Mactel and Viruses

[Mechcozmo]

powerpc and x86 implement stacks slightly differently (i think in the direction they grow). however, i don't know if 32-bit implementations of powerpc have the no-execute bit. the ppc970 does. additionally, i don't know if darwin supports no-execute either in hardware or software emulation.

This is what I've read from an article and some from a book that I'll admit was over my head, but the summary of the book's chapter made it clearer.

I do know that the No-Execute Bit deals with RAM and not the stack, but does help control buffer overflows. In any case, everyone should stop worrying. It is so extremely technical that if someone manages to exploit it, Apple probably already thought of it because there are so few avenues to approach from.

The market share theory doesn't work. Mac OS X has no viruses, only Mac OS 9 and earlier.

Correct. Look at Linux/*BSD. No viruses there either and they share the same structure as OS X.

You should all be reminded that there have been at least two proof-of-concept viruses for OS X. I recall one of them was if an MP3 was double-clicked, any code contained in a resource fork in the file would be run. The trouble with that was if the file had passed through a Windows machine (or anything else that doesn't support resource forks) unmodified (archived or such), the resource fork would be stripped, and thus, no more virus. I don't think it was ever developed into anything malicious.

Of course, there are also Office macro viruses, but I've never even seen one (although I know they exist).

I remember those proof-of-concept things... but they never were exploited. And that was back in the days of 10.1...

Office Macros were implemented by the Windows Office Unit and the Macintosh Business Unit was forced to copy them over to be compatible. I see those as another reason to use TextEdit. What can an Office Macro do to really damage an OS X machine? It won't know where files are unless coded for that...

 

[jhu]

This is what I've read from an article and some from a book that I'll admit was over my head, but the summary of the book's chapter made it clearer.

I do know that the No-Execute Bit deals with RAM and not the stack, but does help control buffer overflows. In any case, everyone should stop worrying. It is so extremely technical that if someone manages to exploit it, Apple probably already thought of it because there are so few avenues to approach from.

the no-execute bit is a bit in the paging table indicating whether data in that portion of memory is executable or not. if it is set, then code residing in that portion of memory cannot be executed. because the stack is just data that resides in memory, the nx-bit would also apply to it.

as i've said before, i don't know whether darwin implements no-execute at all whereas there is full support (either via hardware or software emulation) in the other bsds and linux. even windows has support for hardware only.

this thread is rather interesting, even though it's about 2 years old

 

[wako]

Correct. Look at Linux/*BSD. No viruses there either and they share the same structure as OS X.

AND HERE IS THE OWNAGE


Now, if a virus can infiltrate Linux, dont you think it can also infiltrate OSX? Free of virus ladies? please... dont be so niave...


Also, just because you dont have to worry about viruses and such, it doesnt mean that you are hack free. Viruses is just one side of the story of security, hacking brings another ball game. No computer is safe on the net!

 

[TrenchMouth]

The market share theory doesn't work. Mac OS X has no viruses, only Mac OS 9 and earlier.

To prove that the market share theory doesn't work you pointed us to a article that relies on conjecture and the "personality" of Mac users to speculate on whether or not there would be more viruses writen for the Mac OS if it had a greater share of the home computing market?

Things like "And Mac users don’t tolerate ****." make that article less than convincing...Some guys blog doesn't "prove" anything.

I think something that often gets overlooked here is that it is not like Windows is an insecure OS.

The article you linked to suggested that it is the amount of "crapware" that makes Windows more vulnerable to security issues, and that Mac users somehow wont stand for that. If the market share increased, the people that "accepted" that software would become Mac users. It is not as though you switch over to the Mac and all of a sudden you are a different person. With more users come more dumb users. What this article implies is that Mac users are the intelligent users. Well then who are being attracting over as switchers? Joe wintel user...who loves weatherbug and and anything that says "increase your megahertz now!"

Increased user base = bigger target. I didnt think there was much more to it than that.

That Apple does have a secure opperating system, and an existing base of intelligent users means that they have a nice head start, but never underestimate some 17 year old programer with something to prove.

 

[Mechcozmo]

I read through the virus reports dealing with Linux.

Most of them dealt with pre-1.0 software.
Beta software.
If the OS X Public Beta was cracked then I'd say, 'big deal; it was a beta'
When Longhorn was first released, it was immune. Then it was made more compatible and is not able to be cracked again. However, it is still beta (or is it alpha still?) and so I think it is funny that it is cracked but will wait until the actual release to serve judgement.

Also, one of them was unwanted software but did a good thing. It was using the original concept of a worm. However, that doesn't make it 'right'.

 

[Counterfit]

I remember those proof-of-concept things... but they never were exploited. And that was back in the days of 10.1...

Actually, I think the MP3 one was during that Panther days.

can an Office Macro do to really damage an OS X machine? It won't know where files are unless coded for that...

That, I couldn't tell you. I've never seen or used a regular Office macro, never mind a macro virus.

 

[simie]

Linux is vulnerable here is proof

http://www.viruslibrary.com/virusinfo/search.htm


1. Worm.Linux.Mighty
2. Worm.Linux.Slapper
3. Exploit.Linux.SSHD22
4. Linux.Gildo
5. Linux.OSF.8759
6. Linux.Diesel
7. Linux.RST
8. Linux.Nuxbee.1403
9. Worm.Linux.Adm
10. Worm.Linux.Cheese
11. Linux.Kagob.a
12. Linux.Satyr.a
13. Worm.Linux.Ramen
14. Linux
15. Linux.Zipworm
16. Linux.Winter
17. Linux.Bliss.a
18. Linux.Vit.4096
19. Linux.Rike.1627
20. TrojanSpy.Linux.Logftp

Go to the URL address above and type in words like Mac - OS X etc and see he results. According to Linux websites they-re about 100 viruses for Linux out there.

 

[illegalprelude]

these threads always get so childish. Yes there is viresus for OSX and yes for Linux but how many does windows get? 100 a day? oh ok

 

[FadeToBlack]

I am getting sick of these types of threads.

As far as I know, there are no viruses for OS X. I'm sure we'll probably know it when it happens (if it does) as it will be all over sites like this one.

 

[Mechcozmo]

I am getting sick of these types of threads.

As far as I know, there are no viruses for OS X. I'm sure we'll probably know it when it happens (if it does) as it will be all over sites like this one.

I agree. Maybe the mods can lock this thread before it degenerates further?

 

[bousozoku]

Whatever. Instead of creating more threads for this same subject, please just do a search and read the same thing there.