Blog Post

Security Exaggeration or Real Threat: Is This the End of an Apple Era?

Stay on Top of Enterprise Technology Trends

Get updates impacting your industry from our GigaOm Research Community
Join the Community!

badbotnetSecurity scares seem to be coming up all too frequently for Mac users these days. First, there was the devastatingly fast hacking of a Mac thanks to a Safari exploit at PWN2OWN, and now the first-known botnet to exploit OS X appears to have been activated, according to two security researchers at Symantec. If true, it means the sense of security and superiority that so many Mac users maintain over their PC-using counterparts might be coming to an end.

The botnet is a result of users having downloaded and installed pirated copies of iWork ’09 way back around the time of its initial release. Accompanying those pirated versions was a trojan called iServices, a variant of which was also packaged with a pirated copy of Adobe Photoshop CS4. iServices remained dormant until just recently, when it was implicated in at least one Denial of Service (DoS) attack. Though the install base of the trojan is at present not large enough to pose a major threat, the researchers warn that this is likely only the beginning.

Symantec researchers suspect that software piracy will only trend upwards as the economic crisis continues, which is a very good thing for opportunistic hackers. The easiest way for them to distribute their malicious code is via pirated programs, since they aren’t QA’d or regulated in any real, consistent way. And if Macs continue to increase their presence, hackers will begin more and more to target OS X users, because it makes financial sense from their standpoint to do so.

In response to the report, network security firm McAfee, another anti-virus maker, spoke up. They claim that there’s nothing new about the iServices trojan that wasn’t already apparent and active in January, and that it represents only a low level of risk now, just as it did then. In other words, they think Symantec is blowing things out of proportion. Not that they’re saying you should just relax and pretend nothing’s wrong. Far from it.

Instead, the solution offered by both the Symantec team and McAfee is the one you’d likely suspect: install anti-virus software in order to protect your computer. And it may be the best solution, although after years of running both Windows and Mac machines without any virus protection that wasn’t built into them, and with no major issues to report at this time, I’d say that safe and intelligent browsing (i.e., don’t download risky pirated files) is still your best bet for avoiding these kinds of attacks, Mac or not.

34 Responses to “Security Exaggeration or Real Threat: Is This the End of an Apple Era?”

  1. vincent Hayden

    Let’s just go yell fire in crowded movie theatre! The Martians have landed in Laguna beach! Have any Macs been compromised or not? We’ve already got the pharmaceutical company creating new diseases they’re not working to prevent or cure us of. I own a Mac and Pc and have had no problems, but I also follow common sense principles – some of which are mentioned afore.

  2. Jack'of'InTosh

    I hope people find exploits and bring Mac and Apple to real world! Mac are extremely overprice computers. I can buy a superior machine with superior graphics card and tons of software for same price as a Mac. Plus, I could buy dinner for 2, movie and coffee too.

  3. ha ha this is funny im not a mac user or a mac fan and i wish the worse for all mac users and mac fans but seriously if u download a pirated program the first thing you should do is test it else where and kno that duhh there r risks its pirated i mean i got tons of pirated software never try it on my machine first
    and if u check windows users it usually ones who r not savvy who get viruses
    mac users u should be afraid why because appl never tell you about a problem first hand they tell you after they fix it which means you could have been vulnerable for a long time and didnt even kno but im not a mac user so i dont really kno how apple does its thing i jus use windows cus thats what i kno i tried to convert to macs worst 4 months of my life did not kno where anything was couldnt even turn on the camera on the plus side dream weaver look sexy on os x but cs4 looks better on windows i get tired of that one same color theme on os-x if there is a way to change someone please tell me

  4. ruffmac

    After reading the blogs here, two trends emerge:
    (1) Many bloggers are semi-illiterate. Can’t spell, can’t write what they mean, insert apostrophes where they don’t belong, etc. etc. Which impeaches their degree of knowledge. Why trust someone who writes bad English?
    (2) Some bloggers are just plain wrong. Why? Because they know not what they discuss.
    E.g., Astrochimp knows nothing about installation of applications on a Mac, but he pretends to know something. Ignore him.
    Another example: blinkdt says, in effect, there is no secure web browser for the Mac. Wrong again! And he is arrogant! He says he builds systems. Does he build enough systems to supply the millions of users who cannot build their own system? If he did, what price would he charge them? (Remember, he would then have to provide warranty support, phone support, pay salesmen, pay for stores and their maintenance, etc.)

    THE FACT IS that the Unix-based Mac OS is vulnerable to attacks. However, one glance at the Secunia web site ( shows that most vulnerabilities are patched (vendor provides software update – patch – that fixes the vulnerability).

    Microsoft Vista: 30 advisories in 2008, 4 in 2009
    2008: 3 out of 30 are marked as unpatched with the most severe being rated Less critical
    2009: none unpatched
    Apple OS X: 12 advisories in 2008, 3 in 2009 (all but one are patched)
    2009: 1 out of 3 are marked as unpatched with the most severe being rated Moderately critical
    2008: none are unpatched

  5. Notromeel

    @ blinkdt

    I just think it’s simple. (i’ve owned both platforms)

    When I’m on my Mac, I have so much more time to actively work. On my PC, It became very bogged down with updates, patches, viruses and spyware.

    I just get on my Mac, and it works :)

  6. Windows User

    You will only get this virus if you download illegal.
    Stop downloading, it will ruin your computer.
    No-one gives away software for free, even the crackers need to earn money.
    Without viruses, they can’t sell virus scanners.
    Don’t download illegal and you are safe.

  7. “Instead, the solution offered by both the Symantec team and McAfee is the one you’d likely suspect: install anti-virus software in order to protect your computer.”

    So would you not have got this ‘virus’ if you had their software installed & will their software remove this threat if you install it now?

    There have always been exploitable flaws with OS X like any other software, but I have yet to see any anti-virus/spyware/rootkit software that claims to be able to protect you & clean your system of all the potential threats.

    Then again as most of these are non-replicating threats they have not seemed to been a big problem. But a good report on all the main threats and what tools are best at protecting/cleaning your system seems long overdue.

  8. @blinkdt
    The minimum configuration mac pro makes that computer look like trash. Try to beat the specs of this mac i use for work.
    Two 2.93GHz Quad-Core Intel Xeon (nehalem) Aka Server core i7, which you cant even buy on new egg yet..
    32GB (8x4GB) DDR3 EEC Ram
    1TB 7200-rpm Serial ATA 3Gb/s
    1TB 7200-rpm Serial ATA 3Gb/s
    1TB 7200-rpm Serial ATA 3Gb/s
    1TB 7200-rpm Serial ATA 3Gb/s
    4x NVIDIA GeForce GT 120 512MB (thats right four graphics cards, and can run 8 displays.
    Two 18x SuperDrives
    Ill be surprised if you can build anything close to this for any price. The mac pro is the only macintosh that follows the traditional pc design and is thus the only one comparable to a custom built system. Also the iMac is for those who dont want the computer to use all their desk space.

  9. blinkdt

    @Mike Jones

    I know what an iMac is, my friend. I guess the question is: why would anyone dump that kind of money into a mediocre system with minimal expansion capabilities? ‘Cuz it looks purdy? Cripes, my Dell studio 1735 (2.5GHz T9300/4GB RAM on x64 Vista Business) is configured better than that, with blueray/HDMI/two 7200 RPM Seagate Momentus hard drives and a 24″ Samsung in portrait mode to boot. Let’s throw in an Intel flash cache module, some Creative speakers, a headset, and a Microsoft Arc mouse and I still had a nice night on the town with the hundreds I didn’t pay on the “Mac Tax.”

    And it’s a “motherboard,” you twit, no matter what one company decides to call it after the fact. Stop confusing the children.

  10. Mike Jones

    @ blinkdt

    don’t make everyone laugh. building a case similar to the iMac would set you back $240,000 for the first unit alone, then you’d have the engineering expense to fit a core duo 2 logicboard, 24″ screen, hd, optical, 802.11n, bluetooth, firewire 800, 5 usb, video, optical audio in/out, camera, speakers, etc into that case. so another $200,000, so that first unit would set you back $440,000! NOT $1,200

    sounds like you don’t know what you are talking about. you didn’t even look to see what an iMac is. so no wonder you can’t build one for less.

  11. blinkdt

    You’re right, Monster. “The best way to obtain [malware] is to use a browser that is full of holes,” e.g., Safari, the worst of the worst. I use IE 8, infinitely more secure, thank you very much. Oh, wait, I forgot . . . you can’t use it, can you? So you really don’t know, do you? But you just keep sayin’ it’s “full of holds” and maybe one day it might come true.

    “Compair your costs also buddy you 24 inch iMac starting at 1200$ with everything DDR3,wirelessN, Bluetooth, iSight camera I could go on . Try to build a pc with what a iMac comes standard with at the price of 1200$ good luck buddy!!”

    Are you kidding? Is that a joke? I’m a system builder, pal. Give me $1,200 and I’ll build a system that blows you iMac out of the water, like shooting a mosquito with a bazooka! Kawoosh!

    An iSight camera? Oooooo, goody. I think I’ll pass. I wouldn’t build a system today unless it included Blueray and HDMI support (hint: think home entertainment, after the work gets done). Anything less is just, well . . . Apple.

  12. Astrochimp: you say windows is more secure by having all these pop ups asking you if you are sure you know what you are doing. As for your software and it’s digital signiture that’s great that you need that to know what you are installing is safe. I’ve always used common sence if I don’t know what it is or where It came from don’t install it.

    The best way to obtain a virus is to use a browser that is full of holds (I.E8) or a email client that doest provide a built in layer of security.

    Know how to control your browser and it’s security setting and also your email client . You will be fine.

    What you are doing on a apple blog supporting windows and talking about how hard osx will fall is beyond me.

    You just continue to run you pc and your norton and wonder why you computer runs like shit. Do alittle more reasearch before you come here. Start by looking up the side by side benchmark06 pc vs mac. Sorry to tell you but windows even runs better on a mac at native speeds.

    Compair your costs also buddy you 24 inch iMac starting at 1200$ with everything DDR3,wirelessN, Bluetooth, iSight camera I could go on . Try to build a pc with what a iMac comes standard with at the price of 1200$ good luck buddy!!

  13. Astrochimp

    There’s a hole in the Apple, dear Liza, dear Liza,…

    This kind of attack would be theoretically thwarted in Vista, if the users were paying attention to the security warnings that come up.

    On Vista, if an application requires admin access (to e.g. install software) the publisher of the software, by secure digital signature, is identified OR lack of a publisher.

    On Apple OSX, there is no such information presented.

    So, on OSX, I could install software that has no digital signature i.e. it couldv’e been hacked by ANYBODY, and if I didn’t go to a lot of extra and highly technical steps to check, I’d never know.

    This is just one of the ways in which Vista is more secure than OSX. And Windows 7? Better.

    IMO, Apple will never catch up to Microsoft in security. Apple will continue lying about how their OS is more secure, and enough people will buy it to buy there expensive hardware.

    Apple’s advantage related to security is obscurity, nothing more. Obscurity is not security.

    The question I’ve been posing for years is not IF Apple will fall, but how hard.

  14. Although its true the mac fell quickly during the PW2own contest it must be understood that the hacker former NSA security analyst Charlie Miller spent a lot of time before the contest preparing his exploit as seen in Toms Hardware interview:

    CM: “Yes, I took down the Mac in under a minute each time. However, this doesn’t show the fact that I spent many days doing research and writing the exploit before the day of the competition”

    Charlie Miller is also apparently a Mac User.

    CM: “I don’t know what I’ll do with my new MacBook Pro, but I definitely won’t retire my trusty MacBook.”

    And as for which OS he recommends:

    “I’d still recommend Macs for typical users as the odds of something targeting them are so low that they might go years without seeing any malware”

    Mac security in general:

    CM “I’d say that Macs are less secure for the reasons we’ve discussed here (lack of anti-exploitation technologies) but are more safe because there simply isn’t much malware out there.”
    Security issues with mac have been hyped up recently by certain parties, there are concerns but no doubt Snow Leopard coming in few months will improve mac security.

  15. Meh. I’m not too worried about this. I don’t download crap, and I know how to stay alert about what my computer is doing. That’s really the biggest threat for any computer user be they a Mac user, or Windows user — not keeping track of what is happening on their computer. I have seen so many people click past errors and alerts that are actually displaying useful information about the problem that they are experiencing. Those same people seem to download an asshole of crapware, and then wonder what went wrong with their computers. Such things just produce more demand for my services.

  16. that is so very true in the late 80s the Government spent a shit load of time and money building a system that they thought would be 100% solid as a rock crash proof.

    Some joe shmo came in and broke the damn thing down in 24 hour what took them years to build.

    key is learn how to use a computer before you start doing shit you dont understand and just keep and eye on whats your installing, opening, web sites you visit and get a traffic monitor learn your ports and protocols and you can protect you self very well with and not have to spend a shit load of money for a anti virus that people write viruses to get around (symantec,Norton) and that slow your computer to a crawl !! even PCs have a bit of built in security learn how to use it even though it might be crap :)

  17. I can’t understand why some folks insist on discounting such threats on the basis that the Mac is so secure, no one can break it. Bottomline is as long as the security system was designed by a human being, someone can and will find a workaround. Might not be today, but it will happen. The worst thing you can do is discount the threat.

  18. not to worried this is just a ploy some guy over at symantec and mcAffe decided to come up with reason being that there internet security sucks and no one is buying it so they needed a quick way to generate some revenue.

    They saw that Macs are becoming a trend and thought they needed to expand there market soon they will come up with a story that redhat has a treat out and tell us all that we need to do is buy there product to be safe.

    it all comes down to if your gonna use some software you didnt pay for borrow it from some one who has , if you dont know what the program is dont install it, if you dont know who the hell is sending you that email that says i want to give you a million dollars dont open it (know one is giving away that much money) if you are on a web page and somthing pops up and says install me i will make all you dreams come true, reboot your computer dont be a dumb ass and click on it.

    Mac over PC and it will stay that way. you can tell me that its gonna explode in my hand when i get this virus. i will not buy some shitty anti virus .

  19. Yeah, yeah, yeah. We keep hearing about all the “threats”, but not a single one of them has actually been “real” has it? They’ve all been “someone could” or “someone might”.

    The Mac community still isn’t worried.