Re: XP vs Mac OS X

justin wrote: 
As of today, here are NO virii or trojans in existence. And when the
email client is configured to pass plain ASCII only, which is as hard
as ticking a box, a Mac doesn't spread them either.


This isn't true, as my other posting suggests. There is a trojan rootkit designed to take over Mac OSX. It's been found on only one system 'in the wild'.



No, it was not, and it could not activate itself unless the machine was
already _physically_ compromised, on a root level. One had to _install_
it as a root. NOT over network.


So you are wrong, there are 'mactrojans'.

WRT the network thing, are you talking about viruses or worms? The word "virus" is generally used to refer to any malware that can be spread from system to system. The method of delivery is immaterial. A network worm is a 'virus' that attacks over the network, without user intervention.



If there was one, rest assured it would hit the news big time.
Mac users are not spending any money on protection and as such, are
_very_ interesting to companies like Symantec which are dropping Mac
support.

As a Mac user since '90 I've never seen one, although I've heard of
some benign cases. I have been running OS X since it come out, as a
root, connected 24/7, with only a built in firewall. Never had a
problem.


I worked at Apple between 1987 and 1993. There were LOTS of mac viruses. I recall one that got into the QA lab in cupertino. The QA engineers kept writing bugs against our code that we couldn't reproduce. After going over to the lab, we determined they had a virus that had infected every machine in the lab, and that was interfering with the code.

Writing a virus for Mac OS 1-9 is incredibly easy to do, given the resource manager scheme. There were even hypercard viruses... Excel macro viruses... email worms... trojan horses...



Not over the network. I question your Apple expertise, there is and was
not a single malware in existence that spreads over the network. It is
impossible to hack Mac OS 9 through any network client. 


Sigh. Never say something is impossible.

As far as I know, there aren't any windows viruses that spread unassisted either. There are ways to attack windows boxes, linux boxes, and mac boxes over the network, but they are not generally autonomous malware that spreads from machine to machine (they are not 'worms' or 'viruses'); there are scripts that can walk lists of IP addresses and try to attack systems. If a system is left in a stupid state, then it's easy to attack, and possibly gain control over. Windows and unix both have command line interfaces, and allow remote logins, if enabled. The lack of a command line interface, and the wierdo appletalk protocols on macos made that kind of attack more difficult in an IP environment. Howver, for mac, windows and linux, a simple hardware firewall protects against this kind of attack. It is also far easier to simply write a stupid kids game, and embed an ugly attack into it.

If you can trick a mac os9 user into running malware, it can spread itself by writing into the resource forks of other applications. There are no controls on this. It can also plant itself into the system folder, to be started on system startup, rewrite data, and generally do anything you or the system can do, including formatting your disk, or watching keystrokes, and opening outbound network connections after you type in your credit card number.

For OS X, an application that is run under a user id with no root privs can modify that user's bin directory and profiles, along with any files that the user has access to. It can open network connections, send email, and basically do anything that you as a user can do. It may not be able to open 'well known' sockets for listening, but it doesn't have to do this; it can open sockets above 1024, and also initiate outbound connections. I don't know, but I'm guessing it can use the objective C hooks to watch your keystrokes, and wait for you to type in the root password (which you have to do with alarming regularity, particularly if you install software often.)


I was present when a friend of mine was checking his email on a PC. It
took him 20 minutes to verify few messages, wait for all watchdogs to
bless the content, then update virus definitions... That was not fun.


Thankfully, it doesn't take this long anymore. 


This was two months ago. But you just may be right as Microsoft had
probably issued a few dozen service packs since then.


Either you are misremembering how long it took, or there is something seriously wrong with the PC. In either case, it's not much of an argument against windows.


As for security and reliability, in '95 US Army switched its wintel
Apache servers to Macs running OS 9.


Well, that was a mistake. They should have been using something real, like UNIX, VMS, or even MVS. OS 9 has practically no security. Any process can whomp on any other process; the networking is wide open; the scheduler is cooperative, meaning any process can simply fail to give up control for arbitrary amounts of time; there is no file system protection. Even hardware is whackable by any process. Be all that you can be!

Regards,
 Bob Monsen




Not really, most of the above is irrelevant for Mac network security.
Specially since the majority of this thread was MS vs Apple OS _virus_
security.


Again, do you know the distinction between a virus and a worm? Do you know anything about the Mac, other than how 'cool' it is? Do you know anything about software reliability? Do you know anything at all about hardware redundancy? Putting up a mission critical application on a mac seems like a mistake to me.

Unix was designed to run dumb terminals, not intelligent clients.
It is very "whackable" as AOL, White House, Nasdaq, Amazon, MS and many
others have learned in the past.  Ask Windows users about all the fun
they have had. Mac users missed the "party". And please, no "market
share" argument fallacy.


You are just showing off your ignorance. Those websites are using big multiprocessor solaris (unix) servers, or banks of hundreds of cooperating linux systems, I'm guessing. The attacks you mention are mostly DOS attacks, which has nothing to do with the os they are running, other than it listens for TCP connections. There have been attacks due to things like a misconfigured apache, or a bug in bind, but everybody uses unix or linux; nobody who has any real traffic uses MacOS.

I'm glad you missed the party. I was using macos betweenn 1983 and 2002, both at home and at work, and I didn't get any viruses either. However, I knew not to run the 'christmas tree' email enclosure; I knew not to download and run stuff from bbs systems. When I got broadband, I knew not to allow direct access to my system from the internet. When I had macs on big intranets at apple and cisco, I knew enough set the file sharing and remote access passwords to something reasonable. Since I've been using windows, I've also never gotten a virus. I used XP for 3 years before getting paranoid and installing a virus checker. When I finally checked it, I had no viruses. I had spyware, but nothing dangerous.

People who are aware enough to simply not click on those silly emails (or download and run the 'see britany naked' .exe file enclosures on newsgroups) generally don't get viruses.

---
Bob Monsen
.

Relevant Pages

  • TidBITS#794/29-Aug-05
    ... This week's issue brings a potpourri of Mac news, ... Mark Anbinder looks briefly at Google Talk, ... Adding Tiger's AirPort Preferred Network List ...
    (comp.sys.mac.digest)
  • Apples new software may steal the show
    ... Steve Jobs, Apple Computer's co-founder and performer in chief, rarely shows any reluctance to sell -- or even over-sell -- his company's accomplishments. ... Jobs spent only about five minutes talking about what I see as the big news of the day: Apple's first software for using a home network through a television screen rather than a computer monitor. ... Apple's Mac OS X, the software running all its Macintosh computers, also has built-in features for easily connecting Macs in a network. ...
    (comp.sys.mac.advocacy)
  • Re: Wired security improvements
    ... I have a lot of experience with 802.1x in a wireless environment and it ... option than MAC Authentication via RADIUS as far as security is concerned, ... it can only provide a weak form of network authentication. ...
    (Security-Basics)
  • Re: OK first real Mac Complaint - Network Trouble
    ... changing the channel on my router has cleared up wireless issues on my ... have to reset it when the connection dies. ... to suck up a large amount of network bandwidth to do unnecessary screen ... It should at least help to identify what the Mac ...
    (comp.sys.mac.misc)
  • Re: About War Driving ..
    ... However, MAC filtering does not qualify as defense in depth, ... because the attacker can spoof a valid IP address. ... broadcasting the SSID doesn't hide a network, but just makes it show up ... machines in your building that you can control and check the MAC ...
    (Security-Basics)