Apple claims OS X immune to viruses. Experts say, 'no'

[Bob Crabtree]

"slightly fewer faults" if you don't mind?

[Hiroaki]

I suspect that the ASA will haev a field day with that - it really is an advert aimed at the lowest common denominator.

Sadly, I suspect it'd work on a lot of people as well - Mac's being the slightly lesser known day to day system and this being the company that bought us the iPod, Joe normal may well believe them.

All that said, the timing of the article on this? A little suspect....

Although you see less of them nowadays, I wonder what would happen if a Mac with boot camp acquired a boot sector virus via it's Windows install?

[darrensen]

"Apple - we have slightly less faults than Microsoft"

"Apple - we have slightly less faults than Microsoft"

all i have to say on that is....

MACBOOK PRO

Let go buy a mobile microwave and burn our laps! Apple really tick me off with faulty equipment. I work at a cross platform company and the ratio of faulty mac to PC's is 6:1. Also the amount of time i spend on fixing software problems on a mac is about 20:1.

They are far from perfect!

[TheVoice]

Amusing adverts, but a few times it's quite clear that they're downplaying what the PC has to offer. Assuming that "PC" in those ads means "Windows PC", in virtually every ad on that page, there's something that made me think "Hmm....that's not quite true".

I think Apple needs to create an ad campaign that doesn't rely on slandering the opposition. All it does is makes the Mac users feel better, and the PC users feel alienated. How that encourages anyone to switch, I don't know.

[Mike Fishcake]

Smug, smug, smug, smug.

And wrong.

Sometimes I have to reboot my Mac because it's running like a dog. This air of self-righteousness is going to come back and bite the fanboys on the arse.

I like Macs, but I like them because of the way MacOS works, not just "because it's not windows". Apple can say what they like, but Windows does have advantages over MacOS. If I had the money, I would buy a Mac with Boot Camp on it.

[[GSV]Trig]

IMHO
Any peice of kit that runs code can be infected with a virus, be that your STB, Mobile, Mac, whatever, anything that you can write or download software for is vulnerable, just because there arent any out there doesnt make them any more or less secure it just makes them lucky, advertising the fact that people arent writing nasties for your OS or whatever does 2 things, makes you look unpopular and makes you a target.

[TheAnimus]

this just in, mac's cure cancer.

Well at least that statement might be true, where as the other just plain isn't.

now if it was a trust platform, then mabye i could understand the claims!

[joshwa]

http://www.overclockers.com/tips00958/ has an interesting take on this - basically saying that all mac users think they are completely immune from viruses, that they don't need A/V software, that they'll never get a virus... then one day there'll be a mac virus that infects every single mac on the planet and they'll be screwed...

The Mac (software) problems that do occur are normally so difficult to resolve you're just better off re-installing the OS (according to Mac consultants I know)... the Mac I use crashes every now and again... and it's normally not 3rd party software, it's stuff like Safari... plus safari can fail to work with ebay, downloading .dll files everytime you click a link or want to logon!

Plus if you post for support on Apple forums... there is NO reply, no solution to the problem anywhere to be found... and then the problem just goes away a couple of months later, or the user just gets used to it...

[nichomach]

Mac OSX has the capability to be inherently somewhat more secure than Windows - it's a heavily messed with BSD Unix. That said, a lot of the modifications appear to reduce its security somewhat. Bottom line; Mac users should be running security software, like AV and anti-spyware packages, and they should keep them up to date and properly configured. Just like Windows users. The thought occurs that if both do, then much of the supposed Mac advantage is illusory.

[stmok]

Four things about OS security.

(1) OS design...
What does it have to reduce damage or the likelyhood of attack? Designed to be toughened against attack? etc. Something? Nothing? Are we talking about based on proven Unix technology or some hybrid?

(2) Response time of the developer to security issues?
How does Apple do? Hours? Days? Weeks? Months? Years?

Apple slow to patch security flaws?
http://arstechnica.com/journals/apple.ars/2006/5/4/3842

(3) Does that user have a clue WTF he/she is doing?
Know how to implement firewall? Update regularly? Add something like SELinux? IDS? know how to respond to threats? etc. Most Mac users aren't all that different to Windows users when it comes to security and how they react to it. (most know a firewall is important, but the problem is they tend to assume that's a solution to everything for security!)

(4) Number of people who find the problems? (is it open or closed source?)
Open-source finds and fixes issues MUCH faster, because they are very receptive to bug reports. (its common for patches to come out daily). True, OSX has some components of FreeBSD in it, but it is a hybrid that isn't directly compatible. It has GUI bits and other apps that could increase the probability of security issues. (working on the principles of: the more crap you slap on, the more potential issues you need to address). I'm not sure how well they test the apps for security. (It ain't open-source, so you can expect the bug count to be a sizeable number...If they opened it up, we may see how good or bad their coding is).



Now, let's look at this Apple advertising...
(Oh god. Its specifically targetted for those who have no-clue, and once again, poke fun of PC users.)

Switching OSs does NOT mean you should forget about basic security practices. If you do, you're a fool falling into the "security through obscurity" concept. Obscurity is only delaying the inevitable. Its entirely up to the user and the company/project to act responsibly about it.

Sadly, Apple is making this a selling point. Its irresponsible to promote something is virus free when that's not necessarily the case. (sure, it may be harder to write something that is easily spreadable, but it doesn't mean you're invulnerable to OSX specific nasties. If one were to appear, that is). They should say "Windows problems don't work on Macs because we have OS X...Here's a hanky".

There's no substitute for the user's brain, and the knowledge of options they have. Its not right to promote something and protray that you shouldn't worry about security issues. Under this view, it is misleading.


So I spot two possible misleading things about this Apple ad campaign.

(1) They assume all PC users are Windows users.
(I'm a Linux and FreeBSD user, and there are others like me who don't use Windows unless its a necessity...ie: Hold a gun to our heads).

(2) Portraying the message that security is a non-issue.
(Users should be made aware of what to do if trouble does occur, so they can respond to the threat).


Security through Obscurity only buys the Developers time to bring in a patch. But the ultimate test is how fast they can react to a potentially threatening issue. ie: When the crapper DOES hit the fan.

[Bob Crabtree]

Impressive first posting!

[stmok]

Let's throw some more fuel to the fire, shall we?

Apple world
=> Their general message is: "We don't have problems like PCs."
(Yes Apple, keep telling yourselves that...)


Real world
=> MacBook Pro has too much thermal grease applied, causing issues.

You wanna see how inept they are at applying thermal grease?
http://forums.somethingawful.com/sho...readid=1864582
(Instead of a nice thin layer, they throw in a WAD of crap!)

This has also caused some legal action from Apple.
(because a service manual was linked)
http://www.theinquirer.net/?article=31446

But wait, there's more! Because too much of the thermal grease was applied, temps went up by 12deg/C+! This means that the thermal control fan will kick off more often than it should...Result? Noise. (BTW: if you break the seal in an attempt to fix it yourself, you will void warranty!)

Users are NOT satisfied, so there is an attempt in some sort of general protest to fix it!
http://www.osx86project.org/index.ph...sk=view&id=180

Spec-wise, a typical mobile CPU is design to operate at 100deg/C. (So the argument can be made that "its still operating within spec"...Which is exactly what Apple did! Instead of admitting and correcting the issue!)


This is a simple exercise of Quality Control and Customer Relations...In this case, Apple has demonstrated its inability to address these two areas in an efficient manner. This is how to NOT handle customer dis-satisfaction!

What should have been done?

(1) Should have properly applied thermal grease from the start!
(This was the ROOT cause of this chain reaction...Apple would've saved money as well, since they wouldn't need their legal dept to get involved.)

(2) Immediately address the customer's concerns.
(That's the difference between a company who says they sell quality products, and a company that actually provides quality and after-sales service...It feels like Apple just took their money and ran, doesn't it?)


=> On the security front, as soon as Apple went to x86, they opened up a can of worms.

Under this view, they should have stayed with PowerPC architecture...(Since this architecture isn't as widespread as x86). Now that they have moved over, its easier for someone to "steal" a copy of OSX, patch it to run on their non-Apple box (heck, even update it to the current updates), and develop some wonderful malware for it!

Moving to x86 gave malware writers (crackers) the perfect opportunity to build test boxes to play with. (Its analogous to handing the keys to your daughter's chastity belt to a known rapist!)

Here's a bit of reality...
Experts: Macs Becoming Malware Targets
http://www.enterprise-linux-it.com/s...d=0100000098BC

Coupled with Apple's slow response time (months) via their "security through obscurity" approach, you can see this is a recipe for disaster, just waiting to happen.


When you promote the general message of your product is invulnerable or superior, don't expect everyone to simply accept it and hand their cash over to you. There's always someone delibrately trying to prove you wrong or to test you out! (To humilate you publically and to prove you're full of crap).

Microsoft was in the same shoes.

One of their reps in the UK basically said WinXP with SP2 was pretty much invincible, and he'd like to see someone break it. Ironically, a security issue appeared months later...And now MS's stance for Vista is that they're making it difficult for nasties but they cannot guarantee with certainty they'll be invulnerable. Quite a big change in tone, isn't it? (If they only re-wrote Internet Explorer and dropped the nonsense that is ActiveX)...Oh well.


As I've always hinted...
You cannot bullsh*t technical folks with marketing nonsense. It just doesn't work. Because they will always do things to prove if you're telling the truth or not! When they do prove you wrong, it'll spread like a brush fire on lots of IT/Tech sites. (It then becomes a Public Relations issue).

Microsoft, Apple and other software companies aren't the only ones that BS. So do AV companies. The recent "multi-platform concept virus" (works on Linux and Windows) was found by Kaspersky Labs (makers of KAV)...They essentially used FEAR as their weapon of choice. To scare Linux users into thinking they were as vulnerable a Windows users.

This failed because Linux people actually grabbed the source code to this nonsense and tested it out...Result? It was a half-arsed effort. Linus (the man who started Linux kernel), had to step in to see, out of curiosity, WTF it was about...Ironically, he had to create a patch to actually make the nonsense work! (It goes to prove AV companies are willing to do ANYTHING to maintain their sales...Including outright lie).

Sure, there are nasties that exist on the Linux platform, but users have always had the necessary free security tools (its quite a collection), and the information to make themselves resistant and contain any spread of issues. That's the biggest different between Windows/Mac users and *nix users. One is often helpless to major issues, while the other checks the logs and does something about it.

To portray that people shouldn't worry about security is like saying you can completely erradicate terrorism...Its bad message to send to the customer.

[TheAnimus]

This is the type of marketing i hate the most, purely because you don't need 114,000 viruses, you only need one.

Now its x86, most BSD flaws will prophigate straight through the proccess of "barstardisation" apple have done. upshot of which, the proof of concept code one sees for a PC exploit will work just as well on mac os x.

Bootcamp seams to provide no protection at all, its possibly they could of used some of the ideas we've seen in specalisit projects for anti-rootkit technologies (verfication of certain files to make sure they've not been patched).

So, whilst there would off been security by obscurity on a power pc,theres much less on a mac. The biggest problem people face with security is complacency. I've seen so many systems that can be compramised because of use of PHP. The OS can do little to protect against shooddy use of languages which aren't the best at inforcing secure principles.

Its worth saying i've never (to my knowledge) had a windows XP box of mine compramised. This is because i'm not remotely complacent about security, adds like this will not only increase their sale to idoits, it will make mac culture even worse than it is, they are in love, complete denail of anything wrong, and as such their very likely to get compramised/attacks because their not expecting it. XP users expect a box on the net to have attempts made on them, so are by nature warery (anti-virus,firewalls, not running as admin)

[Bob Crabtree]

Let's throw some more fuel to the fire, shall we?

Apple world
=> Their general message is: "We don't have problems like PCs."
(Yes Apple, keep telling yourselves that...)


Real world
=> MacBook Pro has too much thermal grease applied, causing issues.

You wanna see how inept they are at applying thermal grease?
http://forums.somethingawful.com/sho...readid=1864582
(Instead of a nice thin layer, they throw in a WAD of crap!)

This has also caused some legal action from Apple.
(because a service manual was linked)
http://www.theinquirer.net/?article=31446

More about the legal stuff here:
http://www.gizmodo.com/gadgets/lapto...ful-171394.php