Ars Technica Investigates the State of Malware on the Mac | Hacker News Reader

Ars Technica Investigates the State of Malware on the Mac

daringfireball.net

21 pointsshawndumas29 comments

Actually I wouldn't be surprised to find Norton on a Genius Bar Mac, mostly because an anti-virus is required for PCI compliance to handle credit cards.

Last time I bought something at an Apple Store, my credit card was swiped through an iPod Touch, not a Mac. Do you think that the iPod was running a virus scanner?

PCI requires anti-virus on "all systems commonly affected by malicious software". It is not required on every system involved in credit card handling.

To me this seems like Gruber doing damage control for Apple again.

There's no doubt that simple scams like this will increase as marketshare does, and pretending like it's not already happening is fooling nobody.

Yeah, I really don't understand Gruber's position on this. It seems fairly obvious and inarguable that as Macs become a bigger target, there will be more and worse malware on them. Is he saying that there's something inherent to Mac OS that makes malware harder? If so, what?

Gruber wrote more then once in the past about market share argument. It's been going on for years. And there were more viruses for Mac OS versions prior to OS X with even smaller market share. I think one advantage OS X always had compared to Win < 7 that users never had a habit to run with administrator rights all the time.

Sure, that's one advantage, but it doesn't seem like a decisive one, really.

I must have missed his arguments re market share. I've only ever seen him post the historically periodic articles about how people have always been saying it's about to happen. What are his actual arguments?

If anything, I feel like Mac OS X will potentially be more vulnerable. To make the anatomical analogy, Windows has always had a lot of exposure to malware, and as a result there's a fairly robust anti-malware ecosystem, like anti-bodies in an immune system. OS X, on the other hand, hasn't. It's evolved in the absence of many attacks, and has a proportionally weaker immune system.

Ok, I'm not sure I buy that completely, but the market share argument seems like a straightforward one.

Most iterations of the "market share argument" I've seen imply that at some time in the future, Mac market share will reach a tipping point and writing viruses for OS X will be lucrative enough that there will be a dramatic increase in the amount of malware being flung at Macs.

It has the same problem that plagues every other apocalyptic argument: the world keeps not ending.

Nobody ever says how much market share OS X needs to reach this tipping point, which makes it pretty hard to falsify. Meanwhile, the Mac market share keeps growing, year after year, with only minor increases in the prevalence of malware, and no major botnets or worms of the sort that were rampant on Win9x and early XP.

Claiming that OS X is (or will be) a soft target also serves to further undermine the market share argument: Windows has been getting more secure over time, which should help make OS X a more attractive target if it really is a softer target than Windows.

You're totally right, that market share argument is often vague and probably unfalsifiable, but there's at least a clear logic to it.

"It hasn't happened yet," on the other hand, is not an argument at all. An analysis charting data of total malware vs. market share would be more interesting, but an argument for why it hasn't happened yet, and will continue not to would be the most interesting to me.

I'm not sure I follow your last point.

I don't know that the "market share" argument is unfalsifyable. The Witty Worm of 2004 (http://en.wikipedia.org/wiki/Witty_(computer_worm)) attacked a particular vendor's firewall implementation. It seems to have infected every one of the 12,000 members of the susceptible population. That's a pretty small market share, even in the firewall market, even in 2004.

The Witty Worm seems like a good counter-example of the "market share" argument.

As for full disclosure, I personally regard the "market share" argument as a form of the Special Pleading logical fallacy.

The Witty Worm could be explained by those firewalls being considered far more valuable or vulnerable targets than desktop PCs. The market share argument typically assumes that those factors are roughly the same for Macs and Windows machines, and that the only significant difference (or at least, the dominant factor) is the size of the target population.

The market share argument implicitly rejects the idea that OS X is significantly more secure than Windows, by saying that when OS X gets more popular, the amount of malware for OS X will catch up and be more comparable to the amount of Windows malware. It postulates that there must be some threshold level of market share that Macs must exceed before this happens.

The current fact that Mac malware is still rare puts a lower bound on that threshold. Whatever that number is, it is larger than the current Mac market share. It is also safe to assume that 50% is an upper bound on that threshold.

If you assume that OS X is not only as insecure as Windows, but significantly less secure than Windows, then the threshold should be lower, because fewer Macs should be needed to reach the same level of successful attacks. If an attack on Windows is twice as hard as an attack on OS X, then OS X should only need 33% market share in order to reach malware-volume parity.

Every advance in Windows security that is not matched by Apple, and every increase in Mac market share, narrows the conditions under which the market share argument can be considered true, and narrows the range of predictions that can be made in accordance with that theory.

While there is not enough evidence to totally reject the market share argument, we do not have the crucial evidence necessary to prove it true, and all the evidence that has been accumulating over the past decade counts against it.

I agree that nothing about the market share argument has been proven, true or false. The evidence only shows that the market share argument is false or that we simply haven't reached the threshold yet.

But:

"The market share argument implicitly rejects the idea that OS X is significantly more secure than Windows..."

This is the idea I'm curious about. Perhaps there are arguments that make the case that OS X is signicantly (and inherently) more secure than Windows that I've missed, and if that's the case, I'd appreciate someone directing me at them.

If the market share argument is false, which I grant that it very well could be, I'm interested in the reasons that might be so. Inherent security of OS X could be one reason. Another could be something specific to do with malware that I don't know or understand because I'm not that familiar with the subject.

I'm saying I understand the market share argument, and it seems straightforward and logical. I have not seen a counter-argument, but if there is one, I'd like to see it. Gruber does not produce a counter-argument. I'm not asking for evidence either way, because I don't think there is any yet. I'm asking for an argument.

I'm not saying the market share argument is illogical. I'm saying it's not likely to be true. The extent to which that can be proven is limited by the lack of specific predictions to be falsified. At the moment, all I can say is that a significant fraction of the predictions that could have been made a decade ago have been falsified.

For example, the Mac malware explosion has not happened yet, and Mac market share is around 10%, so we can conclude that Macs aren't 10 times easier to attack than Windows targets. If Mac market share is more like 15%, then Macs can't be much more than 5 times easier to attack.

As far as predicting the market share at which Macs get malware, Adam J O'Donnell seems to have given a 5 to 10% of the Internet population estimate in this presentation: http://projects.csail.mit.edu/spamconf/SC2008/Odonnell_gamet..., with a more cautious paper here: http://www.securitymetrics.org/content/attach/Metricon3.0/j3...

That presentation dates from 2008, it looks like, and O'Donnell gives both Mac and Linux a 4% market share at the time, which seems a little suspicious in that almost everyone else gives Linux just barely 1% even now.

>Mac market share will reach a tipping point and writing viruses for OS X will be lucrative

Playing with the $59.99 "price" of Mac Defender it's probably only taken a dozen or so purchases to get a return on the design/HTML/CSS, the Cocoa, and hosting, etc. general development time required to put this together.

Depending on the numbers (un)reported - it's not hard to imagine:

   a) Mac Defender is already profitable
   b) it could become very profitable
   c) other malcontents will likely recognize this...

So I think it reasonable to speculate the OS X malware inflection point is now.

One successful product does not necessarily lead to a thriving market. The authors of Mac Defender have probably made a good return on their investment, but what counts in the long term is whether their customers have, in the form of stolen credit card numbers or botnet membership or whatever.

If Mac Defender and it's forthcoming copycats aren't very effective tools, then we probably won't see an explosion. There will be some short-term growth, but Mac malware would quickly become a low-level endemic problem, instead of the multi-year epidemic that would be necessary for OS X to get to the state Windows is in.

Mac Defender may mark the start of the arms race between malware authors and Apple, but I don't think there's any evidence yet to suggest that the arms race would proceed as quickly or as embarrassingly as it did for Windows.

Profitable doesn't mean that it's more profitable then if the developer had written windows malware.

Afghani farmers can make a profit with saffron but they keep planting poppies because they make a bigger profit.

"What are his actual arguments?"

Here's one: http://daringfireball.net/2004/06/broken_windows Mac community has no tolerance.

Here's another: http://daringfireball.net/2006/11/jackass_larry_seltzer Fundamentally more secure.

Overall I just think he has more confidence in Apple's drive to deliver ease of use consumer experiences. As he recently recently hinted: "So, for the sake of argument, let’s take it as a given that this sort of thing is becoming more common. What can Apple do? Think about it. (My guess: think about why the iPhone and iPad, despite being far more popular than the Mac, have no trojan horses.)" Obviously he's thinking that Apple could, if security becomes an issue, offer clueless users a mode where app execution is limited to signed Mac App Store installs or something.

Thanks, that's what I was looking for. I guess I haven't really been following Gruber long enough to have been exposed to those arguments, and he doesn't really seem to have linked back to them (they are pretty old).

That said, I'm not sure I follow his arguments.

The first one seems to be that the Mac community is less tolerant of malware/crapware. But as the market expands, especially to former Windows users, doesn't this become less true by definition? It's an explanation for why there hasn't been much malware on Macs, but not really one for why there couldn't or won't be.

The second was isn't an argument so much as an assertion. Though this might be a case again of me not being familiar enough with his writing historically and his audience. Maybe he's speaking from the assumption that his audience understands technical details about Mac OS architecture/design that makes this true?

You're right, though, it does indeed seem like Mac App Store exclusivity is where Apple is headed. And that does seem likely to make the OS fundamentally more secure than others, mostly reducing potential exploits to third party app/web.

I think historically it WAS more secure. See Pogue's write up from 2003: http://www.nytimes.com/2003/09/18/technology/circuits/18POGU...

As time has gone on MS has made strides in the default shipping copies of Windows. SP3, Vista, WP7. I'm not sure if they're better the same or worse today compared to OSX (or linux) but I'd agree historically Windows was a total mess -- we'd have entire days of downtime to viruses as they took over the company. haven't seen one of those in years though.

Is he saying that there's something inherent to Mac OS that makes malware harder?

No, he's saying that everytime there is a virus/trojan/rootkit/malware found in the wild that targets MacOS X there is a chorus of articles in the tech media essentially proclaiming that the end is nigh for safe computing on the Mac.

There is malware/etc that targets Macs. There will always be malware that targets Mac. I doubt Gruber doesn't believe this. However the existence of particular piece of malicious software is not the same as a widespread practice that will bring down the platform as is seemingly presumed by the various tech articles that talk about Mac malware.

I agree that one instance of malware doesn't necessarily mean anything, but growing market share does. And what the ars article points out that's really pernicious is Apple's response to the issue, which is not a good sign for how they might deal with the growth of malware as a reaction to growing market share. Especially in light of Apple's marketing re security of Mac OS.

And Gruber doesn't seem to be making an argument in this post. He agrees with the reporting but quibbles with a tertiary, almost irrelevant graph.

Original source: http://arstechnica.com/apple/news/2011/05/malware-on-the-mac...

From the Hacker News Guidelines[1]: "Please submit the original source. If a blog post reports on something they found on another site, submit the latter."

The fact Mac OS X is a security pushover is pretty well known[2]. I wouldn't be surprised if more macs weren't rooted with something much stealthier than Mac Defender. Disclaimer: I use a mac.

[1] http://ycombinator.com/newsguidelines.html

[2] http://www.washingtonpost.com/blogs/faster-forward/post/ie-s...

The fact Mac OS X is a security pushover is pretty well known[2].

That raises the question then, why aren't we seeing more Mac viruses and malware? Is it purely a question of economics that market share answers? Is it because there's more technical "know-how" and experience floating around about Windows vulnerabilities? Is it because it is easier to profit off of Windows vulns? These are genuine questions to which I'd love to hear some answers.

Edit: The fact that OS X Lion was shared with security researchers in advance[1] is a good move on Apple's part. Does Microsoft do similar things?

[1]http://news.cnet.com/8301-1009_3-20036218-83.html

This link included information that the other didn't.

Your second link does not support what you are citing it for.

I assume Gruber is talking about engineers in Cupertino never using Norton, while Ars is talking to Genius Bar employees. It is that far fetched to assume Apple trusts the former more than the latter?

Perhaps "Slipping a Norton" will become the new mickey.

Reply on news.ycombinator.com