For years, the Mac faithful have watched from the sidelines as their Windows brethren put up with frequent viruses, habitual security updates, and more Trojans than the ancient Greeks. But now a series of high-profile vulnerabilities and hack attempts have made Mac users realize they are not immune to security problems.
Reports in recent weeks of nasty viruses and hack attempts on the
Macintosh operating system have led security researchers to remind everyone that both Mac
OS X and Microsoft Windows have roughly the same vulnerabilities. The only difference has been that hackers prefer to go after Windows, which runs on roughly 90 percent of all computers, rather than waste time on the Macintosh, which has a market share of about 3.5 percent.
However, even with the protection of being in the minority, the Mac enthusiast's days of security superiority -- and, some might say, smug satisfaction -- could be waning. Once thought invulnerable by many in its core user base, the Mac might finally be "worthy" of targeting by hackers who once considered it small potatoes.
If that's true, then Apple's legion of defenders, whose devotion to the company can border on evangelical zeal, will have to change more than their perspective.
Target Practice
Speculation abounds over why the hacker culture has chosen this moment to put the Mac OS in its sights.
Some wonder if Apple's spectacular success with the iPod and subsequent market dominance in digital music -- or if the company's switch to Intel processors, which have powered Windows machines for years -- are causing a kind of backlash similar to what Microsoft has endured for years from the hacker community.
Others have questioned whether the Mac OS might have vulnerabilities that make it an even easier target than Windows. Because security breaches of Windows systems are commonplace, weary administrators have become accustomed to setting up multiple firewalls. But the lack of attacks on Macs might have left them more exposed, some observers have said, simply because extra precautions were thought unnecessary.
Such musings make for interesting dinner party conversation among I.T. types (if not their friends and spouses), but if you're having security experts over, be sure to have topics to discuss after the appetizers. Many security professionals believe, simply, that in the hacker subculture, attention begets momentum.
In other words, the more that people talk about Mac security, the more tempting it is for hackers to crack the systems, just to show that they can.
Peeling the Macintosh
Apple has not been immune to security problems in the past, but these problems generally have been few and far between, in contrast to the pile-up of intrusions seen in recent months.
Last September, the company issued 10 fixes for holes in OS X. Symantec noted that the flaws were serious because machines running the affected systems could be targets for remote attacks.
In February, the Mac community was concerned when a worm, Leap-A, spread through iChat, Apple's messaging client. Another exploit days later left users of the Safari Web browser exposed to malicious programming.
These and other vulnerabilities prompted Apple to issue a security update for an additional 20 holes, and to tweak security settings for iChat specifically, so that users now receive a warning stating they are downloading unknown or unsafe file types. To the typical Mac user, this warning was akin to seeing Bigfoot.
More discussion about security was sparked by a late-February contest in which a Swedish man set up his Mac mini as a server and invited people to try to break into the system and gain root control, which would allow the attacker to install software or delete files.
A systems engineer at the University of Wisconsin-Madison, Dave Schroeder, boasted that a Swedish Mac-hacking contest was too easy. He subsequently set up his own contest, which he claimed was more challenging. The university, fearing its servers would be overwhelmed, summarily shut down the blood sport.
Although Schroeder's claims now are being examined and even disputed by some people, the contest rejuvenated discussion about Mac hacking in general, and garnered interest as the story shot 'round the world.
Achilles' Heel
The recent vulnerabilities and the hack-a-Mac contests have focused attention on heretofore little-mentioned difficulties with OS X. Security firms have said that Macs actually have just as many vulnerabilities as Windows systems, but they are exploited far less often, leading some Mac users to view their systems as bulletproof.
"The perception about the Mac doesn't match reality," said Craig Schmugar, virus research manager at McAfee Avert Labs. "Many Mac users simply felt their machines were invulnerable, and that's because they never had any security problems, so it was easy to think that."
Some people even have disputed what makes for a virus, Schmugar said. He has heard about Mac enthusiasts claiming a certain virus was not a "true virus" because it required user interaction to launch rather than worming its way undetected into the system.
"You talk to a Windows user about the dangers of clicking on the wrong attachments, and they know you're talking about a virus," he said. "But there's something about the Mac community that is very protective of their machines. They don't want to admit when something bad is threatening them."
Vincent Weafer, senior director at Symantec Security Response, said that it was important for Mac owners to understand the pros and cons of their OS compared to Windows systems.
With Macs, user-access controls and default security settings are more mature, Weafer said, but Windows has better firewalls and intrusion detection thanks to numerous third-party vendors. Microsoft also has better security updates, he added, but that is not surprising.
"Simply being on a Mac has never been the only defense you need," he said. It has offered some level of protection, he noted, because hackers have not seen the system's exploits as an opportunity for fame (or infamy) in the same way that they have with Windows systems.
Lock and Key
What is likely to change after this spate of vulnerabilities is that Mac customers will be better informed, and therefore might exercise the type of caution that has become second nature to Windows users. That includes being careful about downloading suspect software, opening questionable software attachments, and visiting sites that could be chock full of phishers -- con artists looking to fool you into submitting sensitive information.
But another group might have its eye on Mac security as well, added Schmugar. "Hackers that haven't paid attention to the systems in the past might now see that it's worth their time and effort," he said. "Before, they left it alone because it affected too few users, but now they might see it as fun."
Increased attacks also could spark discussion of Apple's security practices. The company has been criticized in the past for putting out updates just after Microsoft issues its patches, a ritual that some say has minimized the attention paid to Mac flaws.
"A tactic like that is just about marketing, really, and maintaining an image," said Schmugar. "But, really, [Apple is] still putting out the patches, so it's not like they're being deceitful. They're just careful in their timing, like they are with everything else."
In many ways, the discussion has sparked more what-if speculation than actual alarm. A sudden surge in Mac-targeted viruses is not necessarily a smart bet.
"Maybe some virus writers will see Macs as a new frontier, and that could be intriguing to them," said Thomas Kristensen, chief technology officer at the security firm Secunia. "But most really don't want to spend their time creating a virus that will affect maybe 2 percent of users."
If he's right, it looks as if Mac users might be able to keep at least a portion of that smugness in reserve for their Windows counterparts -- at least for now.
