Mac Desktop Security: The Landscape Is Changing
Macs are climbing up the malware threat ladder as Mac OS X gains more users and business adoption. Yet there is a high level of cluelessness about Mac OS X security and it's making all Mac users vulnerable.
Tue, September 06, 2011
CIO — Only about 20 percent of Americans think Macs are vulnerable to viruses, compared to more than half who describe PCs as "vulnerable" or "very vulnerable" to attack by viruses, according to Alex Stamos, a security analyst at iSec Partners.
That doesn't mean Macs are safe, only that Mac users have a "go ahead, run this unsigned binary, who needs anti-virus" attitude about potential threats, Stamos told an audience at this year's Black Hat security conference in Las Vegas.
The truth about Macs and malware, according to Stamos, McAfee Labs and other vendors is:
- Any computer is vulnerable to malware
- Apple has ridden the popularity of the iPhone and iPad to a comeback in the enterprise, making its operating systems a more attractive target for malware writers
- The high level of cluelessness about security makes Mac users of all stripes far more vulnerable to infection or phishing attacks than PC users who have learned caution by experience, according to Stamos.
Now in Hacker Sights: Adobe
Threats to Windows machines are actually going down, at least proportionately, as Microsoft's security improves and the popularity of Adobe products draws more malware writers to focus on it rather than Windows, McAfee's report showed.
The issue is not that Adobe code is insecure, just that it is growing in popularity more quickly than the stable user base of Windows, the report said. Since January, malware threats collected by McAfee that were aimed at Adobe products have increased from a little over 4,000 per month to just over 14,000 in June — growth of 330 percent in six months.
Mac OS X — Keep It Out of Your Enterprise
The increase in threats to Mac OS X machines is as dramatic as the effect is on Mac users, the report found.
"There are more Mac users than ever before as well as steady business adoption," the McAfee report found. "This puts the Apple platforms squarely in the crosshairs of malware authors. It will be interesting to see if this type of malware makes its way to the iPhone and iPad as well. It is probably a case of 'when' rather than 'if.'"
So far, most of the threats have beensocially engineered approaches such as MacDefender — a fake antivirus program that preyed on the budding awareness among Mac OS X users that their platform may be vulnerable.
MacDefender showed up in April and May; by May 31 Apple had shipped a patch that plugged the vulnerability it exploited and cleared it from infected machines.
