Comments on: Snow Leopard and Malware http://www.eset.com/blog/2009/08/27/snow-leopard-and-malware Fri, 12 Mar 2010 00:43:45 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: David Harley http://www.eset.com/blog/2009/08/27/snow-leopard-and-malware/comment-page-1#comment-62770 David Harley Thu, 03 Sep 2009 12:01:19 +0000 http://www.eset.com/threat-center/blog/?p=1580#comment-62770 Interesting points. As it would be a pity if they got lost in an exchange of comments, I've answered them today in a separate blog at http://www.eset.com/threat-center/blog/2009/09/03/mac-malware-again. Interesting points. As it would be a pity if they got lost in an exchange of comments, I’ve answered them today in a separate blog at http://www.eset.com/threat-center/blog/2009/09/03/mac-malware-again.

]]> By: Adam http://www.eset.com/blog/2009/08/27/snow-leopard-and-malware/comment-page-1#comment-62313 Adam Mon, 31 Aug 2009 07:11:05 +0000 http://www.eset.com/threat-center/blog/?p=1580#comment-62313 "Currently, the only way to get malware onto Macs is to persuade the user to install it." That's probably true. If you know of Mac malware found in the wild that doesn't work by tricking the user, then it should be easy to provide a few examples to rebut that argument. If you can't, the argument still stands. Of course it doesn’t mean that "there is no way to install malware without the active participation of the computer user—period." There must be some way to pull this off, you'd need an unpatched vulnerability to weaponize and exploit and then to hijack a few websites to distribute the goods. I can't see why it would be impossible (except that you probably couldn't find one at the moment). And that's not what that guy implied, he said that currently the threat is limited to a few trojans. True enough, this has been the case for the last 2 years. (The DNS changer trojan was first found in fall 07.) Who said that "all the Windows malware is self-launching"? As a matter of fact, some Windows vulnerabilities are used in website drive-by-download attacks, that's a big difference between Windows and OS X. User-launched malware matters but is less scary, it's targeting the user. At least users can learn good security practices, learn to recognize social engineering, etc. The File Quarantine feature, which already existed in Leopard, has been enhanced and it could help, too. In all, I don't see how MacLand is getting to be more dangerous, the number of known malware didn't increase dramatically. “Currently, the only way to get malware onto Macs is to persuade the user to install it.”

That’s probably true. If you know of Mac malware found in the wild that doesn’t work by tricking the user, then it should be easy to provide a few examples to rebut that argument. If you can’t, the argument still stands.

Of course it doesn’t mean that “there is no way to install malware without the active participation of the computer user—period.” There must be some way to pull this off, you’d need an unpatched vulnerability to weaponize and exploit and then to hijack a few websites to distribute the goods. I can’t see why it would be impossible (except that you probably couldn’t find one at the moment). And that’s not what that guy implied, he said that currently the threat is limited to a few trojans. True enough, this has been the case for the last 2 years. (The DNS changer trojan was first found in fall 07.)

Who said that “all the Windows malware is self-launching”? As a matter of fact, some Windows vulnerabilities are used in website drive-by-download attacks, that’s a big difference between Windows and OS X. User-launched malware matters but is less scary, it’s targeting the user. At least users can learn good security practices, learn to recognize social engineering, etc. The File Quarantine feature, which already existed in Leopard, has been enhanced and it could help, too.

In all, I don’t see how MacLand is getting to be more dangerous, the number of known malware didn’t increase dramatically.

]]>