Mac desktop security: The landscape is changing

Only about 20 percent of Americans think Macs are vulnerable to viruses, compared to more than half who describe PCs as "vulnerable" or "very vulnerable" to attack by viruses, according to Alex Stamos, a security analyst at iSec Partners.

That doesn't mean Macs are safe, only that Mac users have a "go ahead, run this unsigned binary, who needs anti-virus" attitude about potential threats, Stamos told an audience at this year's Black Hat security conference in Las Vegas.

The truth about Macs and malware, according to Stamos, McAfee Labs and other vendors is:

  • Any computer is vulnerable to malware
  • Apple has ridden the popularity of the iPhone and iPad to a comeback in the enterprise, making its operating systems a more attractive target for malware writers
  • The high level of cluelessness about security makes Mac users of all stripes far more vulnerable to infection or phishing attacks than PC users who have learned caution by experience, according to Stamos.

Now in Hacker Sights: Adobe

Threats to Windows machines are actually going down, at least proportionately, as Microsoft's security improves and the popularity of Adobe products draws more malware writers to focus on it rather than Windows, McAfee's report showed.

The issue is not that Adobe code is insecure, just that it is growing in popularity more quickly than the stable user base of Windows, the report said. Since January, malware threats collected by McAfee that were aimed at Adobe products have increased from a little over 4,000 per month to just over 14,000 in June -- growth of 330 percent in six months.

Mac OS X -- Keep It Out of Your Enterprise

The increase in threats to Mac OS X machines is as dramatic as the effect is on Mac users, the report found.

"There are more Mac users than ever before as well as steady business adoption," the McAfee report found. "This puts the Apple platforms squarely in the crosshairs of malware authors. It will be interesting to see if this type of malware makes its way to the iPhone and iPad as well. It is probably a case of 'when' rather than 'if.'"

So far, most of the threats have been socially engineered approaches such as MacDefender -- a fake antivirus program that preyed on the budding awareness among Mac OS X users that their platform may be vulnerable.

MacDefender showed up in April and May; by May 31 Apple had shipped a patch that plugged the vulnerability it exploited and cleared it from infected machines.

It is not known how many Macs were infected.

As a networked enterprise platform, however, Stamos says Macs are not safe.

Apple's new server operating system -- OS X Lion -- is so inherently insecure that Stamos recommends keeping it off the network altogether and using Macs only as standalone machines connected to IP or Windows networks, not those designed for Macs.

The Mac Server's networking protocols -- especially DHX User Authentication -- are designed for ease of use, not security. It is trivial, Stamos said, for hackers to set up a Mac user to download a file that will overflow the buffer protecting the heap segment of the server's memory, allowing the file's malicious payload to run uncontrolled in the server's memory and give itself whatever access rights it wants.

The Login Keychain with the Mac OS X server is also vulnerable to brute-force cracking of the user's password, and, although there is a sandbox in which misbehaving code should be contained, Mac OS X Lion Server doesn't put a tight enough lid on it to protect against new malware threats. The list of vulnerabilities goes on, Stamos says.

Apple's ad hoc DNS service also requires no encryption, so malware listening to chatter on the network can identify machines and ID codes to replicate

VPN credentials remain within memory after the connection has been broken, which makes them vulnerable

Mac servers accept a range of authentication protocols but don't prevent malware from downgrading to the least secure of these and trying to get illegal access via the weakest link.

There is also no central, required cryptography or memory forensics to help identify malware already running on the server, Stamos said. The desktop version of Mac OS X is more secure than ever, so there is no excuse for such weakness in the server; the only solution, he said, is to leave the server alone.

"Run your Macs as little islands on a hostile network," Stamos told attendees at his Black Hat presentation. "Once you turn on the administrator stuff, once you install OS X Server, you are toast."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityApplehardware systemsdesktop pcsMac desktops

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Kevin Fogarty

CIO (US)
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?