Virus

[Gary Richardson]

Hi plugsnpixels,

Macs OS is not in and of itself secure, no OS is, but you are right that you are highly unlikely to come across any infections.

The simple answer is that the bad guys just don't write them for Macs because there is insufficient payback for them.

Modern malware is written by highly skilled and educated professional programmers, it has long ceased to be the activity of kiddies in their bedrooms, but is organised by well funded criminal gangs. The reason being that they can make huge amounts of cash from these activities, in some cases running into billions of dollars.

Were they to be interested in Macs, then there is absolutely no doubt that they could develop infections to penetrate their defences. However they want the biggest return for their effort, and that means targeting Windows, a system that is much more prevalent and with which they are so far more familiar.

The current trend is towards identity theft, and the more and more infections are being written to install backdoors and keyloggers. Most are rooted (cloaked by a rootkit), so generally the user does not know that they are infected, many times they come to us with other problems, and it's only when/if we run a rootkit scan that their "guests" are discovered.

With a backdoor/keylogger, the attacker has as much (and in most cases more) control over your computer as you do. They can install programmes to distribute porn, distribute spam, use your computer for DDoS attacks and a whole lot of other criminal activities. These programmes are rooted, so the victim will be unaware that they are present, as they are not seen by the OS. The only thing the victim notices usually is a reduction in their computer's performance.

Just how long Macs remain untargeted I couldn't say, as I said earlier I hope it stays that way indefinitely, but at some time or other it seems logical to assume that these criminals will want to expand their interests, and when/if they do, you probably won't know, because all you'll notice is decreased performance which you'll probably attribute to something else, just like all the Windows users did.

[Swampy]

>>>Actually, I need to replace my computer. It is ~ 5 years old and I'm concerned of a complete failure at some point. My concern with the apple is the cost of converting all of my software to the apple environment and how many of my applications will work in this environment. Any thoughts?

For the cost of Parallels or Fusion you can turn your Mac into a full blown PC. Run your old software using XP or Vista OS. Do your surfing, email etc. on the Mac "side" to avoid internet born virus/malware. No need to buy new versions of your software. :-) It's an Intel chip after all.

[plugsnpixels]

This is funny! Just this very moment, for the first time ever (with this thread open), I got the pop-up window Swampy described (see attached), and this web page--CAREFUL, it's one big hyperlink loaded (titled "Online Guard")! I'm also attaching a screenshot of the page so you don't have to visit it to see it.

Nothing else happened until I tried to select/copy the web header to post here, then the .exe (Install2650.exe) began to download. I'm on a Mac, so I just cancelled it. (Here's some info on the .exe file from Prevx, which appears to be legit, but who knows...)

The Online Guard page is obviously bogus; it says I have 14 spywares with 5519 files infected... I bet if anyone else looked at this page it would say the same thing.

So maybe this thread is infected-!

[Swampy]

P&P good catch. If I were on a PC, I'd never click the link. Geeez... it sends you to aome obscure web page and offers to check your computer for malware, Just click the link and get infected and pass it on... No way Jose

[HroadhogD1]

My question is, after somebody gets this type of pop-up-and you click cancel, is it still downloaded? What if you just click the red X? All of this seems to be getting worse. What can we do? Add software, and watch what we do, but even then..... With the Macs getting more popular, it seems to be just a matter of time.....guess there are people out there staying one step ahead or at least a half step. I just wish there was more we could do!!

[plugsnpixels]

Depends on how far along the way you cancel. Even if it fully downloads, it would probably just there sit until you double-click it. On the Mac a .dmg or .pkg couldn't install itself without your password, or so I understand. Not sure about XP.

[plugsnpixels]

Here's an example of how Mac OX-X Leopard handles stuff you downloaded.

[Gary Richardson]

Originally Posted by HroadhogD1

My question is, after somebody gets this type of pop-up-and you click cancel, is it still downloaded? What if you just click the red X? All of this seems to be getting worse. What can we do? Add software, and watch what we do, but even then..... With the Macs getting more popular, it seems to be just a matter of time.....guess there are people out there staying one step ahead or at least a half step. I just wish there was more we could do!!

Can't speak for Macs as I'm not familiar enough with their OSs to say.

For Windows it will depend on what "permissions" are set. If you are browsing using an account with Administrator privileges (Windows XP accounts are Administrator by default), and your browser is set to allow scripts, then you can be fully infected without any human interaction.

If you are using an account that is set to Limited, then the file would not be installed as Limited accounts do not permit file installation. I recommend that everyone creates a Limited account and uses it for browsing. If you know you're going to want to DL and install something then use your Administrator account, otherwise by using a Limited account you are much safer.

Similarly if your browser was set not to allow scripts to run, then it's unlikely the rogue installer will operate. I use Firefox as my browser with the NoScript add on. This allows me to block scripts from all sites except those to which I give permission.

I don't want people to get paranoid about picking up really nasty infections, despite them being more widespread than they were formerly, they are still relatively uncommon for people who browse normally. They are mostly contracted by people looking for freebies and those visiting crack and porn sites. For those of us who are a bit more selective on what we click, the chances of getting an infection are very much reduced.

Just remember to be cautious of anything that's being given away and check things out before you install it, remember there's no such thing as a free lunch.

[DWThomp]

Gary - thank you for all this valuable information. I just added the No Script extension to Firefox. Are the default settings ok or are there some options that need to be selected? Thanks again.

[skydog]

Gary...how/where for explorer do I indicate "no script"? Within the Tools of explorer do I change or just use the security settings provided?

[Gary Richardson]

Hi Dennis,

The default settings for NoScript are fine, though you can customise them if you wish. I have Flash blocked as well, but then I visit some rather "risky" sites when I'm researching Malware (yes they can use Flash as an "in" to your system). If you have this set you'll get a notification if a Flash object tries to open, you can right click it and select to let it run from the NoScript menu if you think it's OK.

When you land on a site if you look in your taskbar there will be an icon (red circle with a diagonal line through it and a blue S inside), this indicates that scripts are disabled for that site, because of this some site functions will not work.

Once you've established a site is OK such as for here at RetouchPRO, you simply right click the icon and select Allow or Temporarily Allow as you require. Allow will permit scripts on that site on a permanent basis, Temporarily Allow will allow scripts for your current session only.

Right click on the icon and select Options and you can customise which site options you wish to block, you can also view the list of sites you've allowed.

A site can be removed from the Whitelist (allowed sites) if you no longer wish to give them script permissions, or alternatively you can visit the site then Forbid it using the right-click menu.

Skydog,

For IE6, the following settings will improve security (but you may find the number of prompts you get a little inconvenient), personally if you're going to use IE as your browser I'd just upgrade to IE7 where the default settings are more secure. IE7 also has tabbed browsing which is a distinct improvement. Most of the teething problems with earlier renditions of IE7 have now been resolved so you shouldn't have any issues with it.

For IE6

• From within Internet Explorer click on Tools > Options > Security > Internet > Custom Level.
• Make sure these options are set as follows:
  • Download signed ActiveX controls to Prompt
  • Download unsigned ActiveX controls to Disable
  • Initialize and script ActiveX controls not marked as safe to Disable
  • Java permissions to High Safety
  • Installation of desktop items to Prompt
  • Launching programs and files in an IFRAME to Prompt
  • Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Press the Apply button and then the OK to exit the Internet Properties page.

[pixelzombie]

Originally Posted by Gary Richardson

Hi plugsnpixels,

Macs OS is not in and of itself secure, no OS is, but you are right that you are highly unlikely to come across any infections.

The simple answer is that the bad guys just don't write them for Macs because there is insufficient payback for them.

Modern malware is written by highly skilled and educated professional programmers, it has long ceased to be the activity of kiddies in their bedrooms, but is organised by well funded criminal gangs. The reason being that they can make huge amounts of cash from these activities, in some cases running into billions of dollars.

Were they to be interested in Macs, then there is absolutely no doubt that they could develop infections to penetrate their defences. However they want the biggest return for their effort, and that means targeting Windows, a system that is much more prevalent and with which they are so far more familiar.

it is true that no OS is completely secure, but Windows so much easier to break into and create problems for..a lot of the well know virus' were written by teenagers just learning to program..Apple has always made it as difficult as possible for a virus to infect the mac and that is the main reason you don't see a lot of malware being written for the mac, it can be done but by the time a person aquires such knowledge and skill they could have a very rewarding job as a programmer..there may not be a lot of money in writing malware for the mac, but i'm sure there is some hack out there that would love the notoriety of creating the 1st virus that actually did some serious damage on the mac platform...

[Gary Richardson]

Originally Posted by pixelzombie

it is true that no OS is completely secure, but Windows so much easier to break into and create problems for..

Macs are no more difficult to hack than Vista, but there are already Vista infections because it's a more popular OS than those on Macs.

a lot of the well know virus' were written by teenagers just learning to program.

Practically no modern viruses are written by teenagers, they are written by criminals who wish to make money from you.

Apple has always made it as difficult as possible for a virus to infect the mac and that is the main reason you don't see a lot of malware being written for the mac, it can be done but by the time a person aquires such knowledge and skill they could have a very rewarding job as a programmer.

Macs may have once been more difficult to penetrate than Windows, but that is not the case now. The rewards from computer crime far exceed those that can be made legitimately. The guys writing modern infection codes are not at all interested in Notoriety, cash is what motivates them and nothing else.

You can hold to your naive belief that Macs are secure because of their design if you wish, but it really is not the case. Their true security is due to the paucity of their number and little else.

Like most Mac users, I don't expect you to believe me, and I sincerely hope you continue to have infection free browsing.

[Gary Richardson]

For those who don't think Macs have any vulnerabilities, this might make interesting reading.

http://blogs.zdnet.com/security/?p=758

[pixelzombie]

that report relies on reports from the actual companies themselves, not what has been discovered by an independent party...