In the final screenshot, I wonder how Sophos think that the unsophisticated user is supposed to figure out which of the two scare boxes claiming to have detected malware is lying, and which is telling the truth?
Mac malware evolves to no longer require users to enter their password
21–30 of 49 posts
Re: Mac malware evolves to no longer require users to enter their password
#22from http://www.macworld.com/article/160098/2011/05/macdefender.h... "Windows 7 is actually more secure than OS X, but the gap narrows every year. And there simply isn’t the same attack ecosystem for Macs, nor are we likely to see one develop. So while Mac users will likely see more malware, it’s highly improbable we (or Windows 7 users) will ever experience what those who are still running Windows XP battle today. B…
How is windows 7 more secure? I can install a malicious app if I want to on any system. The only "problem" here is that safari automatically opens safe files. They should also get a smartscreen filter like IE9 has. Safari has something like this already (google safefilter) but it doesn't seem to be as effective. Mac OS X as a whole has xprotect, but that is a very simplistic defense to look for some known malware sig…
I'm no security expert, but I do try to keep up. Someone please correct me if my facts are off. Ahem:
Windows 7 does a lot more randomization of memory layout than Mac OS X does, making it more difficult to exploit executables and libraries shipped with the system. It's actually easier to exploit a Mac OS X machine than it is a Windows 7 machine -- see the results of pretty much every Pwn2Own [1] contest.
That said, the vast majority of spyware is targeted at Windows and doesn't need low-level exploits to do its job. It's the difference between safety and security; you're probably more safe on a Mac, even though they're technically less secure.
Re: Mac malware evolves to no longer require users to enter their password
#23Does anyone know how this malware gets past the com.apple.quarantine attribute? That is a little concerning, though in general this is just your standard trojan attack.
Re: Mac malware evolves to no longer require users to enter their password
#24Earlier quoted context omitted.
How is windows 7 more secure? I can install a malicious app if I want to on any system. The only "problem" here is that safari automatically opens safe files. They should also get a smartscreen filter like IE9 has. Safari has something like this already (google safefilter) but it doesn't seem to be as effective. Mac OS X as a whole has xprotect, but that is a very simplistic defense to look for some known malware sig…
Security experts generally agree that there are more exploits on Mac. It's easier to run arbitrary code without permission. The only thing is, nobody has bothered to write that code yet.
One question that is worth asking is how many of these exploits can be done remotely, and how many of these exploits require physical permission to a system?
It is worth noting that there is a difference between exploits that require physical access and those that can be conducted remotely.
Speaking just for myself, I am not certain which operating system is more or less secure, but I do not think that operating system security matters as much as user habits. I have ran Windows XP since 2001 and I have never once suffered from malware or a virus (except when I transferred a USB-stick virus onto one of my computers just to see what would happen). I know that the plural of anecdote is not data, but it is worth noting that it can and has been done.
Re: Mac malware evolves to no longer require users to enter their password
#25Earlier quoted context omitted.
How is windows 7 more secure? I can install a malicious app if I want to on any system. The only "problem" here is that safari automatically opens safe files. They should also get a smartscreen filter like IE9 has. Safari has something like this already (google safefilter) but it doesn't seem to be as effective. Mac OS X as a whole has xprotect, but that is a very simplistic defense to look for some known malware sig…
I'm no security expert, but I do try to keep up. Someone please correct me if my facts are off. Ahem : Windows 7 does a lot more randomization of memory layout than Mac OS X does, making it more difficult to exploit executables and libraries shipped with the system. It's actually easier to exploit a Mac OS X machine than it is a Windows 7 machine -- see the results of pretty much every Pwn2Own [1] contest. That said,…
True, but it is my understanding that the randomization will finally be addressed in Lion (Address Space Layout Randomization)
http://www.appleinsider.com/articles/11/02/25/apple_exposing...
Re: Mac malware evolves to no longer require users to enter their password
#26Does anyone know how this malware gets past the com.apple.quarantine attribute? That is a little concerning, though in general this is just your standard trojan attack.
Are you talking about the dialog warning you about opening software from the web?
Might it be because the zip file is extracted automatically? (open safe files in safari)
Or is an installer not considered an application is apple's eyes?
Edit: well, i just checked without open safe files (I just found it today on a google image search, google plays a big part in the distribution of this). And there still is no warning when opening the zip. I assume once extracted it doesn't know it was downloaded from the web. Is it that easy to circumvent?
Re: Mac malware evolves to no longer require users to enter their password
#27Someone who knows how OSX works - how is the malware getting execute permissions?
It's not. For whatever reason, OS X installer pkg files are deemed 'safe files' by safari, which has an option to open such "safe" files automatically. So the thing that actually launches is a standard Installer.app from apple, but running a pkg script provided by the 'bad guys'. Fortunately Installer.app requires user interaction before it does anything, but it's still disconcerting.
Re: Mac malware evolves to no longer require users to enter their password
#28In other words: it still falls into the "you have to be stupid enough to allow total strangers behind the wheel of your car" category, they just don't need you to hand over the keys anymore. Got it. Stupidity is not a problem that can be solved through technology. At least Apple now has a service to protect stupid people against themselves, it's called the "App Store". You know, with the kind of approval system we've…
> Stupidity is not a problem that can be solved through technology.
Wait a couple decades. Kurzweil may be on to something ;-)
Re: Mac malware evolves to no longer require users to enter their password
#29* Requires user interaction, so it doesn't count. * Doesn't work if you aren't an admin. * The OS is just installing what the user agreed to install. Seems like Mac users are regurgitating Windows users' excuses from years ago. It's a problem. Rather than make excuses, we should be expecting Apple and others to be actively working toward a solution.
So, you expect the operating system do disobey the user when it determines the user actions could be harmful?
If I tell my machine to do something, I want it to carry my orders.
Re: Mac malware evolves to no longer require users to enter their password
#30* Requires user interaction, so it doesn't count. * Doesn't work if you aren't an admin. * The OS is just installing what the user agreed to install. Seems like Mac users are regurgitating Windows users' excuses from years ago. It's a problem. Rather than make excuses, we should be expecting Apple and others to be actively working toward a solution.
If I trick a GNU/Linux or UNIX user into running a "sudo rm -rf /" command and entering a password, did I create malware?