Apple Admits Its Macs Have a Malware Problem
April 12, 2012 12:07 PM
comment(s) - last by
(Source: Mashuga Mom)
Flashback botnet is no fun for the infected
Apple has finally owned up to the fact that many of its users' machines have been
afflicted by crippling malware
. And it promises that it's working on a fix. But experts wonder if the company is simply acting in a reactionary fashion or is ready to finally get serious about protecting its users.
I. Trojans are Increasingly a Problem for Mac Users
In the 1990s, hackers enjoyed a virtual wild west of unpatched exploitable software. But as the new decade rolled around companies like Microsoft Corp. (
) stepped up their security. As a result it's become harder for malware to install on Windows computers without some sort of user action. Hackers have circumvented this by creating programs that trick the user into approving the installation via exploiting trust (hijacked sites, systems) or user ignorance (clicking spam email links). The approach has become tremendously successful and today Trojan-type malware are responsible for a large percentage of the Windows botnets.
Apple, Inc. (
) long avoided such woes, thanks to its small market share and specialized OS code, which precluded stock PC malware from running on a Mac. But the company's base security model is in theory no more secure, and -- perhaps driven by
rising market share
-- of late the company has grappled with
serious trojan issues
Macs are increasingly the target of Trojans. Malware writers love Apple's
sluggish pace of patching. [Image Source: Venitism]
The latest fire facing the Mac community is "Flashback", also knows as "Flashfake". This Trojan has evolved over multiple variants to its current form, which masquerades as an install Java applet on hijacked websites. Customers who approve it unwittingly run a piece of code that exploits a flaw in Oracle Corp.'s (
) Java platform in order to remove OS X's limited anti-malware capabilities and install back-door control programs.
The affected machines are turned into bots, which the attackers can use to spew spam or commit other foul acts. Kaspersky Labs' Igor Soumenkov
in an interview that at its peak, Flashback had infected 600,000 machines, including roughly 300,000 in the U.S. Approximately 98 percent of those machines were Macs.
II. Is Apple to Blame?
Apple has been under heavy fire from the security community. First, it was the company's lackadaisical approach to patching that gave Flashback the opportunity to take hold.
The majority of infections occurred after Oracle had already patched the Java vulnerability. The code would thus have failed under most Windows machines. However, Apple insists on
redistributing all third-party updates
via its own repackaging scheme. And under this system it often delivers updates at a sluggish rate, often months behind their release to the more open, more used Windows platform. As a result it's often
far behind on security patches
of third-party platforms -- something malicious hackers are increasingly realizes means open season on Macs.
Over 600,000 Mac users were infected, thanks to Apple's sluggish patching.
[Image Source: Macenstein]
Apple is quick to respond by
attacking third-party platforms
like Adobe Systems Inc.'s (
) Flash, which it
no longer installs on Macs
, in part for being too "insecure".
At the same time Apple practices a
policy of blatant hostility towards security professionals
who are trying to help it.
But a promising sign is that Apple, after delivering patches to close the Java flaws exploited by Flashback, has released a Knowledge Base post warning users that Macs are indeed afflicted by this piece of malware.
This is one of the first times the company has officially acknowledged malware issues. A
previous Trojan -- MacDefender
--was estimated to have infected as many as one in twenty Macs at its peak. While Apple
quietly battled it
with patches and tools, the company instructed technicians in a leaked memo
to lie to customers
and not inform them of infections.
III. OS X is at a Crossroads in Terms of Security
The new issues put the company's image in an awkward position, given that Apple has long promoted OS X as a platform that is largely
immune to the kinds of malware
that have long afflicted Windows machines. Of course some OS X users are savvy enough to realize the reality -- no platform, certainly no consumer platform, is ever fully secure. However, many less tech-savvy Mac users do truly believe that their machines are immune to malware. The disillusionment when they learn the truth may be a blow to Apple.
The company is preparing a tool that will detect and remove various known variants of Flashback. In the meantime its patching seems to be working -- infections have dropped to 270,000 machines, according to Symantec Corp. (
While it's clear that Flashback will be beaten back by the Cupertino company, the compelling question is whether Apple's unusual public admission to having malware is a prelude to adopting a more proactive approach: patching faster, or possibly even allowing third party patches. For now, customers can only judge the company's security stance by its track record -- a track record that speaks to a generally negligent sluggish pace of prevention interspersed with reactionary spurts of action.
Apple is at a crossroads as to whether to decide to become more responsible about security, or allow its customers to be abused. [Image Source: Letters to Jen]
Today hackers appear to be finding Macs the easiest platform to hack.
Apple computers were hacked the quickest
at recent "hack-to-own" style competitions.
With Microsoft adopting a more proactive approach and with hackers increasingly attracted to Apple's affluent customer base, if Apple sticks to its reactionary approach, customers may soon find their Macs going from being the most secure platform, to being the least secure. OS X is at a critical crossroads -- the next move is Apple's to make.
This article is over a month old, voting and posting comments is disabled
4/12/2012 6:48:20 PM
"There are three kinds of lies: lies, damned lies, and statistics." Mark twain, quoting Benjamin Disraeli.
Replace 'statistics' with your 'facts', and that about sums it up.
You see, you could use REAL facts, like Solandri does, and not be hated so much. But you prefer to be despised. So, I suggest that it is you, not Motoman that needs to see some kind of professional about some sort of trauma that someone experienced as a small child... Perhaps your mother wouldn't breast feed you?
You see, the 'facts' are: Apple DOES have a better security model than windows, natively, provided that a knowledgable 'nix user is behind the wheel. Which, as Motoman pointed out is not normally the case.
Apple has in the past outright lied about various malware 'deficiencies'. Or, any deficiencies in any of its products, actually... And that has been a top-down approach, mind you, made infamous by 'You are holding it wrong'.
Apple is notoriously slow patching issues. Too many examples to list, really.
Of late, it seems that Apple has finally realized that it is really an eight hundred pound gorilla, and everyone else is not, so now it is Apple's turn to kick sand in everyone's face that it doesn't like.
So, Tony, please. Go find a professional, get your issues sorted. I'd suggest, in my professional capacity, that you seek a nice, bosomy lass (if you are inclined that way, that is) and suck away to your heart's content. Then perhaps we'll have some peace and quiet around here.
"The Space Elevator will be built about 50 years after everyone stops laughing" -- Sir Arthur C. Clarke
Malware Authors Get Boost from Apple's Sluggish Updates, Infect 600K Macs
April 6, 2012, 8:40 AM
Developer Demonstrates Serious Security Breach in iOS, Apple Bans His Account
November 8, 2011, 9:06 AM
"Devil Robber" Trojan Infects Macs, Leeches Their GPUs for Bitcoin Profit
November 1, 2011, 10:59 AM
Analysts: Apple Now Has More Than 10 Percent of the U.S. PC Market
July 14, 2011, 1:52 PM
Apple Tries to Roll Out Trojan Protection, Only to See New Variety Pop Up
June 2, 2011, 9:00 AM
Verizon, Cogent Peer War Leads to Netflix Streaming Issues
June 19, 2013, 10:29 AM
Quick Note: Verizon May Become Canada's Fourth Major Carrier
June 18, 2013, 2:15 PM
BMI Files Lawsuit Against Pandora Over Royalty Fees, Radio Station "Stunt"
June 14, 2013, 1:28 PM
Ukranian-Led Cybertheft Ring Busted, Six East Coast Residents Arrested
June 13, 2013, 10:38 AM
Rep. Peter King (R) on NSA Leaks: Prosecute the Journalists
June 12, 2013, 4:00 PM
Comcast to Turn Customers Modems Into Quasi-Public Wi-Fi, Raises Legal Risks
June 10, 2013, 8:02 PM
Most Popular Articles
Source: Don't Worry, NSA Spies on "99 Percent" of Americans' Locations, Call Records
June 14, 2013, 3:57 PM
Report: Intel Delays 14 nm Broadwell, Schedules Haswell Refresh for 2014
June 17, 2013, 5:30 PM
NSA Leaker May be Killed in Drone Strike Says Ron Paul
June 17, 2013, 11:18 AM
Report: Apple to Release Larger iPhone Screens, Cheaper iPhone for $99
June 13, 2013, 9:41 AM
Just How Powerful is the Xbox One? Microsoft is Confused
June 18, 2013, 11:30 AM
Latest Blog Posts
Lumosity: Does it Work?
May 22, 2013, 8:20 PM
Quick Note: Sony "Teases" PS4 Ahead of Xbox Reveal in New Video
May 20, 2013, 12:33 PM
Nokia Introduces Instagram-Like App of Its Own to Help Lumia Sales
May 20, 2013, 7:10 AM
Parents of Pre-Teen Drivers Commonly Practice Distracted Driving Says Study
May 9, 2013, 7:16 AM
Apple's iOS 7 Running Into Internal Delays Due to Massive Overhaul
May 1, 2013, 4:26 PM
More Blog Posts
Copyright 2013 DailyTech LLC. -
Terms, Conditions & Privacy Information