Forgot your password?
typodupeerror
Security Businesses OS X Operating Systems Apple

Apple Quietly Recommends Antivirus Software For Macs 484

Posted by timothy
from the wear-your-rubbers dept.
Barence writes "After years of boasting about the Mac's near invincibility, Apple is now advising its customers to install security software on their computers. Apple — which has continually played on Windows' vulnerability to viruses in its advertising campaigns — issued the advice in a low-key message on its support forums. 'Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one application to circumvent, thus making the whole virus writing process more difficult.' It goes on to recommend a handful of products." Reader wild_berry points out the BBC's story on the unexpected recommendation.
This discussion has been archived. No new comments can be posted.

Apple Quietly Recommends Antivirus Software For Macs

Comments Filter:
  • a way to make money (Score:4, Interesting)

    by Bizzeh (851225) on Tuesday December 02, 2008 @09:00AM (#25958635) Homepage

    is this a scare tactic for apple to push some payfor software and get people to buy it. or have apple started to loose confidence in their operating system? or even worse, do they know something we dont? are they expecting an attack?

    • by bytethese (1372715) on Tuesday December 02, 2008 @09:04AM (#25958685)
      It does sound like a possible "setup". Macworld 2009 debuts new AV software? Who knows. Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts? After all, Mac does seem to be gaining market share year by year.
      • by YttriumOxide (837412) <yttriumox@gmai l . com> on Tuesday December 02, 2008 @09:17AM (#25958865) Homepage Journal

        Maybe the Mac has starting to reach that point where virus writers and security aficionados have enough a base to target their efforts?

        Perhaps, but I am still waiting to see a real "virus" that hits MacOS. There's been a few trojans (such as the one mentioned in TFA), but nothing that qualifies as a virus yet as far as I know. It is likely much harder to write a real virus (rather than a trojan) for MacOS than Windows as you'll need to find a privilege escalation exploit (need I say, without local access) in one of the standard services first, all of which tend to be pretty robust and having a core that comes from the open source and Unix worlds... as far as I know, there aren't any such exploits known right now.

        Trojans can of course still be fairly nasty, as there's a lot of stupid users in the world (of any OS)

        Disclosure: I do use MacOS X as my primary OS at home, but I'm definitely not a "fanboy" (I also have Linux systems at home and use primarily Windows at work - I consider myself "OS agnostic").

        • by CFTM (513264) on Tuesday December 02, 2008 @09:29AM (#25958981)

          I don't know why you want to wait, it will happen in time. This is not meant as a critique of Apple in anyway, I am of the belief that over a long enough time frame, with enough market penetration, Mac viruses will become more common. It's not that Macs are inherently that much more stable, rather the market penetration is such that it makes more sense for people creating malicious viruses to focus on the PC instead. Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

          I also would wager that the Mac OS is probably a bit more secure than Windows, because well, it's Windows...that being said if there's enough code there will be mistakes that can be exploited that's the nature of the human element.

          • by mario_grgic (515333) on Tuesday December 02, 2008 @09:40AM (#25959175)

            I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

            If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

            UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

            • by deraj123 (1225722) on Tuesday December 02, 2008 @10:00AM (#25959459)
              Except the GP didn't say that it was easier to break into the system - he said that more people are going to try. I think he neglects to mention an underlying assumption that no software is perfect, and given enough time and effort, the chances of finding a security flaw that can be exploited is greater than zero in ANY piece of software. While this assumption won't always be true, it's completely reasonable for us to make it when considering the security of our systems - for we don't really have any way of disproving it for any particular piece of software.
              • by Ostracus (1354233)

                Agreed, however this is still news because the platform is under such control by Apple. They could quietly and easily put not only hardware and software in place. But implement more effective procedures in their software process to make security tighter. And we wouldn't be the wiser.

              • Re: (Score:3, Insightful)

                by vertinox (846076)

                I think he neglects to mention an underlying assumption that no software is perfect, and given enough time and effort, the chances of finding a security flaw that can be exploited is greater than zero in ANY piece of software.

                I don't believe this to be true if enough focus on security is made.

                Software can be made secure at the expense of functionality. Now this doesn't ever solve the problem of local access, but if you made your OS into a glorified terminal server, you can prevent automated attacks by restr

            • by TheRaven64 (641858) on Tuesday December 02, 2008 @10:05AM (#25959539) Journal
              It doesn't when you're talking about manual attacks, but it does for automated attacks. Compromise one Windows machine, and it's trivial to find a load more Windows machines to attack. Compromise one Mac, and it's much harder to find the next Mac to attack.

              UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

              Oh, this just makes me laugh. Operating system the first Internet worm ran on? UNIX. It wasn't until the mid '90s that people started saying 'UNIX Security' without laughing.

              • Re: (Score:3, Interesting)

                by chaim79 (898507)

                Mid 90's? so win 95? how did the security of Unix compare to the security of windows 95?

                Maybe they stopped laughing at Unix security because they found something else that truly showed how bad security could be. :)

            • Re: (Score:3, Funny)

              by Anivair (921745)
              You're wrong. Market share has everything to do with how easy it is to break into a computer. They are, in fact, directly proportional. the easier it is to break in, the bigger your market share. Just ask Debian.
            • by squiggleslash (241428) on Tuesday December 02, 2008 @10:10AM (#25959615) Homepage Journal

              I wish people would stop parroting this fallacy all the time. Market share has nothing to do with how easy it is to break into a system.

              Look at AROS [sourceforge.net]! It has no security whatsoever, not even memory management between processes, so despite only having a hundred or so users, it must have zillions of virusses. But, of course, it DOESN'T. So far as I'm aware, nobody's bothered to write one, and it's unlikely any AROS virus would actually be effective.

              All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

              If you have something like windows where security is bolted on after the fact, and OS that was never meant to be a multi-user OS connected to the internet (all these were added as features later on and done poorly) then you will have a system that is much harder to keep secure.

              UNIX on the other hand was designed from day one to be networked multi-user OS, and security and separation of concerns was there from beginning.

              It's frankly hilarious that Unix, on which the first worms operated, can be held up as some system that had security built-in from the start. It's also untrue that Windows, that is, the operating system known as Windows today, was "never meant to be a multi-user OS connected to the internet". Unless you're talking about Windows Me and its predecessors (98, 95, 3.1, et al), then that's completely false. Current versions of Windows (XP, Vista, 2003, et al) are derived from Windows NT, which was designed, from the beginning, to be "a multi-user OS connected to the internet".

              In fact, Windows NT and its successors have a more advanced security model than Unix, allowing more than a separation of users and groups.

              The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

              There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

              Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

              • by alexhmit01 (104757) on Tuesday December 02, 2008 @11:06AM (#25960513)

                The issue with Windows is two fold. First, marketshare. And second, an over complex user-environment where too much functionality is available on the "user" side of the security wall. Both of these issues affected Unix up until the mid nineties, where its disproportionate share of Internet nodes and the amount of stuff running as the default user (which in Unix was root, which also happened to be the account with the most rights.)

                No, the Windows problem was that to migrate from DOS + Windows shell to Windows NT, was a slow, painful 10 year process with LOTS of growing pains. Windows 4.x series (Win95, Win98, WinME) were supposed to be a singular OS before the transition to NT, and was created because the uptick to NT 3.51 was low because of the RAM requirements. The original plan was 3.1 for home users, NT 3.1 for "Workstations," and Win32s was released to let people target both OSes.

                As we moved through Win 3.11 w/ Win32s -> Win95 -> Win98 -> WinME, the NT systems grew in popularity. Lack of advanced DirectX support prevented NT 4.0's being the transition, Win2K was close but price kept it out, and WinXP finally merged the OSes. By that point, it'd been 8 years or so since the first 32-bit programs came out. The ones targeted mass market, originally Win32s, and later Win95/NT4 libraries, were generally assuming the consumer version. On the consumer Windows, there WAS NO SECURITY model, so it was common for applications to assume lots of access. This meant that while NT 4.0/Win2K gained market share and had the security model from the NT system, the security wasn't used and users had full access to the drive, because the alternative was broken software.

                To not break applications from 1995 - 1998, in the early 2000s we were still shipping OSes with most of the system being world writable.

                So while Windows possessed a security model that could work, in practice, it was never implemented, because it required locking down the system on each system, so instead of protecting OS directories, we used the "bolt on" security like Group Policies, etc., to prevent users from doing things. I worked with a bunch of Citrix systems in the late 90s, and we were able to lock down those machines, because you were only talking about locking down a single machine or two, and the defaults were more reasonable. There was PLENTY of software that wouldn't run under Winframe 1.x/2.x gold (2.0 never shipped, Microsoft pulled the license, then bought it to ship Terminal Server and Citrix moved the addons into Metaframe), not because it required the NT 4/Win95 libraries (we could always confirm that using 2.0 Gold that was NT 4 based), but because it made assumptions about access that was reasonable for Win 3.11/Win95, but not NT based OSes. Citrix, targeting big budget Enterprises could get away with that, Microsoft reaching the entire market could not.

                I assume that this has been fixed in Vista, but I haven't used it, I switched to Mac OS X in the mean time.

              • by _Sprocket_ (42527) on Tuesday December 02, 2008 @11:44AM (#25961175)

                All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

                Fair point. However, Mac OS X has far more market share than something like Aros. We're talking somewhere above 8% of the market right now. That's an appreciable install base and certainly worth targeting. By comparison, the Witty worm [schneier.com] targeted (and infected) an install base of only 12,000 systems. So sure - install base might be a factor. But it is hardly the only one.

                There's little reason to believe that Mac OS X is protected from viruses by anything other than its low market share at this point. There's not a large enough group of users for network effects to take over. It is not an inherently secure operating system. The default user is generally set up with administration privileges, and it just takes a buffer overflow or other ordinary vulnerability in a client application like a web browser plug-in for a virus or worm to have complete access to the user's files, and enough access to be able to modify many of the applications the user is likely to run.

                Fundamentally, Mac OS X has the same problem as Windows, and the same problem the "run-everything-as-root" Unixes did in the eighties and early nineties: too much functionality available to the default user. To fix this, you need to change the model somewhat. The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

                Wait a minute here. Correct me if I'm wrong, but my impression is that the "administrator" setting of an account allowed sudo access. That's a little different than running as root. Is there something else going on in the Mac userland?

                It should also be noted that we've heard these warnings [linuxinsider.com] before. The doomsday scenario has yet to come to pass. And while I agree that some of the perception of imperviousness is misplaced, I am also inclined to believe there's a bit more at work here than some critics want to believe.

              • by LO0G (606364) on Tuesday December 02, 2008 @11:47AM (#25961237)

                Good points all, but I think you forgot one major aspect of the "market share" argument.

                There hasn't been a true "virus" out there in the wild for years (to me, a true virus means self propogating malware - malware that modifies existing binaries and relies on those modified binaries being distributed). Instead there's a TON of malware intended on converting machines into botnet clients.

                The vast majority of malware (maybe as much as 95% or higher) these days is really "crimeware" - software intended to aid in criminal activity (identity theft, click fraud,etc).

                As a criminal, let's say that it's going to cost me $10,000 to hire some eastern european hacker to develop malware for my criminal enterprise (number totally made up). I get to chose which platform I have the hacker target - I can target Windows with 90% of the market, I can target OSX with 8% of the market or I can target Linux with 2% of the market (market share numbers also made up, but probably in the right ballpark).

                That means that if I'm interested in profit (and this IS a criminal enterprise, so profit is the primary motive), I want to have my hacker target the platform with the highest ROI. That means that the hacker's going to go after Windows and ignore OSX and Linux.

                As the Mac's market share increases, it is going to be an increasingly more attractive target for hackers, because the ROI is higher.

                • Re: (Score:3, Interesting)

                  by _Sprocket_ (42527)

                  As a criminal, let's say that it's going to cost me $10,000 to hire some eastern european hacker to develop malware for my criminal enterprise (number totally made up). I get to chose which platform I have the hacker target - I can target Windows with 90% of the market, I can target OSX with 8% of the market or I can target Linux with 2% of the market (market share numbers also made up, but probably in the right ballpark).

                  That means that if I'm interested in profit (and this IS a criminal enterprise, so profit is the primary motive), I want to have my hacker target the platform with the highest ROI. That means that the hacker's going to go after Windows and ignore OSX and Linux.

                  As the Mac's market share increases, it is going to be an increasingly more attractive target for hackers, because the ROI is higher.

                  Sure - market share is one factor on ROI. But it's not the only factor. Another big part of ROI is how long you get to keep control [infoworld.com] of your target. If the target doesn't remain compromised very long, then you've wasted your resources (unless of course you only needed a short window - but that's implying a targeted attack and is beyond the scope of this conversation). The thing is, if you look at malware in the wild [wildlist.org], you'll find that there are plenty of examples for Unix malware but they just don't survi

              • Re: (Score:3, Interesting)

                by nsayer (86181) *

                Windows NT, which was designed, from the beginning, to be "a multi-user OS connected to the internet".

                [citation needed]

                I will grant you that NT was designed to be connected to a network, but I find it incredulous that the designers had in mind a publicly accessible one, much less the Internet as we know today. Even Billy got it wrong in the first edition of The Road Ahead and had to revise his pontifications.

              • by node 3 (115640) on Tuesday December 02, 2008 @07:52PM (#25969221)

                All viruses require a reasonable level of market share to operate, because one of the principles they rely upon is a network effect, and you just plain cannot get a network effect without a decent market share. So marketshare is, very much, a pre-requisite for a successful virus. It's not the only one, but when people say "Mac OS X hasn't been attacked yet because it doesn't have enough marketshare", they're right. That's one fundamental reason. And unless you can show that any other reasons apply, it's likely to be the only reason.

                This is called critical mass. The fact that there's a very healthy third-party developer market for OS X is strong evidence that it's reached a sufficient critical mass to attract virus writers. The fact that there are trojans out for OS X is strong evidence for such critical mass.

                So, you must be wondering, why aren't there any actual viruses for OS X? It's because they're too damned hard to write. Trojans? No problem. Worms? Sure, but they won't be long-lived. Viruses, though, on OS X are a nut that's yet to be cracked.

                People always like to bring up how most malware is meant to earn money, or that most people use Windows, so it's a bigger target. This only explains why OS X has less viruses than Windows. What it doesn't explain is why OS X has no viruses. You'd expect at least one or two, if for nothing else than the fame and to take Mac users down a peg.

                The very least Apple could do is set Mac OS X up so that the installer actively discourages setting up the default user as an administrator.

                You do not understand how Mac OS X operates. Admin accounts are not the same as the user Administrator or the group Administrators (on Windows), nor the same as root on Unix. They are basically equivalent to a Unix user in the sudoer's file. You have to enter your password to elevate your privileges, just like you do in Unix, and similar to what you have to do in Vista (although the OS X/Unix way is a bit more secure in that someone can't just walk up to your unlocked computer and start wreaking superuser havoc without your password).

          • by VirusEqualsVeryYes (981719) on Tuesday December 02, 2008 @11:04AM (#25960487)

            Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

            Yeah. Why achieve the fame and glory of being the first to write a real Mac OS X virus? Why feel satisfied in crushing the worldview of every Mac fanboy in existence?

            There's just no draw.

            • by Bobfrankly1 (1043848) on Tuesday December 02, 2008 @12:19PM (#25961797)
              Real virus writers are more concerned with making gobs of money with as little investment as possible. Mac doesn't play into that role yet, as the aforementioned marketshare is still small by comparison.

              Also, virus writers are likely to stick to Windows for the same reason many users do, they already know it. Why spend the extra time learning a new OS to infect the minority when you can target the majority in much less time? That leaves you with so much more time to spend your pilfered moneys.
            • Re: (Score:3, Insightful)

              Why create a virus that only hits 7% of computers when you can hit one that hits 85% of computers?

              Yeah. Why achieve the fame and glory of being the first to write a real Mac OS X virus? Why feel satisfied in crushing the worldview of every Mac fanboy in existence?

              There's just no draw.

              The 90s called andd they want their virus-writer stereotype back. In case you haven't noticed, these days big viruses get written for money - huge botnet herds and all that. Search for it on /. if you're really that new here. There is also stealing CC info, but I'd guess the guys writing browser exploits have at least the 2 neurons required to look at the stats of the browsers hitting the sites they infected to see what targets make more sense to code for. Once it makes sense financially to add detection an

        • by v1 (525388) on Tuesday December 02, 2008 @09:44AM (#25959235) Homepage Journal

          Macs definitely are susceptible to malware, as the recent DNS trojan has demonstrated. Any app that asks for and gets your admin password is going to play with your computer, that's pretty hard to beat.

          Viruses, and worms in particular, do covert, automated spreading. Worms are able to exploit on-by-default network services remotely in the background. (we just had a new one announced yesterday! affects xp AND vista, good lord you'd think they'd learn by now!) Viruses require the ability to circumvent LOCAL security, and get their hooks in the system and replicate locally without user interaction/permission. OS X (and unix in general) are designed from the ground up with this in mind, and have always been far less vulnerable to these two issues.

          I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice. Windows started in the wide open, and their devs got used to it, before they realize the scope of their mistake and tried to close the doors. The devs refused to stop writing apps that just "oh lets just assume we have full write access to the entire hard drive" etc. and so MS has had to go very slowly to avoid completely destroying their established software market. That's hard to overcome.

          Even today I can count on one hand all the mac apps I've ran into that either (1) have to be installed while logged in as an admin, or (2) will only run properly (or completely) when logged in as an admin. And I count those developers as idiots for not knowing what they're doing and just assuming they have privs. Until Windows software approaches these numbers, I don't think we can call the Windows security model "fixed".

          There are two things that most interest me here. First, Norton has been considered anything from "bad" to "poison" to OS X from the get-go. It's been known to create a wide variety of system problems, and in most cases, when OS X is misbehaving, and they admit they are running norton, the first advice they get is to remove it. (and "good luck removing it" to boot) Symantec has been of little help there, their first "removal tool" was 300+ lines of terminal commands, and still didn't completely uproot it. Their current removal tools are more effective and user-friendly though. So to see Apple RECOMMEND norton is something of a shock. I don't know of a single person in any of the mac support forums that recommends anything for Norton besides uninstalling it.

          Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it. From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate? I seriously question where they're going by recommending you install additional (or possibly multiple) AV software.

          • by domatic (1128127) on Tuesday December 02, 2008 @10:14AM (#25959663)

            I don't see this changing anytime soon, just due to the differing design philosophies inside the two systems. From the start of OS X, apps didn't just have free access to do as they pleased, they were restricted by a security model, and learned to develop in OS X under these restrictions, being forced to learn good coding practice.

            There is another common stupidity that many Mac developers seem to have that still persists from the Classic days. Many OS X devs still act as though the user installing the app is the only one on the system. A good example is Adobe Reader. EVERY user that runs Reader for the first time will be pestered to enter an administrator password the first time the software is run. The only workaround is to copy some preference files into every home directory on the system and if there is an update to Reader then that has to be done again. Yeah, yeah, I know just use Preview but things like that happening are common. It isn't OS X' fault. There is provision for system wide app settings; it's just that OS X devs tend not to use them the way Windows devs assume everyone is an administrator.

          • by notthepainter (759494) <oblique@@@alum...mit...edu> on Tuesday December 02, 2008 @10:25AM (#25959845) Homepage

            Even today I can count on one hand all the mac apps I've ran into that either (1) have to be installed while logged in as an admin, or (2) will only run properly (or completely) when logged in as an admin.

            At a previous job I had the task of making the installer for our consumer level OS X product. I had to fight with management to get them to let me spend the time to get it installed both as a drag install and to do it without requiring admin accesses. (Our product installed an item in System Preferences so this wasn't a no-brainer.)

            I eventually prevailed and coded it "correctly" and was quite gratified to read in reviews how good the installation process was. It can be done but the non-Mac managers mindset just often doesn't see the need for doing it the "Mac" way.

          • Re: (Score:2, Informative)

            by jsalbre (663115)

            From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate?

            I don't think they're suggesting that each machine run multiple AV systems, just that there are multiple AV systems in use among all machines, thus decreasing the chances that a virus can exploit a weakness in a particular scanner and remain undetected.

            Als

          • Re: (Score:2, Insightful)

            by bkaul (1235970)

            Second, I thought AV products don't "stack" well? Our PC tech here is constantly having problems with computers that come in and are running 2-4 AV software, and they're fighting like cats and dogs and crippling the system to where only a fresh install will fix it. From what I read on that Apple post, it sounds like Apple is encouraging you to install multiple AV software. And OS X already runs ClamAV doesn't it? Although I have yet to see such a thing get pushed out, I assume Clam can get updates via SoftwareUpdate? I seriously question where they're going by recommending you install additional (or possibly multiple) AV software.

            I don't think they're recommending multiple AV installations on any given system, but rather a variety of AV programs being used by their user base at large. So, a virus writer will not be able to count on everyone having exactly the same configuration, and would have to plan to defeat a variety of AV programs if he wanted to ensure the effectiveness of his malicious code. This wouldn't be because all of them would be installed on a computer, but because any one of several would be installed, and he could

          • ClamAV is included with Mac OS X Server, but not the desktop Mac OS X.

            Also, it doesn't appear that Apple is recommending that a user stack more than one AntiVirus package on a given system, rather, they are refraining from picking a single package so that the market is heterogeneous. This affords better protection to the herd as a whole. I agree the technical bulletin is a bit ambiguous on this point.
        • ...is likely much harder to write a real virus (rather than a trojan)...as you'll need to find a privilege escalation exploit...

          That's not really correct. All a virus is is a self-replicating program that infects other files or programs. There's no need for privilege escalation. Granted, that would protect system files from infection (which is good) and perhaps make the virus less dangerous; then again, infecting docs (e.g. macro viruses) and executables in your home directory would still suck. Also sinc
          • There's no need for privilege escalation.

            Technically correct, but any malware that runs purely with user privileges is going to be pretty tame - especially as it should be DEAD easy to find and kill (admittedly therefore some kind of "antivirus" software would actually be needed, but nowhere near the complex scale of current things)

            Granted, that would protect system files from infection (which is good) and perhaps make the virus less dangerous; then again, infecting docs (e.g. macro viruses) and executables in your home directory would still suck

            Maybe most users treat their systems differently, but I really don't have anything in my home folder that I couldn't stand to lose and regain. All important documents that don't get modified every day (especially my me

    • is this a scare tactic for apple to push some payfor software and get people to buy it

      No, it's just common sense. Macs are not immune to viruses, and it's wise to keep up to date.

    • It's in the Details (Score:3, Interesting)

      by jDeepbeep (913892)
      If you follow the apple store link in TFA, it's interesting to note the description for the first product (Intego VirusBarrier X5) says this:

      Now that you've installed Windows on your Intel-based Mac, you're vulnerable to a whole new range of security threats: Viruses, spyware, adware, and hackers are all waiting to compromise your Windows setup. No matter if you're running Windows in Boot Camp, Parallels Desktop, or VMWare's Fusion, it requires Windows-specific protection. VirusBarrier Dual Protection is t

    • Maybe it's just them covering their own asses against the lawsuits and public backlash that might come if a widespread virus ever does hit OSX.

      Whatever the reason, they've been selling AV software in their stores for years now, and even included an antivirus with .Mac subscriptions for a couple years, in spite of these programs essentially not doing anything.

      I'll go out on a limb here, though, and I'll advise that you don't install any of Apple's recommended Antivirus packages. They're resource hogs that

    • by Me! Me! 42 (1153289) on Tuesday December 02, 2008 @11:51AM (#25961297)
      Mmm, I don't think so.
      AFAIK this has always been Apple's policy. All they did was update the posting slightly to show the latest leading commercial AV software. Here's the previous update from a year and a half ago. I assume it was just an update of the one previous to it. (I think you will find that it looks very familiar!)
      http://web.archive.org/web/20080113164722/http://docs.info.apple.com/article.html%3Fartnum%3D4454 [archive.org]
      "Mac OS: Antivirus Utilities
      Last Modified on: June 08, 2007
      Article: 4454
      This article describes the antivirus utilities that are available for the Mac OS.

      Apple encourages the widespread use of multiple antivirus utilities so that virus programmers have more than one program to circumvent, thus making the whole virus writing process more difficult. Here are some of the available antivirus utilities:

      Intego VirusBarrier X4
      Publisher: Intego
      License: commercial

      Norton Anti-Virus for Macintosh (formerly SAM)
      Publisher: Symantec
      License: commercial

      Virex
      Publisher: McAfee
      License: commercial

      This article provides information about a non-Apple product. Apple, Inc. is not responsible for its content. Please contact the vendor for additional information.

      Article 17159: "Locating Vendor Information" can help you search for a particular vendor's address and phone number. Keywords: ktech kmosx"
  • by SchizoStatic (1413201) on Tuesday December 02, 2008 @09:01AM (#25958643) Homepage Journal
    Well what do they expect they start to get a larger market share they start to be the target of more blackhats.
    • Well what do they expect they start to get a larger market share they start to be the target of more blackhats.

      True, but at this current point in time the only thing that this anti-viruses application will detect are MS-Windows viruses. On the other given that a Mac could become a carrier for a virus, being infected through connecting to various networks, this probably helps protect networks that the computer connects to.

      On a side note, does anyone know if there is decent GUI for Clam AV?

  • Sophos (Score:5, Interesting)

    by gammygator (820041) on Tuesday December 02, 2008 @09:04AM (#25958689)
    I've been running Sophos on both my Macs for a year or so... Not so much because I felt I needed them... but because I come from the PC world and felt nekked without an AV program... and my work covers the license costs which made the decision a no brainer.

    Interestingly enough... to date, they have only detected MS based viruses.
    • Re:Sophos (Score:5, Interesting)

      by gEvil (beta) (945888) on Tuesday December 02, 2008 @09:18AM (#25958875)
      Interestingly enough... to date, they have only detected MS based viruses.

      When I ran a lab of Macs several years ago, we ran AV software on all the machines. It was mostly there to strip out the Word macro viruses that students would bring in from their home computers. I'm not aware of the software catching any viruses that could actually have done anything to the machines themselves.
      • Re: (Score:3, Interesting)

        by SaDan (81097)

        The only Trojan I've ever seen for Mac was in a Word document macro years ago. The payload was empty if you opened the file on a Windows system, but on a Mac system it would try to wipe the drive.

    • by vertinox (846076)

      I use ClamX. In fact I ran it last night though I wonder if it only looks for windows specific viruses.

      As precaution I usually look at what programs are set to automatically start up and the file sharing security.

      From my understanding, the only Mac viruses are really just trojans which manually have to be run instead of just browsing to a webpage and then being hit with it.

    • I'd be interested in buying Mac Antivirus software if any of the AV products for the Mac could point to a single Mac virus that they could prevent, or a single Mac security flaw that they provided a work-around before Apple fixed. The second is a lot easier than the first, but I don't see it in any adverts. With 10.5, Apple introduced a nice syscall interception framework and with 10.6 I expect to see it used by default for a lot more things (it already prevented an mDNS vulnerability being exploitable on
  • by m0s3m8n (1335861) on Tuesday December 02, 2008 @09:05AM (#25958695)
    Yes Apples can get malware (general term) if you are a complete dumb ass. Until self-propagating zero-interaction attacks appear, leave me alone.
  • by Shivetya (243324) on Tuesday December 02, 2008 @09:05AM (#25958697) Homepage Journal

    I have Quicktime.

  • by grapes911 (646574) on Tuesday December 02, 2008 @09:06AM (#25958717)
    Don't those AV programs mostly scan for Windows viruses on the Mac so you don't pass around those viruses to Windows users?
    • by FictionPimp (712802) on Tuesday December 02, 2008 @09:19AM (#25958883) Homepage

      That is what I always thought, in fact looking at clamXav it appears to only scan for windows viruses.

      • Re: (Score:3, Interesting)

        by kimvette (919543)

        It also detects apache worms. Back in the day SuSE shipped with a vulnerable Apache build and I had to clean a server. ClamAV made it simple to remove the worm, without my having to prune every directory by hand.

  • Old document (Score:5, Informative)

    by Anonymous Coward on Tuesday December 02, 2008 @09:08AM (#25958731)

    This story is just wrong. That document is several years old. Apple advises to install security software since years. They just added new names for recommended software products and therefore updated the issue date on the document.

  • I noticed the "Old Article: 4454" string on the page. Anybody have any idea what the old knowledge base article used to say? And what era it was from?
    • by Golias (176380)

      Noooo! Don't give up the game! This whole discussion is proving to be a terrific honey-pot for identifying anti-Mac platform bigots! And here you had to go and ruin it by pointing out that the "news" story isn't actual news.

      Oh well. This is slashdot. There will be more.

  • a necessity (Score:5, Funny)

    by Anonymous Coward on Tuesday December 02, 2008 @09:22AM (#25958907)

    Well, duh... With the Apple CEO engaging in the unhygienic practice of peeing on all the hardware before it ships, no wonder users are being advised to get some sort of protection against pathogens.

    Or was that the Mapple CEO... meh, they probably all do it.

  • by bomanbot (980297) on Tuesday December 02, 2008 @09:26AM (#25958943)
    Well, aside from the fact that this Apple support document is not exactly brimming with information, using an antivirus program on a Mac makes perfect sense in a mixed environment with other operating systems.

    Although your Mac may be safe from the vast majority of malware stuff circulating right now, it can still spread them around and infect for example the other Windows machines on the network (those Microsoft Office macrovirus infections are a good example).

    Also, with all the nice virtualisation programs available on the Mac and BootCamp, it makes sense as a Mac user to be more aware of potential malware problems , although then the antivirus solution should be inside that environment, I think. Also those antivirus programs open up a whole other can of worms, because those antivirus companies are splendid examples of honesty and efficient programming, as we all well know :)
  • This has more to do with the protection from law suit from clueless users who might get some virus or whatever installed and claim "what, you have not told me I need an anti-virus software".

    But in all seriousness, I would never ever, ever install any kind of anti-virus crap on Windows, let alone non-Windows OS. Those things are more taxing and costly (as in CPU and disk arm cycles) than a virus :D. I have used Windows for decades and never had a virus, and I sure as hell won't be installing anti-virus softw

  • Because of the better inherent security in the operating system model is true that mac/linux is probably safer from direct attacks on the OS but is just as prone to browser attacks and social engineering attacks?

    I mean, when root privilege is required to affect the core system this should inherently be safer then Win32 where everybody is an administrator.

    Disclaimer: Feel free to flame me to a crisp on my lack of knowledge, but I'll make it clear that I am not an expert in computer security and I am in
  • by scubamage (727538) on Tuesday December 02, 2008 @09:35AM (#25959087)
    ...you can hear the heads of a million fanboys going poof!
    • by ettlz (639203)
      That's the great disturbance in the reality-distortion field. I bet the Organas were Mac users, too.
  • by tecker (793737) on Tuesday December 02, 2008 @09:38AM (#25959135) Homepage
    The college I attend actually requires all mac users to install Symantic Corporate to be allowd on the network. Their justification is that this will prevent WINDOWS virus from passing through macs and then hitting the Windows boxes as the mac users send them on. We have a good security team and I can understand why they would want to do this.

    As macs are being used in Enterprise environments they can harbor virus infected files silently before going back into the network. One computer that missed new definitions can be taken down when that file gets passed to it. Its up to you but if you are in Enterprise situations you better comply.

    As for multiple AV systems, that is retarded. They will fight for resources and cause performance to be brought down. Just pick one and run with it. If you want.
  • Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.
    • by Golias (176380) on Tuesday December 02, 2008 @10:16AM (#25959699)

      Hell they even gave it away with old .mac accounts. And apple support always had lines saying to use protection. How is it all of a sudden new? They have been saying to use protection for YEARS now.

      Very true.

      And I've been ignoring the recommendation for years now. Guess which AV app I'm going to install today.

      That's right. None. Running an AV program on a Mac makes about as much sense as using a rope to tie down your car every time you park it in your garage.

    • Re: (Score:3, Funny)

      by Prien715 (251944)

      They have been saying to use protection for YEARS now.

      And yet, AIDs is still an epidemic.

    • Re: (Score:3, Interesting)

      by jeffasselin (566598)

      Correct. They've always had a similar article, listing antivirus solutions. This is just an updated version with current products.

  • I am increasingly annoyed by Apple's following Microsoft in "Security Theatre" techniques like the Leopard "OMG you downloaded that file from TEH INTERWEBS!" dialogs, but this is going too far.

    Antivirus software does not make any difference to the virus writing process. It can only detect and block existing exploits. Until there ARE active exploits in the wild all it can do is cause time and data loss through false positives.

  • "After years of boasting about the Mac's near invincibility..." I've been a Mac user for over 22 years. While I have heard many of my fellow Mac users boast about the lack of viruses and other malware for Macs- mainly out of ignorance or just to taunt Windows users- there have been Mac viruses in the past (e.g., nVIR) and there will be Mac viruses in the future. I've always been concerned that complacency regarding Mac malware would eventually result in heinousness once some bad actor sunk their teeth in

    • by Golias (176380)

      Kinda tough to build a good table of virus definitions when there are none out in the wild for you to define.

  • This is not news. Apple has always recommended that users of its products run anti-virus software. The reason that this got 'amped-up' was because Brian Krebs at the Washington Post 'noticed' the Apple Support document while trolling around their site enjoying the new, harder to use, design layout. What he failed to notice -and mention in his blog- was the article was modified from an earlier one that said basically the same thing. It's prudent for Apple to have been saying this all along so as to avoid any
  • Viruses and trojans (as opposed to worms) are a user stupidity issue. You can't fix that with technology. For a computer to be useful, it needs to run programs that the user launches. Trying to put something in the way to analyze whether what that user wanted to do is not what the user wanted to do is never going to be successful.

    of course, things like MSIE make things bad, as the user has no control over what is going on with the software they run. But that is a problem with a single piece of software

  • by gordguide (307383) on Tuesday December 02, 2008 @12:57PM (#25962439)

    Apple has NEVER not recommended users install AntiVirus software. One of the first benefits of subscribing to Apple's DotMac web service, a service that is roughly as old as the first Gold Master release of OSX itself, was a complimentary copy of AntiVirus software (McAfee Virex 7.0, released September 2001).

    The offer only applies to v7x; which no longer compatible with the latest OSX version, which probably goes a much longer way to explain why Apple is now recommending users install their own choice of a competitive application.

    The most recent ad campaign, which does mention vulnerabilities to various malware on Windows machines, comes after more than two decades of people clamoring for Apple to do just that in it's marketing and sales literature. Rather than all of a sudden "quietly" recommending AV software, Apple has always (quietly) recommended it.

    The (very lightweight) BBC article comes across as written by someone who only recently started paying attention to Apple, perhaps after her dad bought her an iPod in Journalism school.

<<<<< EVACUATION ROUTE <<<<<

Working...