Viruses on OS X

[ElDiabloConCaca]

Originally Posted by Randy Singer

Oh, good...a "security expert." One of my favorite types of people. You wouldn't be inclined to tell folks that they need to be worried about malware when they really don't need to be, would you? Just because your job depends on your doing so...?

My job has nothing to do with "security" -- I actually do GIS and database work as a "job," and am only educated as a Linux and UNIX security expert... so your assumption that I somehow needle people into false senses of paranoia in order to further my own career and salary is completely unfounded and downright stupid. I don't make a damn bit of money, nor do I get any "props" for shoving people into believing anything they don't need to believe, nor buying software they don't need to buy. Don't assume anything about me.

I would be willing to put my knowledge of Linux, UNIX and Mac OS X up against anyone who wants to pigeonhole me into some stupid, incorrect stereotype. I think my reputation on this forum reflects that -- I know what the hell I'm talking about.

The fact that your 7,000-strong Macintosh-using congregation hasn't gotten the DNSChanger trojan doesn't change the fact that more than one user here has gotten it. Like I said, people do win the lottery, and when messing around with viruses, statistics downright stink. Tell that to the guy who won a million dollars, and tell that guy who got the DNSChanger trojan that you don't believe him because 7,000 other people didn't.

The bottom line is that we have differing opinions on the matter of virus protection on OS X. You seem to think that whomever contracts a virus deserves it (at least on the Windows side) -- I, on the other hand, seem to think that people should be educated on the matter ("feed a man a fish vs. teach a man to fish"). If they attain the education level where they're comfortable running OS X without virus protection, all the better. If they know not what's out there and are paranoid, virus protection is good. I, for one, am not under the assumption that I shouldn't be worried about passing viruses on to my Windows friends... I have many Windows-using friends that are not "technologically advanced" and don't know what to look out for. While they're always learning, it's ridiculous to think that we should just toss them to the sharks and let them fend for themselves. I just recently donated an old Windows computer to a semi-friend to help him get into the "technological revolution" that is the internet. To point fingers and laugh in his face when he tries to look up some porn in a lonely moment and contracts a virus would be downright mean, not to mention judgemental. Just because a Windows user contracts a virus doesn't mean they deserved it, especially those who are new to the whole computer-internet thing.

And you're right -- paranoia is no indication of a conspiracy... but hard evidence is, and by the scientific method, one instance of evidence to the contrary disproves the idea. The fact that one person on this forum has been the victim of the DNSChanger trojan is evidence that it's "out there" and that there is a possibility of infection... am I saying that everyone should run out and get virus protection on their Mac? No, most definitely not. Am I inciting paranoia to further my own well-being and career? Nope. Am I backing up Apple in saying that virus protection may not be a bad idea?

You betcha.

But that's up to the user to decide -- not you or I. I never said people should run virus protection -- I recommended it for those who are paranoid and/or worried. You, on the other hand, have decidedly suggested to ignore this information and evidence and suggest that no one should run virus protection on their Macs... which I wholeheartedly disagree with. Neither you nor I know every Mac user, and neither you nor I know what's best for them, and it's presumptuous, arrogant and downright dumb to pretend so.

With that being said:

In any case, Macs simply do not spread Windows viruses and there is no sound reason why Mac users need to be concerned about protecting Windows users from viruses.

Absolutely wrong. There are many reasons Mac users should be concerned about their Windows brethren.

Windows viruses usually show up in one of two ways on a Macintosh. First, they can show up as an e-mail attachment to a message sent out by a Windows virus on a Windows computer. In this case, the attachment won't run on your Macintosh and it will open (if at all) as just a mess of code. Since a Window virus can't run on a Mac, it cannot re-e-mail itself out from a Macintosh (i.e. it cannot be self propagating). Such a virus will be easy to spot and just trash. There is little to no chance of spreading such a virus to a Windows using colleague.

Wrong, wrong, wrong. Parallels, Fusion and VirtualBox all allow you to run Windows on your Mac, and if you have shared folders enabled in any of these programs, your chance of infecting your virtual machine (and then having the virus spread to other Windows colleagues) is very real and very possible. Sure, you can stop it in the virtual machine with anti-virus software, but you could potentially stop it earlier on the Mac side.

The second common way to get a Windows virus on your Mac is to receive a Word or Excel macro virus as part of a Word or Excel document that someone sends you. You should have "Macro Virus Protection" turned on in the preferences of both of those applications, which will keep any unidentified macros from running. Documents with unidentified macros should never be sent to others.

Really? Does grandma know that? Does the guy who just bought his Mac know that? Do those people even know what a "macro" is? It's a big mis-step to assume that everyone is on a level playing field in terms of computer knowledge.

In any case, any Windows user who isn't running good, meticulously updated anti-virus software to protect _themselves_, deserves any viruses they get. There are literally over 180,000 Windows viruses!
http://vil.nai.com/vil/default.aspx
Windows users should protect themselves. They shouldn't have to rely on Mac-using colleagues to use AV software to protect them from the miniscule possibility of receiving a Windows virus from a Mac user. Windows viruses are Windows-users' responsibility.

While I know you hate my analogies by now, saying that is like saying that the person getting mugged in the back alley should protect themself and you shouldn't be bothered to make a phone call or do anything about it. Pure laziness. You're on the internet, and as much as you'd like to believe that there is nothing but Macs on the internet and we're just in this little, tiny corner of the internet where no other operating system can permeate, that simply isn't the case. Insinuating that you could possibly, willingly pass on a Windows virus and the next guy in line should be the one to catch it and deal with it is just pure laziness and goes against the whole "global community" mindset that the internet embodies.

[VirtualTracy]

Originally Posted by Randy Singer

I'm the head of a Mac user group with overe 7,000 members. I don't think that you are going to find anyone who is more in touch with a larger number of actual, ordinary Mac users.

I must admit I'm suprised that with the above 'credentials'(which to me personally are both impressive & meh-ish at the same time), that you would ever attempt to deliver what could be construed by a good many forum folk as a "below the belt" blow:

Originally Posted by Randy Singer

Oh, good...a "security expert." One of my favorite types of people. You wouldn't be inclined to tell folks that they need to be worried about malware when they really don't need to be, would you? Just because your job depends on your doing so...?

[Randy Singer]

Originally Posted by ElDiabloConCaca

The fact that your 7,000-strong Macintosh-using congregation...

Actually, if you go back and read what I said, you will find that I am in constant contact with somewhere in the tens of thousands of Mac users. I'm not trying to be vainglorious in pointing that out, I just don't want it said that my experience with Mac users isn't significant. I believe that I am in a really good position to know what is happening among Mac users, and to be able to authoritatively made generalizations about it.

Originally Posted by ElDiabloConCaca

hasn't gotten the DNSChanger Trojan doesn't change the fact that more than one user here has gotten it. Like I said, people do win the lottery, and when messing around with viruses, statistics downright stink.

The fact that one person has experienced something doesn't mean that anyone else is likely to.

I once heard on the news in Florida that a man was eaten by an alligator on the way to work. Yet I don't propose that anyone needs to carry alligator repellant with them on the way to work. Even though it once *did* happen.

Originally Posted by ElDiabloConCaca

Tell that to the guy who won a million dollars, and tell that guy who got the DNSChanger Trojan that you don't believe him because 7,000 other people didn't.

Who said that I don't believe him? I didn't. I believe him, even without having read his post(s).

But then again, I've only ever heard first-hand of two people having encountered this Trojan. Two out of let's say tens of thousands is pretty long odds.

Since Trojans don't self-propagate, and since disseminating one can land you in prison, the sociopaths who spread them around have to do so in an anonymous environment where folks are willing to download things knowing that they aren't safe. Usually this is on a peer to peer file-sharing network, downloading pirated software, but it has also been known to occur sometimes on an anonymous Web site.

The thing is, once one person encounters a Trojan, the avenue through which they encountered it is usually quickly closed. Usually the offending Web site is shut down, or the file/user is removed from the peer to peer network it came from. Also, users are alerted as to how this Trojan is disseminated, and they learn to avoid it. That means that the Trojan in question no longer has any means of spreading. The Trojan's creator, if they are at all smart, then lay low to avoid capture. As a result, instead of becoming more and more prevalent, like a virus, the Trojan usually quickly disappears.

So, given an initial tiny distribution, and the lack of ability to self-propagate, how likely is it that another Mac user will encounter a given Trojan? Infinitesimal. Some Trojans infect less than a dozen users before they disappear and are never seen again.

Originally Posted by ElDiabloConCaca

The bottom line is that we have differing opinions on the matter of virus protection on OS X. You seem to think that whomever contracts a virus deserves it (at least on the Windows side)

No...I didn't say that. That's an egregious distortion.

What I said was that any Windows PC user who does not protect themselves by using AV software deserves what they get. There are over 180,000 Windows viruses. Anyone who isn't living in a cave knows that viruses are a huge threat to Windows PC's. Most new PC's even come with AV software installed. Vista includes it. Salesmen are dying to sell it to you. You fail to run AV software on a Windows PC at your own peril. There is no reason for Mac users to have to be concerned about Windows malware, it is every Windows user's responsibility to protect themselves. When someone shirks their responsibility, what do they expect will happen?

Originally Posted by ElDiabloConCaca

I, on the other hand, seem to think that people should be educated on the matter ("feed a man a fish vs. teach a man to fish"). If they attain the education level where they're comfortable running OS X without virus protection, all the better.

I agree wholeheartedly. People should be educated about Mac malware. They should be told that they don't need AV software and that they can easily avoid malware targeted at the Mac and they should be told how to do so. "Educating them" that they need AV software is simply spreading FUD.
(Fear, Uncertainty, and Doubt.) That is contrary to the way Mac users do things.

Originally Posted by ElDiabloConCaca

If they know not what's out there and are paranoid, virus protection is good.

No, *paranoia* is bad. I prefer to help Mac users get past being paranoid by educating them to the fact that there is no reason to be paranoid. You seem to prefer to tell them to purchase expensive software that they don't need to assuage their paranoia. I don't consider that to be doing them a favor.

Originally Posted by ElDiabloConCaca

I, for one, am not under the assumption that I shouldn't be worried about passing viruses on to my Windows friends... I have many Windows-using friends that are not "technologically advanced" and don't know what to look out for.

Unlike Mac users, Windows users don't need to look out for anything. They simply need to run AV software. As I explained above, they can't miss the need for this. Newbie’s and even backward users can't miss this.

If every Mac user in the world started using AV software, it wouldn't make even a tiny dent in the malware threat to Windows computers.

If a Windows user goes without AV software, they are going to be infected with viruses, no matter what Mac users are doing.


Infected In Twenty Minutes
http://www.securityfocus.com/columnists/262

Over 91% of computers running Windows are infected with Spyware!
(According to a study by the National Cyber-Security Alliance.)
http://phx.corporate-ir.net/phoenix....958&highlight=


The reality is that Windows users *have* to use AV software. Given that they should be protecting themselves, why do Mac users have to be protecting them too, and from a virtually non-existent vector of infection? And especially when there is no other significant threat for which Mac users need to purchase AV software? Purchasing AV software to protect Windows users simply doesn't make sense.

Originally Posted by ElDiabloConCaca

To point fingers and laugh in his face when he tries to look up some porn in a lonely moment and contracts a virus would be downright mean, not to mention judgemental.

Another ridiculous distortion of what I said. (And a rather disturbing one.)

Want to know what's mean? It is mean of you to tell your friend that he needs to purchase AV software for about $100, when you should instead be telling him that he simply needs to avoid downloading video codec’s offered by such Web sites, to remain safe.

Originally Posted by ElDiabloConCaca

And you're right -- paranoia is no indication of a conspiracy... but hard evidence is, and by the scientific method, one instance of evidence to the contrary disproves the idea.

One instance of a person coming into contact with a specific Trojan Horse, by the scientific method, does not indicate that any other person, *ever* will come into contact with that Trojan.

You can disseminate all the FUD that you like, but that doesn't mean that there is any significant threat. When you can provide evidence that out of 30 or 40 million Mac users out there, that more than a tiny handful of them have come in contact with this Trojan, or that after a certain point in time *anyone* has come in contact with this Trojan, then I might concede that users need AV software to protect themselves from it.

Otherwise you are just talking about the need to carry alligator repellant with you on your way to work.

Originally Posted by ElDiabloConCaca

The fact that one person on this forum has been the victim of the DNSChanger trojan is evidence that it's "out there" and that there is a possibility of infection...

As I said previously, there are a small number of Trojans for the Mac. But I also said that they are incredibly rare, and I'm sticking by that.

Feel free to check with any of the malware tracking services and tell me which Trojans have more than a tiny distribution...

http://secunia.com/product/96/#advisories

McAfee: http://vil.mcafee.com/

Symantec: http://www.symantec.com/avcenter/

F-Secure: http://www.f-secure.com/virus-info/
http://www.f-secure.com/v-descs/

Sophos Virus Analyses:
http://www.sophos.com/virusinfo/analyses/
http://www.sophos.com/virusinfo/

Symantec Enterprise Security Response:
http://securityresponse.symantec.com...ter/venc/data/

SecurityFocus: http://www.securityfocus.com/archive/

Originally Posted by ElDiabloConCaca

am I saying that everyone should run out and get virus protection on their Mac? No, most definitely not.

Exactly.

Originally Posted by ElDiabloConCaca

Am I inciting paranoia to further my own well-being and career? Nope. Am I backing up Apple in saying that virus protection may not be a bad idea?

You betcha.

An intelligent person would ask some questions before taking this "advice."

- Why is Apple suggesting this?
- Has Apple referenced a specific threat that I need to be concerned about?
- What specific threats are there?
- How common are these threats?
- Is there a downside to running AV software?
- What advantage in the here and now will I gain from running AV software?
- How often have other Mac users encountered malicious malware?

I believe that the answers to these questions would lead most ordinary Mac users to the conclusion that they don't need AV software at this time.

Originally Posted by ElDiabloConCaca

But that's up to the user to decide -- not you or I. I never said people should run virus protection -- I recommended it for those who are paranoid and/or worried.

How stupid do you think that Macintosh users are? I think that they tend to be pretty bright. The Macintosh Way is for Macintosh users to educate and help each other. I don't think that there are any Mac users who are too stupid to understand the simple ways to avoid the tiny and very rare amount of malware that is out there. Why not just do so instead of telling them to get expensive AV software that they don't need? (In fact, even if they are rank newbie’s, I think that it is still incredibly unlikely that Mac users will encounter any malware, ever.) If they are so stupid that they can't be educated, maybe they shouldn't be using a computer at all? Because its just not that hard.

Originally Posted by ElDiabloConCaca

You, on the other hand, have decidedly suggested to ignore this information and evidence and suggest that no one should run virus protection on their Macs... which I wholeheartedly disagree with.

Where did I say that "no one" should be using AV software? I said that ordinary Mac users didn't need AV software. I believe that several users should have it.

People who run a business where their client files, or their data, is extraordinarily important and who might incur liability if it was lost or damaged, should run AV software, if for no other reason than that it would look bad not to. (e.g. doctors, lawyers, financial consultants, etc.) I run AV software for just this reason. (Imagine being sued and telling a jury that you lost your irreplaceable files because your computer is a Mac and it doesn't need AV software. Even grandmas on a jury have heard that all computers get viruses.)

Network servers should have AV software as a best practice.

People who regularly engage in risky computing practices with impunity should probably consider AV software. (Pirating software can expose you to pirates. Engage in immoral acts and you will often be exposed to other immoral people who don't have your best interests at heart. That's how life works.)

But this is a very short list...because the threat just isn't there to justify the need.

Originally Posted by ElDiabloConCaca

Wrong, wrong, wrong. Parallels, Fusion and VirtualBox all allow you to run Windows on your Mac, and if you have shared folders enabled in any of these programs, your chance of infecting your virtual machine (and then having the virus spread to other Windows colleagues) is very real and very possible.

I was concerned about this when virtualization first became available on Intel-based Macs. So I asked some experts, like the Parallels folks, and others. They said that it isn't a problem. They must have been right. I've never heard of a Mac user's Mac side infecting their Windows side. (Show of hands...who here has had this happen?

That's just more FUD.

Originally Posted by ElDiabloConCaca

Really? Does grandma know that? Does the guy who just bought his Mac know that? Do those people even know what a "macro" is? It's a big mis-step to assume that everyone is on a level playing field in terms of computer knowledge.

Does grandma use Office? Why did she purchase Office when she could have purchased iWork for half the price? iWork may have even come on her new Mac for free.

Does grandma expect to learn to use Word and Excel without training? If so, that won't work very well. I expect grandma to have to have some training to learn to use Office before she can use it at all. When she learns how to use Office, I expect her to learn about macros and macro viruses as it becomes relevant to her.

Sending grandma out with a new copy of Office, with no training, and telling her that purchasing AV software will make it all safe, instead of just telling her to turn on Macro Virus Protection in Word and Excel's preferences, is...um...unconscionable. Is this really what you are arguing for?

Originally Posted by ElDiabloConCaca

While I know you hate my analogies by now, saying that is like saying that the person getting mugged in the back alley should protect themself and you shouldn't be bothered to make a phone call or do anything about it. Pure laziness.

Actually, to use your analogy...I would not only call the police, I would go and physically assist the person being mugged.

But later, after it was all over, if I find out that this person was walking all by themselves, at night, down a dark alley, in a bad section of town, I would, of course, say "What the heck did you expect?"

A better analogy would be that this person went for a walk, at night, in a bad section of town, down a back alley expecting that they would be safe because everyone else in the world should be watching after them to protect them. The world doesn't work that way. You have to be intelligent and protect yourself. Just as Windows users should be protecting themselves.

Let me give you an analogy of my own.

In a perfect world we would all wear facemasks to protect everyone else from the possibility of our spreading airborne germs. We would also carry around our own porta-potties, to make sure that no fecal-oral transmission of disease (a very common vector) could occur by using shared bathroom facilities. Transmission of communicable disease would drop significantly if we did this.

But we don't do that. We are willing to accept some level of risk to trade off against making others (and ourselves) endure some inconvenience and expense.

Originally Posted by ElDiabloConCaca

You're on the internet, and as much as you'd like to believe that there is nothing but Macs on the internet and we're just in this little, tiny corner of the internet where no other operating system can permeate, that simply isn't the case. Insinuating that you could possibly, willingly pass on a Windows virus and the next guy in line should be the one to catch it and deal with it is just pure laziness and goes against the whole "global community" mindset that the internet embodies.

I'm very impressed by your desire to protect our Windows brothers. Really. It's nice.

Now let me ask you...do you wear a facemask to protect your spouse and children from the possibility that they might get a cold, or nasty flu, from you? Wouldn't you feel just horribly guilty if they got sick because of you?

You don't wear a facemask at home, do you? Why not? I'll tell you why. Because we put just about everything that we do through a risk/benefit analysis. You have decided that wearing a facemask all the time around your loved ones is too much of an inconvenience. You are willing to expose them to your germs, and maybe a nasty cold or flu, or worse, that you are a carrier of, just for a minor advantage in comfort.

And you know what? The chances of your transmitting a disease to your family is quite a bit higher than you using your Mac and giving a virus to a Windows user. In fact, I'd be willing to bet anything that you have done the former many times, and that you have never done the latter.

Purchasing AV software to protect Windows users doesn't even come close to meeting a risk/benefit test. AV software is expensive, it can slow your Mac down, it can cause conflicts or instability, it is currently unnecessary to protect Mac users against any significant threat, and Windows users should be protecting themselves. Recommending that Mac users need AV software to protect Windows PC users is indefensible. There is no logical argument that makes it so.

[Randy Singer]

Originally Posted by VirtualTracy

I must admit I'm suprised that with the above 'credentials'(which to me personally are both impressive & meh-ish at the same time), that you would ever attempt to deliver what could be construed by a good many forum folk as a "below the belt" blow:

Sorry, you may be right.

Some background.

First, I absolutely HATE IT when folks spread FUD among Mac users. I'm a very long-time Mac user and maybe I'm an anacronism, but I still remember when Mac users all went out of the way for each other and we were a tight-knit community. Computers are scary enough to most people, they don't need to hear folks spread pernicious untruths about about their computer on top of that.

I really don't like to see folks spreading falsehoods, even if they are pro-Macintosh falsehoods, to Mac users about the Mac. I think that Mac users should have the unbiased-as-possible facts. (In Mac vs. PC debates I'm always quick to point out that the PC has several huge advantages over the Mac. In malware discussions I'm always quick to point out that there *is* malware for the Mac, even though many Mac users stubbornly cling to the belief that there is absolutely none.)

Second, I've seen an influx into the Macintosh press lately of "security experts." These folks claim to be Macintosh enthusiasts, but like anyone who has been trained in a particular field, they tend to see their specialty as having a big place in any landscape.

So I've been reading articles by security experts in Macworld and TidBits that Mac users all need to have AV software installed. And I'm wondering which actual Mac users these idiots talked to? While the subject of viruses comes up all the time in discussion groups and in user groups (mostly because switchers from Windows have a hard time letting go of their paranoia about viruses), no one has reported encountering any malware.

The only time that anyone ever reports encountering malware is when a newbie switcher has a corrupted preference file, or the like, and they just assume that they must have gotten a virus.

Obviously, with the huge influx of new Mac users these past couple of years, mostly former Windows users, the Mac world has changed. Where most users previously would have networked their Macs themselves in just a few minutes, there are now computer consultants telling Mac users that it would be too hard to do themselves. Where most users would have previously been happy using a Macintosh application, with a Mac interface, to do things, now many users are being told that a Windows application running in Parallels is the "standard."

In short, there is a huge amount of Windows FUD that is creeping into the Macintosh world. I guess that I could sit back and just watch as people buy AV software for no reason, hire expensive consultants to do something that a nine year old could do in a few minutes, and run Windows programs with their ugly interfaces without even looking at the elegant Macintosh offerings.

But I guess that I'm too old-fashioned to sit by silently and accept this.

By the way, I'll be speaking on the topic of Macintosh malware at next January's Macworld Expo. January 6 at 1PM in the User Group Lounge. No extra charge to attend. Please come by and say hello if you are attending MWX, even if you don’t intend to stay for the presentation.

[Randy Singer]

Originally Posted by ElDiabloConCaca

Am I backing up Apple in saying that virus protection may not be a bad idea?

You betcha.

Apple has removed the support page (in which they recommended using AV software) cited recently in the press, saying it was
old and inaccurate.

http://www.macworld.com/article/1372...usremoved.html

[fryke]

You spammin'? I mean: This discussion is going quite out of hands, I find.

[Rhisiart]

The debate is becoming a bit acrimonious. Having a passionate viewpoint is one thing, but it has become a little too personal. Randy, ElDiabloConCaca has contributed much to this forum over the years and I am sure many users (like VirtualTracy and myself) are a little disappointed by your personal attack on him.

Putting that aside, it is interesting to read both of your contributions. I use anti-virus software because I am paranoid. Period. Even if there is a tiny risk of being exposed to a Trojan (and I don't surf porn sites) I think something like Intego's Netbarrier is worth the cost (I hope I am not spamming here!).

I agree with Randy's view that Windows users should at least understand that PCs require anti-virus programmes, that are updated regularly. That seems to be a very basic requirement of using a PC at home. However, I doubt many users understand macros.

I used to be a Boy Scout and our motto was 'Be Prepared'. At the risk of sounding gloomy, I suspect Mac viruses are on their way (but when?). Better to be safe than sorry.

Yours truly,

Rhisiart "Paranoid" Jones of Wales

[fryke]

(I didn't mean "spamming" the way one usually does, i.e. to promote a product. Rather I meant he was "spamming" the thread with lots and lots of messages. Three posts in a row? Just edit the first one if you have something to add.)