Can a MAC be hacked? How do I know if it happens? Security advise welcome.

[simsaladimbamba]

I wouldn't take security advice from anyone who thinks "virii" is a word.

HOGWASH follows:

"Virii" is the proper LATIN plural for "virus", but it is not used to describe computer viruses. It can be used to describe other virii though, like those biological ones, swirling around in those gooey genomes.

HOGWASH ends.

 

[ZilogZ80]

"Virii" is the proper LATIN plural for "virus", but it is not used to describe computer viruses.

It really isn't.

 

[simsaladimbamba]

It really isn't.

You are correct, I thought virus would be masculine, due to the "-us", but is is actually neuter, thefore it could be "vira", but as "-us" is a very rare ending for a neuter word, no exact Latin plural for virus is known.

I learnt something new today. Thanks for making me look.

 

[ZilogZ80]

I learnt something new today. Thanks for making me look.

No problem

 

[altecXP]

Let's count all the false statements in this post:

False. They don't get viruses, either. Because there ARE no viruses that run on current Mac OS X.

Really so you are relying on the fact there currently are not any to prove that it can't get them? That's poor logic.

"Panda points to the numbers. There are now 5,000 ‘strains’ of malware that target the Mac and the company says it is seeing 500 new Mac-specific samples appearing every month.

In 2009, 34 vulnerabilities were detected in Apple’s OS X, which had risen to 175 so far for 2010, with a 20-year total of 170,000 macros ‘viruses’ affecting the platform."

The market share myth is exactly that. Macs have a much greater market share than ever before, and growing at over a million Macs per month, yet the number of viruses has gone from a few back in the days of OS 8 and 9, to...... zero. Market share grew, viruses available went down. So much for the market share theory.

That does NOT prove the market share myth wrong. So you are saying that if OS X had 50% the market it would still not be a target? You are kidding yourself. NO one CARES to take the time to make a Mac virus.

False. If that were the case, there would be no firewall or built-in malware protection in Mac OS X, which there is.

To bad that Firewall is OFF by default, and most users will never turn it on.

No, you can't. It IS possible to hack into a Mac, and you have absolutely no basis on which to guarantee that any particular user has or hasn't been hacked.

No I can't guarantee it. I should not have used that word, but most users that "think" they have been hacked really just don't know that they installed a trojan themselves. The simple fact that the user is asking this question means they are not very tech savy and in order for them to be "hacked" they would have to be targeted. I dont count the user clicking a malformed link or installing shoddy software a "hack" I blame that on the user.

 

[altecXP]

You are correct, I thought virus would be masculine, due to the "-us", but is is actually neuter, thefore it could be "vira", but as "-us" is a very rare ending for a neuter word, no exact Latin plural for virus is known.

I learnt something new today. Thanks for making me look.

Thanks for the info.

 

[Eddyisgreat]

That does NOT prove the market share myth wrong. So you are saying that if OS X had 50% the market it would still not be a target? You are kidding yourself. NO one CARES to take the time to make a Mac virus.

Yeah it does. Did you read what was said? The Mac OS has ALWAYS been a target.

The number of viruses/threats that were written for it (not OS X mind you) was HIGHER when the market share was LOWER.

Oh..why bother. I feel like i've had this discussion before.

Taken from another thread:

the number of people actively trying to hack OSX is minisucule compared to the
size of the windows hacking community.
In almost direct relation to the size of their respective user bases (and marketshare), oddly enough.
Increase the user base and the viruses will come.

Yeah, ok.

Makes sense right? Mac OS as a platform has never been targeted due to it's marketshare.

Oh wait a minute.....
........it has!

1988 - Scores ; Market Share is around 6%
1987 - 1991 - nVIR ; Market Share around 4% - 7%
1994 - Virus.MacOS.Init29 ; Market Share around 11%.

Fast forward to the present and we have a bunch of trojans and other user installed goodies. The marketshare of 2001 -> is only 1-2% lower than the early years when Mac OS had not only low marketshare but low overall numbers as well, and threats for Mac OS continued even after the PC market was experiencing substantial growth.

So the number of worms in the wild slowed down substantially because....they lost 1-2% (but the number of macs overall increased)?

Ok.

 

[416049]

To bad that Firewall is OFF by default, and most users will never turn it on.

There is a second firewall built into Unix so the second firewall that you can turn on is for the super paranoid only. It is not required however it only slightly increases your chances of getting attacked in some way

Unix firewall source:

http://itservices.uchicago.edu/services/safecomputing/firewalls/unix/

 

[nefan65]

Any system can be hacked. It's a matter of smart computing, keeping your system up to date, and use the built in firewall. If you're on home wireless, then lock it down. There's a ton of "Best Practices" out there, so take a look at those.

As for the "Market Share" thing; bogus. I used to believe it, but after reading and researching, it's just that...a myth. Face it, it's easier to propagate a Windows based system, than that of a "Nix" based system. There may be a lot of Windows systems out there, especially on the desktop. However, what are most web sites running? Apache, and "Nix" OS's. Granted, different security, etc...

My 2 cents

 

[nefan65]

While Macs can get viruses (the proper plural for computer viruses), they won't affect Mac OS X, as there haven't been any in the last decade that can affect Mac OS X, as those viruses have been written for Windows.


Btw, the marketshare argument is not really true: http://seekingalpha.com/article/52722-the-mac-os-x-malware-myth-continues

Did you know, that Mac OS 8 and 9 had viruses that could affect it? And all while the marketshare was lower than today. Strange, isn't it?

I dunno about that article. OS X is based on BSD Unix, not Linux. So it doesn't have a Linux heritage...it has a Unix heritage...

 

[simsaladimbamba]

I dunno about that article. OS X is based on BSD Unix, not Linux. So it doesn't have a Linux heritage...it has a Unix heritage...

I haven't confused Linux with UNIX, and neither has the author of the article.

By Carl Howe

Continuing a non-story that will never die, Wired Magazine has an article about the threat of Mac OS X malware, in which I was quoted. I spoke with the author, Ryan Singel, by phone yesterday, and disputed the premise that Apple's (AAPL) market share grows, it will be subject to the same degree of malware that Windows is. Unfortunately, something got lost in the translation. Here's the quote:

But Carl Howe, an Apple analyst at Blackfriars Communications, disputes the security researchers' theories. He thinks that OS X's Linux heritage makes Apple systems less vulnerable to attack than Windows-based platforms. He argues that even if hacking Macs hasn't been profitable in the past, attackers would have done it anyway if they'd been able -- just for the attention.

"I think the market-share thing has always been a myth," Howe said. "It's a good story to talk about."

What I actually said was Mac OS X's Unix heritage, not Linux. I wrote Ryan about the mistake, and he corrected it. But I just wanted my readers to know I don't have my *nix's mixed up if they saw the earlier version.

 

[Tikkabhuna]

I figured it would be limited. I wouldn't worry about it impacting wear leveling though...the SF2k is supposed to take it up even a notch. So then their 'security' does nothing for online theft I presume?

Ah, I was told about the wear levelling thing when I got my OCZ Vertex 2E. Due to when its encrypted it fills the entire drive with data the drive doesn't know where it should best place new data. I would assume that because SF2k has AES built in it would then know how to do it.

With the security thing, when a "hacker" tries to get it they would be telling the CPU to get X data and send it to Y. Just like how if you had your drive encrypted you wouldn't notice any difference except you have to type in a password to start up. This stuffs mainly for people with sensitive data on their laptop so if they left it on a train it would be useless to anyone who found it.

 

[nefan65]

I haven't confused Linux with UNIX, and neither has the author of the article.

Then he's wrong...because it's not based on Linux...

From several sources:

Mac OS X is based upon the Mach kernel. Certain parts from FreeBSD's and NetBSD's implementation of Unix...

 

[simsaladimbamba]

Then he's wrong...because it's not based on Linux...

From several sources:

Mac OS X is based upon the Mach kernel.[12] Certain parts from FreeBSD's and NetBSD's implementation of Unix...

I am really not following. Hasn't Carl Howe stated that he means UNIX, or is the quoted part I bolded somehow scrambled?

Carl Howe:

What I actually said was Mac OS X's Unix heritage, not Linux.

Misquote:

He thinks that OS X's Linux heritage makes Apple systems less vulnerable to attack than Windows-based platforms.

Correction by Carl Howe:

What I actually said was Mac OS X's Unix heritage, not Linux. I wrote Ryan about the mistake, and he corrected it. But I just wanted my readers to know I don't have my *nix's mixed up if they saw the earlier version.

Or am I overlooking something?

 

[gnasher729]

HOGWASH follows:

"Virii" is the proper LATIN plural for "virus", but it is not used to describe computer viruses. It can be used to describe other virii though, like those biological ones, swirling around in those gooey genomes.

HOGWASH ends.

No. The latin plural of virus would be viri. "virii" would be the plural of "virius".

 

[simsaladimbamba]

No. The latin plural of virus would be viri. "virii" would be the plural of "virius".

"Viri" is the plural of "vir", but it could be if "virus" would be using a normal declension.

But I don't know where I came up with "virii", must have ben some old myth I read somewhere. I think it was in the late nineties when I came upon some hacker message boards, and it somehow must have stuck.

 

[nefan65]

I am really not following. Hasn't Carl Howe stated that he means UNIX, or is the quoted part I bolded somehow scrambled?

Carl Howe:


Misquote:


Correction by Carl Howe:

Or am I overlooking something?

I only saw the un-edited source, not the corrected. Sorry if I missed something...?

 

[simsaladimbamba]

I only saw the un-edited source, not the corrected. Sorry if I missed something...?

I don't know? The article I linked definitely stated UNIX as part of the Mac OS X gene pool, even though if Carl Howe had to correct someone he has been quoted by, misquoted though, as the quoter quoted "Linux" instead of UNIX.
Anyway, I thought the article I linked to was mentioning UNIX as one reason why Mac OS X is harder to penetrate.

In the end, it really doesn't interest the John and Jane Does anyway, as long as there is finally a virus for Mac OS X. The day will come, especially with the market share rising. Or something completely different. Who knows? The ex-parrot maybe.

 

[el-John-o]

I simply cannot believe the security in obscurity myth. I could understand less malware due to obscurity, and granted there are some, but no Viruses (or Virii ), in the wild in 10 years? What "virus writer" of old (not the money grubbing kind, the computer breaking kind, they are still out there), would not want to answer that challenge? I mean come on, I'm not a hacker or virus author, but I can imagine that's got to be the holy grail right? Create wide spread panic, damaging the most expensive computers on the market, corrupting data on what was thought to be a "secure" platform?

I dunno, doesn't sit right. I have to believe the Mach kernel is quite secure. Nothing is flawless, after all, Alcatraz was broken out of. But it held a whole lot more in than it let out, and the people who broke out were considered geniuses of their time, I'd call that secure.

-John

 

[GGJstudios]

Really so you are relying on the fact there currently are not any to prove that it can't get them? That's poor logic.

No, it's poor reading comprehension on your part. I didn't say "it can't get them" and I've never said that:

Yes macs ... get virii.

False. They don't get viruses, either. Because there ARE no viruses that run on current Mac OS X.

"Can't" and "don't" have completely different meanings. You can look it up, if you like.

"Panda points to the numbers. There are now 5,000 ‘strains’ of malware that target the Mac and the company says it is seeing 500 new Mac-specific samples appearing every month.

In 2009, 34 vulnerabilities were detected in Apple’s OS X, which had risen to 175 so far for 2010, with a 20-year total of 170,000 macros ‘viruses’ affecting the platform."

That's complete BS. Who is Panda and where did they come up with this tripe? There have never been that many strains of Mac malware in all of Mac OS's history.

That does NOT prove the market share myth wrong. So you are saying that if OS X had 50% the market it would still not be a target?

No, I'm saying that if the market share theory was based in fact, and Mac OS X had 5% of the market and had "X" number of viruses, then if Mac OS X doubles its market share to 10%, the number of viruses should also increase, even if not exactly proportionately. The fact is, Mac OS X market share has increased, but the number of virus threats has decreased... to zero. Market share theorists keep saying "if Mac had more market share ....". Well, guess what? It DOES have more market share than it did. And still, no virus threats out there. So, what's the magic market share percentage when these viruses are supposed to appear? 12%? 25%? 51%? 82?

To bad that Firewall is OFF by default, and most users will never turn it on.

There you go again, making an assumption. How do you know most users never turn it on? Did you ask them all? Plus, you are ignoring the fact that your original argument is false:

Mac's rely in obscurity for their security

False. If that were the case, there would be no firewall or built-in malware protection in Mac OS X, which there is.

And you are ignoring my statement that if that were the case, there would be no firewall (on or off). You also ignored the rest of my statement concerning built-in malware protection in Mac OS X. The fact is, Macs do NOT rely on "obscurity" for their security.

 

[munkery]

In 2009, 34 vulnerabilities were detected in Apple’s OS X, which had risen to 175 so far for 2010.

Most vulnerabilities in Mac OS X are found in third party components included by default such as Flash, Java, multimedia codecs, PDF support, and more. Most of those vulnerabilities exist in other OSes once those third party components are installed.

Not all vulnerabilities are exploitable and Mac OS X has very few privilege escalation vulnerabilities. Privilege escalation exploits are required for successful malware install without password authentication. There has not been any malware on Mac OS X that achieves privilege escalation without password authentication.

To bad that Firewall is OFF by default, and most users will never turn it on.

In terms of the common understanding of a firewall, Mac OS X is not running any firewall by default. But, firewalling constitutes more than just an application firewall or a packet filter.

The Unix DAC model insulates different levels of the system by controlling access based on users and groups. This is supplemented by Unix permissions and access control lists.

Sandboxing also constitutes a form of firewalling. Sandboxing in Mac OS X is an implementation of the TrustedBSD MAC model. This is used to sandbox mandatorily exposed services, such as mdnsresponder. Often this type of sandboxing, when used to supplement Unix DAC, is labelled as an application firewall; for example, AppArmour (found in some Linux OSes) is referred to as an application firewall (also by default only used for mandatorily exposed services).

Given the sandboxing of mandatorily exposed services combined with other remotely accessible services being turned off, Mac OS X is firewalled by default even though it does not ship with the conventional application firewall turned on. If you do not turn on any of the services found in the "Sharing" pane of System Preferences, there is really no need to turn on the Firewall except for peace of mind.

Also, application firewalls, such as the one found in the "Security" pane, typically only understand the protocols for sharing services (VNC, FTP, SSH, etc) if used on the standard port for the service and provide only basic filtering for non-standard protocols or services using non-standard ports.

Stateful firewalls are better in general as provide the benefits of both packet filters and application firewalls. IPFW, the packet filter in Mac OS X, can be set up as a stateful firewall. The easiest way to do so is to download an IPFW GUI, called Noobproof, and set it to run in "supernoob mode."

Mac OS X has three types of firewalling. The application firewall is turned off by default. The packet filter, IPFW, is running but with the most open ruleset. The TrustedBSD MAC framework is enabled by default.

 

[mikeo007]

That's complete BS. Who is Panda and where did they come up with this tripe? There have never been that many strains of Mac malware in all of Mac OS's history.

Panda is a fairly reputable computer security company. The article that this person is referring to is probably this one: http://www.pcworld.com/businesscenter/article/208333/does_mac_os_x_need_malware_protection.html

Keep in mind, they're talking about malware, not virus infections, exploits or the like. I would assume they lump in all forms of unwanted programs, as the definition of malware includes non-infections software.

Not getting into the debate, just offering some more evidence to discuss

 

[munkery]

Not getting into the debate, just offering some more evidence to discuss

This quote sums up the issues with that article.

It is also worth mentioning that many attacks these days are socially engineered and platform agnostic. Phishing scams prey on naïve trust and don't care what OS you use.

Socially engineered = Trojan = require authentication to achieve privilege escalation unless running with superuser privileges (Running with chronic superuser privileges is root in OS X, Admin with UAC turned off in Vista/7, Admin in Windows XP). Trojans are easily avoided with a little bit of user knowledge. There are currently only 4 Trojans that can infect OS X and 3 out of these 4 are detected by XProtect included by default in Snow Leopard.

Platform agnostic = an exploit for Flash in the wild may work in all OSes but it is only a part of the whole malware which has a payload that is platform dependent. Privilege escalation exploit payloads have not been seen in the wild in OS X and the default account in OS X prompts for authentication; therefore, these platform agnostic exploits are only parts of whole malware that do not target OS X or are easily avoided because require authentication (Trojan).

Phishing scams = also easily avoided with a little bit of user knowledge. These in no way constitute any form of malware and explain why the number of malware presented in this article is inflated.

 

[GGJstudios]

This quote sums up the issues with that article....

It is also worth mentioning that many attacks these days are socially engineered and platform agnostic. Phishing scams prey on naïve trust and don't care what OS you use.

These in no way constitute any form of malware and explain why the number of malware presented in this article is inflated.

Well said, munkery! In addition, this quote explains the hyper-inflated and distorted numbers they present:

That is why Panda Security is launching Panda Antivirus for Macintosh.... The cost is $49.95 for a one-year license...

How typical of these software companies to distort and misrepresent facts, so they can justify the need for the software they sell. Well, I've got news for you: There is no anti-virus or security app that can protect any computer from the biggest threat of all: the user!

AV can't be guaranteed to protect against phishing scams or trojans or anything else that the user actively does to compromise their computer, whether it be Mac OS X or Windows or Linux, etc. If a user wants to install a trojan, they can. They can simply turn off any AV they might have before installing the malware. The same user can be protected with some common sense and awareness, without the use of any company's anti-virus app.

 

[mikeo007]

...There is no anti-virus or security app that can protect any computer from the biggest threat of all: the user!

Interesting, isn't it? I partially blame the big AV companies for this public ignorance, but sometimes people just do the dumbest things over and over again. I used to work for a major computer retailer doing advanced tech support (basically bind malware troubleshooting) and the ignorance of people was shocking. They actually shut down my division because they "guaranteed" that we would fix the problem. Well we did fix it, and the better agents educated the customers on what caused the issue, but here was about a 90% callback rate because they just went and clicked the same link again or downloaded the same file.

Maybe there should be a required IQ test to purchase a computer?