with such nonsense, but just isn't putting out significant effort to solve security problems with Windows.

I will lay it out like this.. the only way for Microsoft to end its security problems is to do exactly what they don't want to, and that is to rebuild Windows as a Microsoft GUI on top of a Unix base much like OS X.. Doing that they could gain respect, retain customers, improve their product, and solve the security morass they are stuck in. Nothing else they can do will ever lead to all of that.. Even if they open-sourced Windows itself, the code is probably in such a mess from segmentation between departments that most people won't even be able follow it, which is probably precisely the reason they won't open source it because they couldn't stand the public ridicule that would ensue when such dirty laundry is aired. It would be quite an event.. and even then, would anyone be able to write effective patches (other than Microsoft) for such a spaghetti mess? HMm...

[dmw007]

Very well said Xapplimatic!

[Savage Henry]

Very well said Xapplimatic!
I don't normally post mere 'dittos' but after reading Xapplimatic's post I thought I'd go against the grain.

Good read.

[VanMac]

I don't normally post mere 'dittos' but after reading Xapplimatic's post I thought I'd go against the grain.

Good read.
I ditto your ditto :)

[camomac]

Okay first off WOW. I mean I will usually skim REALLY long post like yours, but WOW that was an amazing explanation of the problem Microsoft truly faces with all their closed code projects.

Thank you.

However if Microsoft were to do that the whole IT industry would drop, or at least be downsized tremendously.

[emw]

we were impacted at the office - apparently routers were affected, along with e-mail servers, etc. Most personal computers were okay, even the PCs, but the servers somehow got infected.

We were down on and off for most of the day, so having a Mac helped in that I didn't have to install any patches, but I still couldn't get much work done.

[dmw007]

We were down on and off for most of the day, so having a Mac helped in that I didn't have to install any patches, but I still couldn't get much work done.

Isn't it great to have a computer that just works?! :)

[Dreadnought]

hmmmm, I have W2000on my pc @ work and with virtual pc on my G5, Should I be worried?

[kamper]

Ok, I've had to cut this post in half because it's too long for the forum. Please read the second half before responding...


A reasonably savvy windows user who uses a good firewall and applies patches when they are supposed to and doesn't use IE will be just as safe as us.
That couldn't be farther from the truth.
The vast majority of microsoft software holes have patches available before any kind of significant exploit is actually released to the public. Besides having the holes in the first place, microsoft's biggest security challenge is simply getting users to apply the patches that are available. If you put up a decent hardware firewall (eg. NAT, and very few computers using any operating system should ever be exposed without such a firewall), apply patches when they come out and exercise common sense while browsing you will be perfectly fine. Of course, decent antivirus and antispyware are important too, but that's cure, not prevention. Yes, this is far more work than you usually have to do with os x, but my point was, it's possible.
Wether or not it's "security through obscurity" is irrelevant. That phrase shouldn't even be used in an honest forum because it smacks of anti-Apple bias since there's nothing "obscure" about the Macintosh platform, Mac OS, or Apple... As much as Microsoft has traditionally tried to pretend that Apple is obscure, it isn't anymore obscure than the press decides it is.. Mac usership hasn't changed that much, but has remained relatively stable over the long haul now on the increase. The iPod decided for the press that Apple was nolonger "obscure". How quaint.
Why am I anti-Apple, just because I think security by obscurity is real? It's not a bad thing, and even if it was, is it against the rules to criticize Apple in any way, shape or form? Again, I'm not criticizing Apple here at all.
I'll admit, I don't know the market share percentages. Please cite some real statistics if you know them. I'd honestly be surprised if it's more than 5% on the desktop. That, coupled with the fact that osx is more secure than windows, makes it nearly impossible for a hypothetical mac virus to spread randomly over the internet the way the real windows ones do. If we were talking 50/50 it'd be a very different story (albeit, still in osx's favour).
As you know, there are no true viruses on Mac OS X. The only purported trojan horse was a stunt by a security firm ("Integro" if memory serves) to sell Mac users their anti-malware which basically only focuses on keeping Windows viruses out of emails sent from Macs to Windows machines. That exploit was fixed within less than a month by Apple itself. Compare that to literally several new real viruses every day on Windows.. over 100,000 known viruses in the wild, do the math. Obscurity if valid couldn't even begin to account for that stark of a contrast. Truth be told: It doesn't matter if you use Internet Exploiter or FireFox, it's still Intel code under a sketchy Windows OS.
What does Intel have to do with this? And yes, it does matter if you run IE or firefox or opera. Non-IE browsers don't have the gaping hole known as ActiveX for starters. Non-IE browsers sit at a fairly high level above the system, whereas IE is laced inextricably into windows. If you want to use numbers, compare the number of flaws in IE vs. non-IE that have actually been exploited. IE in it's current state is simply a hazard. Non-IE browsers benefit partly from better engineering and partly from obscurity.
Pure engineering explanation. Windows has already exploited flaws that still exist unpatched. Some things go unpatched for months, even years on Windows. Mac OS X's only known exploits aren't generally known pretty much until the patches are already released for them detailing what the exploits were.

Good engineering deploys high levels of public scrutiny to find flaws and provide feedback for corrections. Microsoft lacks this step in product development. Their code review is all inhouse, closed door. So from a purely engineering point of view, UNIX is always going to be more secure and less bug-plagued than Windows anything until Microsoft changes their closed-source practices.. Any *nix is going to be more secure than Windows because anybody (including all the independent security firms) out there can review the collective sourcecode of all the various apps that comprise the system and report flaws/potential exploits privately to the parties concerned to generate a patch before a hacker finds out about it on some website.
Independant security firms can get their hands on Microsoft's code too. For a proprietary software company, they're actually not all that bad at sharing source code. More on Apple and proprietary code in a bit...
While its true that hackers also have more access to find things too to exploit, the reality is that it rarely works this way. Usually if a hacker spots a problem for malicious exploit, by the time they see it, someone with more well-meaning intent has also found it and reported it for prompt patching. WIth Windows, only hackers will have the source code for it because genuine security firms aren't legally allowed to use copies of "stolen Windows source code". That's not a good situation at all.
Au contraire, crackers rarely find exploits by reading source code. Unless you are actively developing or bug-fixing, reading code is mind-numbingly boring and not particular conducive to understanding. Having code in the open is not a serious benefit to crackers until after they are aware of the general location of a hole they want to exploit.
Windows users must wait 100% on Redmonds to do everything for them. Redmonds has to become aware of the flaw, decide that it's worth fixing, and then handle generating the patch code 100% on their own since their OS isn't based upon open source projects at any level. Apple on the other hand may find most of its OS flaws are already corrected for them by the open source community by the time management becomes aware of the need for a patch. They simply incorporate the new versions of code into their code tree for OS X and voila, patches are in place without much effort on Apple's part. The advantage of that is obvious. The open source community and all its resources and millions of eyes and brains are a resource shut off from Redmonds.. Microsoft will shun the favor of public review while Apple welcomes it. Smart move for Apple.

Windows will never have the advantage of peer review because Redmonds forbids access to nearly everyone outside to review their source code (save for court order that is). Furthermore, they don't even let any one department examine the entire source tree for Windows (Bill Gates is ultra paranoid didn't you know), as each department manages its own segment of Win code. That way (Gates thinks) no one engineer can be paid off by an outside company to steal the source code for Windows because nobody save a priveleged few have access to all of it.. geeeez.. and people wonder why Windows still has so many security holes, bugs, and why Longhorn is taking years to complete.. It's because its like the tower of Babel over there! How is a setup like that ever going to agree on anything or effectively create a cohesive, coherent product? Please.. don't ever tell me that engineering doesn't have a primary role in this problem, because buzz words and "obscurity" side-show distractions aside, engineering still plays the major role in this disastor or there would have been at least one good success at targetting Macs by now.
Of course engineering is the primary reason for the existence of holes. It is not necessarily the primary reason for exploits of those holes.

Anyways, I'm well aware of the benefits of open source vs. proprietary software. I think Apple's decision to adopt Mach and FreeBSD is one of the coolest things that has happened in the computer industry in recent memory and it's the single biggest reason I'm using a mac today. However, that's not the whole story. It's quite possible to develop secure software in a proprietary environment, microsoft just happens to be a very bad example.

Furthermore, open source is only part of apple's story. There is still the graphics system and lot's of utilities and applications that are not open source. Holes in the higher-level userland stuff are just as dangerous as what Apple gets from the *nix community. Now it would seem that Apple has done a pretty good job of this, but again, my contention is that their work hasn't been nearly as strenously challenged as Microsoft's.

[kamper]

Continued ...

Obviously advertising dollars does not dictate why Macs aren't targetted. This is also a really off-base assessment of the issue at center because not all hackers hack for money. In fact, most of the ones hacking for money, contrary to your implication about advertising, are in fact getting paid by means of EXTORTION.. Banks have been handing over millions of dollars every month, black mailed by hackers to keep quiet about the credit and account information stolen from them. (Bank of America comes to mind).
Links to articles please? :) Anyways, how many banks do you know that run os x? How many actually run windows in vulnerable places? I'm not sure if this argument is relevant.
Many hackers hack systems just because they can. For some it is a form of art to prove their own sophistication. Some do it to take revenge on their ex-employers. Others may have more terrorist ideas in mind. There are lots of reasons why there are hackers. Targetted economics as a defacto reason is an extreme oversimplification and an attempt to support the obscurity argument with blinders when in fact that argument itself obscures the deeper truth that engineering really is the core of the security issue (and ultimately therefore the management which decided to deploy that failed system of engineering). Always has been. Always will be. Dollar bills can't blow holes through cement.. Engineer a tough enough OS and no amount of hacker-for-hire employment can change the fact that it is tougher to hack.
I never said that os x wasn't harder to crack than windows. That would be kinda silly :p Regardless, for all the situations that either of us have stated that a cracker might target a particular system, windows still has a much higher market share than os x. Higher market share = easier to exploit and more potential gains (whatever those gains may be). There's simply no way you can claim that these factors have no bearing on where crackers spend their time.
If you still don't believe that engineering is the key issue.. do you remember OS 9 and before? Let's take a trip down memory lane! The Mac had viruses before System X came around.. it had hundreds! They weren't nearly of the class and caliber of what Windows users suffer, but they did exist. What was the only difference between OS 9 and OS X? Wasn't obscurity! It was engineering!
You have an opportunity to educate me :) I know nothing about pre-osx Apple software or the existence of viruses.
One (System 9) was closed source 100% just like Windows. Now with that in mind, it kind of takes the air out of the sales of the "obscurity" argument now doesn't it?
No it doesn't. We're arguing about two different things here. Just because os x is more secure now than it was before, doesn't mean it doesn't benefit from obscurity. If pre-osx mac os had the market share that windows has now, perhaps it would have been exploited to a similar degree (who knows?). If os x had that market share it would, in all likelyhood, suffer much less problems but it would still be more than it has now.
Obscure would be deploying some has-been like STOS, Amiga OS or BeOS.. Otherwise you are calling Unix as a whole obscure, because Mac OS is based upon unix source code. The parts that aren't (like the user interface) don't matter much because they usually have little to do with security.
Please stop calling it unix source code. Unix, as you are referring to it, is merely a set of standards with many very diverse implementations. Apple, so far as I'm aware, has only adopted significant portions of code from the bsd and gnu communities, neither of which are really unix. Calling it bsd source code or unix principles makes much more sense.

And bs on the ui having little to do with security. A huge number of windows exploits are based on how IE handles webpages or how certain file formats are handled or how it's too easy for a user to allow malicious attacks to continue. Any time you have any data coming from outside the physical computer you have an opportunity for a hole. Apple and all the 3rd party vendors that supply software for os x have ample space to screw up.
There were a few reasons why Apple dropped its closed-source OS for a new OS based upon open-source BSD. One of them was security. Clearly open-source stimulates faster discovery, reporting, and patching of exploitable code problems. Open source gives any company smart enough to use it a much larger virtual engineering department to work with than any one private company would ever have the resources to employ on its own. This makes their OS more secure, and bolsters their bottom line. Open source is cheaper after-all. It makes financial sense and engineering sense to use it. Why do you think "little ol' Apple" was able to maintain a seperate source code for OS X on Intel the entire time since OS 10.0.0? Because it doesn't take as many resources when a large portion of the OS is already written for you by the open source community for nearly every processor type imaginable..
And kudos to apple for making this move.
Microsoft (and its supporters) still just don't get it. Even now after the disappointing Dell Downturn and Harrowing Prediction at HP, Microsoft tries to blame its lackluster XP upgrade sales on piracy.. whatever. How about people don't want to shell out money for a half-broken product. If Microsoft had something respectable to offer the public, more people would be willing to pay for it. Perhaps they (like take a queue from Apple eh?) should worry less about piracy and more about product security and performance.. Microsoft will spend untold amounts upon engineering complicated and cumbersome validation and activation schemes that are nearly instantly hacked the second they are put out and don't deter anyone except potential customers who don't want to be bothered with such nonsense, but just isn't putting out significant effort to solve security problems with Windows.

I will lay it out like this.. the only way for Microsoft to end its security problems is to do exactly what they don't want to, and that is to rebuild Windows as a Microsoft GUI on top of a Unix base much like OS X.. Doing that they could gain respect, retain customers, improve their product, and solve the security morass they are stuck in. Nothing else they can do will ever lead to all of that.. Even if they open-sourced Windows itself, the code is probably in such a mess from segmentation between departments that most people won't even be able follow it, which is probably precisely the reason they won't open source it because they couldn't stand the public ridicule that would ensue when such dirty laundry is aired. It would be quite an event.. and even then, would anyone be able to write effective patches (other than Microsoft) for such a spaghetti mess? HMm...
The idea of microsoft tossing out their kernel and adopting a *nix base is silly. There are plenty of customers who respect microsoft and benefit tremendously from their products. Granted, few of them travel in *nix circles :). There are also plenty of things that microsoft is doing right from a security perspective. They are adopting a virtual-machine based environment as their primary 3rd party software platform (which, afaik, apple has no plans on doing). This will have (and is having) great benefit for server applications and will benefit the desktop more as more of microsoft's software gets done in .NET. They are making it much easier for users to run as non-privileged users (which is the only really fundamental idea that they need to borrow from *nix). They are putting IE in a tight sandbox. They are adopting a more serious fundamental attitude towards security (albeit, very slowly). It's not like unix is the only possible way to implement a secure platform.

I'm no fan of microsoft. I dislike many of their business practices and their attitude towards producing useful software instead of making money. I'll be as amused as the next guy if Vista falls flat on it's behind from a security perspective, but I just don't see it happening.

Anyways, after that far-too-long rant, my summary is that I don't understand why people get offended when I suggest that security by obscurity has something to do with the fact that os x isn't a big target. I'm not criticizing apple's development process and I'm not praising microsoft's. It's just that it's not a simple matter of os x being better than windows.

[Doctor Q]

News link #1 (http://news.com.com/Arrests+made+in+probe+of+worm+that+hit+ABC%2C+others/2100-7348_3-5843583.html):Law enforcement officials have arrested two men suspected of unleashing of a pair of computer worms, including last week's Zotob, which hit servers at American Express, The New York Times and elsewhere.News link #2 (http://www.macworld.com/news/2005/08/26/zotob/):Local police have arrested several people in Turkey and Morocco under suspicion of involvement in last week’s spate of computer worms, according to Microsoft Corp. The worms known as Zotob, Rbot and Mytob, targeted the software giant’s Windows 2000 operating system.

[dmw007]

News link #1 (http://news.com.com/Arrests+made+in+probe+of+worm+that+hit+ABC%2C+others/2100-7348_3-5843583.html):News link #2 (http://www.macworld.com/news/2005/08/26/zotob/):

Its good to see those responsible for these acts brought to justice.

[NicP]

According to the Computer Science grad in my education classes this summer, Macs don't get viruses because there's such a small user base no one wants to mess with it. But he could make a Mac virus easily, he says.

Aside from his arrogance and idiocy, I understood (and he doesn't) the Unix base of OS X makes it much more difficult to create a workable virus on a Mac.

Is this right?

tell him he shouldnt have graduated, hes a moron

perhaps he dosent really understand what a computer virus is

http://en.wikipedia.org/wiki/Computer_virus

kamper: i dont think anyone would argue with you that security through obscurity isnt benificial to macs, its that your portray it as the MAIN reason macs dont viruses, which is simply nonsense. there would at least be the occasional virus on OSX if its primary means of defence was obscurity, as has been the case with previous versions of the mac os

[Doctor Q]

Creative is said to ship 4,000 wormy MP3 players

link (http://www.macworld.com/news/2005/09/01/creative/index.php?lsrc=mcrss)Creative Technology Ltd. has accidentally shipped almost 4,000 digital music players in Japan that contain a Windows worm, according to an advisory from Finnish security company F-Secure Corp.

[dsharits]

Creative is said to ship 4,000 wormy MP3 players

link (http://www.macworld.com/news/2005/09/01/creative/index.php?lsrc=mcrss)
HAHAHAHAHAHAHAHA!!! That is hilarious!

Thanks for the link, Doc.

[_Matt]

Makes you feel a little bit better to know that the man
at 1600 Pennsylvania Ave uses a Mac.


only a lil... :cool:

[VanMac]

Creative is said to ship 4,000 wormy MP3 players

link (http://www.macworld.com/news/2005/09/01/creative/index.php?lsrc=mcrss)
Nice.

Wonder if they will apply for a patent for that....

[MACDreaming]

I feel lucky.. My entire family switched two years back.. and except for my mental sister-n-law that nobody listens to who thinks a 100 MHz Compaq Presario on dialup was a good time, nobody misses Winblows at all.. :)


Oh god.... :eek: that is bringing flashbacks to dialing up on a 1200 baud rate modem 10 years ago... Old Tandy 8088 I think it was...

Dial in..... creeeeeehhhh ping ping more loud noises....

Leave desk.

Make pot of coffee.

Go back to desk... Click link.

Go make a sandwich.

Go back to desk... read article (no pics, no video just text)

Click link.

Balance checkbook.

yadda yadda yadda....



Mental sister-in-law is an understatement..... I don't even have my mac yet and dial-up in no way can be a good time!! I have a friend that can not get broadband access at his home so he is no longer online at home do to the frustrations.

Wiping the tears from my eyes.... :D