SiliconAddict said:
OK I know that we aren't suppose to do direct insults but my GOD people are stupid. Talking crap about what they don't know. A virus that runs on Windows is going to try to exploit a windows vulnerability or path which on a Mac WILL NOT WORK. How f-ing hard is this to understand?
😡 And the idea that the exploit is replicated in WINE is F-ing retarded. Its the OS! Its the OS. Its the OS. Its the OS that is where the vulnerability is not the freaking baseline API. Please people for the love of god go to
http://www.symantec.com/avcenter/global/index.html and READ what 90% of the virues on Windows DOES!!
*starts foaming at the mouth and bangs his head into his keyboard*
ser4rvwervqw2werwwer4r rrwewerwe34$
Example:
99.5% of the above won't even work on a Mac and that .5% (Like listening to ports) is handled differently on the Mac then on Windows. Hell I wouldn't be at all surprised if the virus outright exploded as it is trying to do the above. What happens when it can't copy itself or can't edit a registry or can't etc.
Yeah, as I said, none of this stuff works if you don't have the Windows APIs. But then, of course, if you're running WINE, you DO have the Windows APIs, even if they are a different implementation of those APIs. All of a sudden, your computer is capable of responding to most of this stuff.
And, seeing as you believe yourself an expert on these matters, I'd like to ask what you do for a living. Personally, I reverse-engineer viruses and DRM-exploit hacks for a living, and you? Somehow, I think I may just have a slightly better grasp of what it would take than you.
Want an example of what it would take to create a virus for both Mac and PC? OK, here goes:
*Take a multi-platform application with a security flaw - an example we had recently was a graphics renderer.
*Construct a file/image that creates a buffer overflow in the common app.
*Write the windows virus that exploits the flaw, including all of the usual calls to APIs etc
*Replace the calls to Windows APIs by calls to Mac equivalent APIs
*convert the byte code from IA32 to PPC
*change resources such as directory paths, filenames etc
Now, the problem is that the two versions are effectively two completely different viruses exploiting the same securiy flaw. But, if you are running an Intel Mac, the bytecode doesn't need to be replaced. Better still, the first bit of code can be used to detect what sort of computer the virus is running on, knowing if it needs to launch the Mac or the PC version
And if you are running WINE on your Intel Mac, you don't need to remap the APIs either, so the two versions just need to change their resources. In case you've missed the point, all of those Registry operations are carried out through Windows API calls (well, most of them - sometimes viruses can hook undocumented APIs)
It's still hard, and it still demands a pretty decent knowledge of BOTH pltforms, something most people don't have, but it is possible. The Mac does of course throw in some extra protection through correctly configuring security on it's Macs, "out-of-the-box", but this can be defeated once you get code onto the system.
My whole point is that the more your system resembles a PC, the easier it gets to write a multi-platform virus. That's all. We've gone from having two systems using different bytecode, different APIs, different system configs, to systems which - if you run WINE - are starting to be quite similar.
Now, if you want to make yourself a goose by disagreeing with this self-evident fact, go right ahead...
