Mac desktop security: The landscape is changing

Only about 20 percent of Americans think Macs are vulnerable to viruses, compared to more than half who describe PCs as "vulnerable" or "very vulnerable" to attack by viruses, according to Alex Stamos, a security analyst at iSec Partners.

That doesn't mean Macs are safe, only that Mac users have a "go ahead, run this unsigned binary, who needs anti-virus" attitude about potential threats, Stamos told an audience at this year's Black Hat security conference in Las Vegas.

The truth about Macs and malware, according to Stamos, McAfee Labs and other vendors is:

  • Any computer is vulnerable to malware
  • Apple has ridden the popularity of the iPhone and iPad to a comeback in the enterprise, making its operating systems a more attractive target for malware writers
  • The high level of cluelessness about security makes Mac users of all stripes far more vulnerable to infection or phishing attacks than PC users who have learned caution by experience, according to Stamos.

Now in Hacker Sights: Adobe

Threats to Windows machines are actually going down, at least proportionately, as Microsoft's security improves and the popularity of Adobe products draws more malware writers to focus on it rather than Windows, McAfee's report showed.

The issue is not that Adobe code is insecure, just that it is growing in popularity more quickly than the stable user base of Windows, the report said. Since January, malware threats collected by McAfee that were aimed at Adobe products have increased from a little over 4,000 per month to just over 14,000 in June -- growth of 330 percent in six months.

Mac OS X -- Keep It Out of Your Enterprise

The increase in threats to Mac OS X machines is as dramatic as the effect is on Mac users, the report found.

"There are more Mac users than ever before as well as steady business adoption," the McAfee report found. "This puts the Apple platforms squarely in the crosshairs of malware authors. It will be interesting to see if this type of malware makes its way to the iPhone and iPad as well. It is probably a case of 'when' rather than 'if.'"

So far, most of the threats have been socially engineered approaches such as MacDefender -- a fake antivirus program that preyed on the budding awareness among Mac OS X users that their platform may be vulnerable.

MacDefender showed up in April and May; by May 31 Apple had shipped a patch that plugged the vulnerability it exploited and cleared it from infected machines.

It is not known how many Macs were infected.

As a networked enterprise platform, however, Stamos says Macs are not safe.

Apple's new server operating system -- OS X Lion -- is so inherently insecure that Stamos recommends keeping it off the network altogether and using Macs only as standalone machines connected to IP or Windows networks, not those designed for Macs.

The Mac Server's networking protocols -- especially DHX User Authentication -- are designed for ease of use, not security. It is trivial, Stamos said, for hackers to set up a Mac user to download a file that will overflow the buffer protecting the heap segment of the server's memory, allowing the file's malicious payload to run uncontrolled in the server's memory and give itself whatever access rights it wants.

The Login Keychain with the Mac OS X server is also vulnerable to brute-force cracking of the user's password, and, although there is a sandbox in which misbehaving code should be contained, Mac OS X Lion Server doesn't put a tight enough lid on it to protect against new malware threats. The list of vulnerabilities goes on, Stamos says.

Apple's ad hoc DNS service also requires no encryption, so malware listening to chatter on the network can identify machines and ID codes to replicate

VPN credentials remain within memory after the connection has been broken, which makes them vulnerable

Mac servers accept a range of authentication protocols but don't prevent malware from downgrading to the least secure of these and trying to get illegal access via the weakest link.

There is also no central, required cryptography or memory forensics to help identify malware already running on the server, Stamos said. The desktop version of Mac OS X is more secure than ever, so there is no excuse for such weakness in the server; the only solution, he said, is to leave the server alone.

"Run your Macs as little islands on a hostile network," Stamos told attendees at his Black Hat presentation. "Once you turn on the administrator stuff, once you install OS X Server, you are toast."

Join the PC World newsletter!

Error: Please check your email address.

Tags Applesecurityhardware systemsdesktop pcsMac desktops

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Kevin Fogarty

CIO (US)
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?