Virus

[Gary Richardson]

From what I read the statistics were supplied by Secunia http://secunia.com/ an independent 3rd party vendor.

Secunia compiles its statistics from a wide range of sources inside the security community and has reporting facilities that anyone can use.
http://secunia.com/report_vulnerability/

But whatever the source the vulnerabilities exist, and if you think they are known to only a small circle of programmers employed by Microsoft and Apple then I'm afraid you are being seriously optimistic.

Historically most vulnerabilities have not been discovered by the writers of programmes, but by external "testers", some with benevolent intentions, many with entirely different motives.

My intention with posting these statistics is not to show that Macs are prone to infection, but to show that if malware writers wished to target them, then they would have no more problems crafting an infection for that OS than they have creating something to run on Windows.

But you believe what you wish, I've said all I intend to on the subject.

[Swampy]

Gary, I would never say that a Mac or OSX is not vulnerable to any malware. The important thing is exploitation. To date, no one has exploited the vulnerabilities for the Mac. Small user base, little "joy".. who knows why, but the fact remains, the Mac is "safer".

[Gary Richardson]

You'll get no argument from me about the number of infections you're likely to come across if you use a Mac, though I wouldn't use the words safer, just less targeted.

I can't give statistics as to the level of exploitation of Macs vulnerabilities, as I don't deal with that OS. I don't think we can for sure say they have not been exploited, only that you are highly unlikely to come across an infection if using a Mac. However since the modern trend is to Rootkit infections to hide them from users, it is quite possible that there are infected Macs out there that are not being reported as such.

Good browsing habits are necessary whatever OS you use, which is of course the point I was trying to convey.

[Kraellin]

gary, i know java can be used to create malicious invasion of one's computer, but how about some of the other things we are asked to click on from time to time, like scripts, activex and cookies? can any of those be used to invade our windows machines?

also, you might make mention of winpatrol for a good anti-install defense.

[Gary Richardson]

Hi Craig,

Both scripts and Active-X can be used as vectors to install infection, as can Flash and other such presentations. It's because Firefox does not support Active-X that many consider it a safer browser, but really that's not the case. The guys who write modern infections usually install a great deal of flexibility into the infection "warhead", and if one method fails they usually have a number of alternative methods to try.

If the account you're using to browse has Administrator privileges, then a script is able to do pretty much anything it wants. Scripting tools are very powerful, and if there's no need to escalate privileges, then the sky's the limit.

With a Limited account it's a different story, and although the infection can make initial contact, it is more difficult (but not impossible) for you to get a full infection. Your AV programmes will usually have a much greater chance of protecting you if you're browsing using a Limited account.

Cookies cannot infect you. Though many are flagged as "spy cookies" by AV programmes, all this really means is that the cookie flagged contains information that can be read by sites other than the one that installed it. Some people see that as an invasion of privacy as they can't control just exactly who sees the data.

WinPatrol is indeed a very useful utility to have, the newest versions have a great deal of inbuilt functionality. I had a Scottie in my taskbar for quite some time, only disposing of it when I installed a full HIPS protection suite (two programmes doing similar things is always a likely source of conflict).

[skydog]

What do you mean by limited account? What is an AV program. What is HIPS protection suite? I know infections can affect the functionality of one's operating system, but what other purposes do these infections pose? At the end of the day when I run adware I may end up with 35 cookies that I must erase. What exactly is happening while they are there. If I remove them and they appear again later, is it an accumulated effect?

[Gary Richardson]

Windows XP has two types of accounts, (the options are different in Vista) Administrator and Limited and each has different "permissions". An Administrator account can basically do anything including install new files, alter system settings and a whole lot more, whereas a Limited account does not have permission to either change files or alter system settings.

When an infection penetrates your system, it does so with the permissions of the account that was running when it entered. If it is a Limited account, its scope for doing damage is circumscribed by the reduced permissions of that account. Which is why browsing using a Limited account is a much safer option.

Windows accounts however are Administrator by default (not so in Vista), so it's necessary for you to create a Limited account. This is done within Control Panel > User Accounts. (just create a new account and follow the prompts, choosing Limited as the account type)

HIPs is a (Host Infection Protection System), basically it's a process firewall, which controls all process operation within your computer. You use it to make a set of rules permitting or blocking the operation of those processes. It's kind of difficult to describe in just a few words, they require quite a lot of interaction and therefore knowledge of your computer, and because of that I do not recommend them to other than experienced users, though they are very secure.

There have been moves made to simplify their use, but they still require a deal of knowledge to set up and use effectively.

AV is just shorthand for Anti-Virus, sorry forgot not everyone talks this stuff all the time.

As for cookies, all they are is an encrypted text file which contains data set by the issuing site. They usually contain brief profile details including site preferences and sometimes site history records as well. Mostly they are site specific and other sites cannot read the data upon them. Because they are text files they cannot contain active elements, and therefore pose no infection threat.

Some cookies however can be read by more than one site, usually sites within the same commercial group, but some can be read by sites which have come to some form of association. These are flagged by many anti-virus programmes as "spy cookies" and are considered a low level threat, in as much as you may be transmitting details of your browsing behaviour by having them on board. If you're not bothered by this leave them alone, if you are allow your anti-virus to remove them.

Once removed, any new cookies do not have access to the info accumulated by the ones deleted.

Hope this explains things, if you've still any questions just ask, if I can explain further I will.

[pixelzombie]

Originally Posted by Gary Richardson

Y
Good browsing habits are necessary whatever OS you use, which is of course the point I was trying to convey.

i agree, you have to be careful when browsing as that's where the bulk of problems occur as noted by this article:

http://www.wired.com/politics/securi...11/mac_trojan#

so for those on a mac here are some ways to safeguard their machines:

http://www.pocopico.com/rants/osx_hardening.php

http://blog.cocoia.com/2007/03/10/ho...efore-leopard/

the latter deals with some advanced topics so if you're uneasy about some of the information offered it would be best to ask your local mac expert...

[Gary Richardson]

Interesting link pixelzombie.

I see the Mac trojan you linked to seems to be associated with Zlob, this is one of the most prevelant infections for Windows (there's a whole number of varieties of it), so if the Mac version has any success you can expect to see a lot, lot more of it very soon.

As you can see, the infection is not auto installed, but is actually installed by conning the User into installing a codec. This same method is used with Windows. Despite it seeming to be an obvious ruse, it's actually been a very effective way of distributing the infection. It's amazing how little some people think before installing things from unknown sources on their computers. That and the distributers of this junk have a very polished sales pitch.

My fear is that because Mac users have traditionally not been targetted, that they may be more ready to install unknown programmes, I hope this does not prove to be the case.

You'll notice that the security advice given for Macs in your other two links bears a deal of similarity to the advice I gave earlier for Windows. Not so surprising really, the two systems despite their many differences also have a great many similarities in function.

[skydog]

sorry Gary...what is codec?

[Gary Richardson]

Codec (Coder/Decoder), a device used to interpret/view data.

Because data comes in a number of different formats, it's necessary to have a codec that's designed for the particular data form the programme uses.

In most cases programmes use a "standard" format, and the codecs are built in, or supplied by an outside "viewer" like Real, Flash, Windows Media Player etc.

However some programmes use non standard file formats, and special codecs may be needed. If this is from a legit manufacturer which you have sought out yourself, it's fine to install them.

However it's a common infection vector as well. You land on a site which has advertised something you want to see, and when you try to view the content you get a pop-up saying you haven't got the required viewer, and that you need to install special software to do so, or it may be sold to you as a plug in for one of the more mainstream viewers.

Whichever way they sell the scam, once you install the codec/plug-in/programme, you're infected.

Any site with content that can't be viewed with the standard viewers should be avoided.

[pixelzombie]

a codec(compressor/decompressor) is a piece of software required to view certain video formats and should only be installed from a reputable source...

[Swampy]

Yeah, I wouldn't install something from a port site. LOL

[pixelzombie]

i've also seen sites with sports footage try to get the user to install some sort of codec as well...

[plugsnpixels]

Here's an interesting discussion from MacInTouch on the subject. Among the info about Mac-related issues is why Windows users better stay away from Sears (bottom of page)!