Are Macs susceptible to malware from merely visiting a website?

[Larry_Mudd]

Here is the specific update.

[Francis_Vaughan]

Yeah, Apple have not exactly covered themselves in glory with this one. Since they took over responsibility for Java on the Mac they have not kept pace with updates, and this one was fixed by Oracle in January, yet only now do Apple scramble to get a fix out. Being a long time Mac fanboi, I’m not pleased. With luck they will be stung by the adverse publicity this generates and lift their game. Exactly what will be done about sorting out existing infections remains to be seen. Apple need to have a really solid story about this.

[RaftPeople]

@Fubaya

I just now got a chance to look at that and I don’t know what this is supposed to prove. It is basically a survey showing how long it takes for different operating systems to issue patches. Turns out microsoft is the quickest and Red Hat was second,…

While it’s important to fix things quickly, that metric says nothing about the number of vulnerabilities for a particular OS.

I think it’s ok to say MS is good at fixing, but to present that as an argument for Win being more secure than the other OS’s being compared is illogical.

[drachillix]

@Fubaya

In 2010 there were 4 new Windows viruses per minute and 0 for Linux. No one thought to make a single one that targeted half the servers on the internet?

Because Servers are not browsing the web
Because Server admin teams don’t fall for “For $300 you can get lifetime virus cleanup services.”
Because server admin teams often run in isolated test environments before rolling out to the working servers.

Its kinda like asking “Why don’t more people rob police stations, there is lots of cash, drugs, and guns there”

and thats just the locker room… …even more in the evidence storage area.

[Anaglyph]

There’s recently been a Trojan reported that exploits a java security flaw in OSX v10.6 and 10.7, the Java update released on April 3rd. is supposed to fix the java vulnerability by this “Flashback” malware

[AaronX]

This article might be relevant.
Apple Macs spreading Windows malware
http://www.todayonline.com/World/EDC120425-0000115/Apple-Macs-spreading-Windows-malware

[Fear_Itself]

550,000 Macs infected with Flashback virus

Initial reports of drops in the number of systems infected with the Flashback Mac malware are being corrected – the adjusted number is now back to around 550,000 systems.

[Kenm]

@AaronX

This article might be relevant.
Apple Macs spreading Windows malware
http://www.todayonline.com/World/EDC120425-0000115/Apple-Macs-spreading-Windows-malware

The revelation that Macs can pass on Windows viruses is like blowing the lid off the eons-old conspiracy of silence that water is wet.

An infected Windows machines sends an email to a Mac. The infection can do nothing to the Mac, but if the Mac forwards the infected email to another Windows box, the infection is spread to the second Windows box. This has been the case since Day 1.

“Revealing” this as new, or worse yet, news, is hilarious.

[Blakeyrat]

@Arnold_Winkelried

Yes, what I meant is that the file you download is usually an installer for the program and not the program itself.
Though, like I said, I just tried it with two programs I downloaded, and one of them did not show the message when I double-clicked on the “installer.exe”. I wonder why that is?

This is off-topic, but the answer is code-signing. Microsoft has a mechanism by which installers can “sign” themselves with an SSL certificate (much like a HTTPS website), and it trusts installers that are signed that way and doesn’t give you that dialog.

Then the question becomes, “well, owning a SSL cert doesn’t really make it secure, right?” which is a valid issue, but since it applies to every single HTTPS site on the web as well, Microsoft’s not any worse than anybody else about that.

I’m not sure if Apple has any form of code signing set up. If they do, and if the installer/application is signed, I wager it also would not ask about executing it.

[Blakeyrat]

@The_Niply_Elder

Yes, I encounter this sort of thing very often too. This behavior is precisely the type of thing that supports my earlier argument that Windows does not have “baked-in” security features like Unix and Linux. Yes on the surface of things Windows has some sort of annoying popup that you click through. But very often it does not appear. My hypothesis is that this symptom comes from the same fundamental design rot that allows hackers everywhere violate Windows at will.

How is this kind of shit even possible? But it happens. And a million little variations of this kind of inconsistent behavior pervades Windows. You honestly cannot say with a straight face that Windows was designed with security in mind. Saying that it has security attached like a post it note is being a little too generous, a little too British overstatement .

Seriously?

Look, Windows trusts SSL-signed applications. This is no better or worse (from a security perspective) than Firefox trusting SSL-signed websites or SSL-signed Java applets.

Just because you don’t understand why Windows asks you for some applications and not for others doesn’t make it evidence of a lack of “baked-in security”, or that Microsoft’s programmers are bad at their jobs, or some kind of conspiracy on Microsoft’s part. It just means you don’t understand what’s going on.

As for your UAC complaint, it seems your problem in that case is that Windows 7 has too much security, and won’t let your application get away with the crap it was getting away with on XP.

[Mister_Rik]

@Blakeyrat

I’m not sure if Apple has any form of code signing set up. If they do, and if the installer/application is signed, I wager it also would not ask about executing it.

My Mac warns me every time I try to install something I’ve downloaded. However, it doesn’t warn about something being installed from a disk. I recently installed Adobe Photoshop CS5, and the installer also secretly installed a little 3rd-party utility called “Growl” that scans my whole Applications folder and looks for updates on the Internet. I didn’t know what this thing was that kept popping up alerts telling me about updates to this and that, so I found what it was and went to their web site. It turns out they were aware that it was getting automatically installed along with Photoshop, without user permission, and were kind of annoyed about that (and have told Adobe to desist). They had a handy uninstall utility for those of us who wanted to remove it.

[johnpost]

they are no longer being called virus free by Apple.

[old_joe]

Apple itself has changed its tune. as this article says

Apple drops virus immunity claim for Macs so Apple no longer claims to be immune to virus’s (sp?)
600,000 people got infected so we can now say that yes Macs get infected (big old roll eyes)!

PCmag says “Following April’s Flashback Trojan - which hit more than 550,000 Macs - Apple recently removed from its website the claim that its Mac operating system is not susceptible to PC viruses.”

So maybe now the fanboys can just stop, IT people have always known it would happen sooner or later. 500,000 to 600,000 infections would qualify for “out in the wild” I would think.