Mac Malware Market-Share Myths
News Commentary. For years, Microsoft executives have justified security problems by saying Windows was a bigger target. What, Mac market share isn't big enough? |
When will it be?
I've long criticized Microsoft's security justification because it wasn't verifiable. Microsoft could claim more malware problems because of Windows volume, and there was no test because its largest rival, the Mac OS, had small market share. It's a circularly reinforcing statement that, without verification, is pure PR bull.
Apple's market share is way up, and given that yesterday, Nov. 18, Microsoft cancelled Windows Live OneCare, it's a good day to ask how much is enough.
According to Gartner, Apple's U.S. market share was 9.5 percent in the third quarter (based on preliminary data). It's even bigger in U.S. retail, where Mac unit share was 20.1 percent in October, according to NPD. Macs have gained lots of share since earlier in the decade when Microsoft started making the "more market share means more attacks" argument. When will Apple's market share be enough to prove Microsoft's theory? Thirty percent? Forty percent?
Zero, I say. I don't doubt that there will come a time when Mac OS becomes a bigger target by volume than it is now. But what does that have to do with exploits? If Bucky's Bank has 100 branches, and they're robbed 50 times more often than the 10 Brady Bank branches, an argument could be made that volume is the reason. If Brady opens 50 branches, it would become a bigger target than it had been, but not necessarily be robbed any more often. Brady may simply have better security, making it harder to rob. More volume might mean more attempts, but not necessarily more robberies.
By comparison, there has been a notable increase in proof-of-concept and even some mildly dangerous Mac malware. But there hasn't yet been a major increase in Mac exploits.
No operating system is invulnerable to hacking or malware attacks. In the past, Microsoft used vulnerabilities as measure of Windows' real security compared with other operating systems. But vulnerabilities aren't the same as exploits. It's due diligence when a developer fixes potential vulnerabilities. Exploits are measurably higher for Windows than the Mac. For Mac OS X, if measured by exploits in the wild leading to infections, the number is statistically zero.
My conclusion as to why Mac OS X has been subjected to so few exploits compared with Windows: permissions and architecture. Drive-by malware downloads are easier on many Windows systems than on Macs. Hardier Mac OS X permissions generally require user name and password to install software, creating a natural barrier to stealth installations. Malware also has more places to hide on a PC and can gain broader permissions, particularly for Windows XP and earlier Windows versions, than Mac OS X.
Now a seeming counterargument comes from Windows Vista. The operating system's market share is more Mac-like. Microsoft has sold bunches of licenses, but most haven't been deployed. For example, Gartner estimates that only about 10 percent of enterprises have deployed Vista. Based on Microsoft data on security vulnerabilities and exploits, Vista is safer to use than XP. Is it because Vista's market share is much less, and that makes it a lesser target? Of course not.
Vista is better, not because fewer people use it than XP, but because Microsoft improved permissions and the architecture. According to the "Microsoft Security Intelligence Report: January through June 2008," (PDF) the "infection rate of Windows Vista [Service Pack 1] is 48.8 percent less than that of Windows XP SP3" and Vista gold code (with no service packs) has an infection rate 85.4 percent less than XP gold code (released in 2001). These numbers show improvements in the software rather than attacks varying by installation volume. The report explains:
At least part of the improvement in the security of Windows Vista over Windows XP can be attributed to the implementation of the Security Development Lifecycle (SDL). A Microsoft-wide initiative and a mandatory policy since 2004, the SDL has played a critical role in embedding security and privacy in Microsoft software and culture. Combining a holistic and practical approach, the SDL introduces security and privacy early and throughout the development process. It has led Microsoft to measurable and widely recognized security improvements in flagship products, such as Windows Vista, Internet Explorer and SQL Server.
By the way, for anyone interested in security, this Microsoft report is a must-read. The authors offer a broad and thorough perspective on the security landscape during the first half of 2008.
Back on topic, in my testing, Vista is a lot more secure than XP and even more so using Internet Explorer 8 Beta 2. Permissions are more Mac-like, security architecture is better (compliments to Microsoft on that 64-bit kernel) and malware can't hide as easily. Vista and successor Windows 7 are the strongest evidence that Microsoft's "more volume means more exploits" argument is a load of crap. But changes to these Windows versions also make them safer to use on the Internet.
Now Microsoft is preparing its boldest security advancement yet: "Morro." The forthcoming security software is designed to use as few system resources as possible—and that is going to improve the Windows user experience. In my testing, security is Windows' biggest usability problem, and the root cause isn't rootkits or other malware but often the security software designed to keep people safe. Security software suites sap system resources and interrupt some processes.
As Windows security improves, there may come a time when system-sucking security software won't be necessary. If not Microsoft's Morro, then maybe something else. A safer Windows is a more usable Windows, and a more attractive upgrade than switching to a Mac.
Everybody wants Wile E. Coyote to get the Roadrunner just once. Maybe in a future "Get a Mac" ad—parody, not from Apple—PC Guy will put up an umbrella to deflect falling pebbles and then a giant, 50-ton Acme weight will squash Mac Guy.
[Please send your tips or rumors to watchtips at live.com]
Comments (15)
Guess what if windows shut down compleletly the next target for hackers would be mac. there wouldnt be a barrier to stop them
Posted by wek | November 19, 2008 5:15 PM
Windows is th best! Go Windows, I us Windows al the time and it is grate. Macs suck - they cant evn get on the intenet and they are no good for games. Windows is the best!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Posted by Fe3DR | November 19, 2008 5:34 PM
I would love to yell at the last guy, but I can't get my d@mn Mac on the Internet!
ARGH!
MACz RULZ!!!!!
Bot
Mac Fanbot and ACME customer
Posted by ex2bot | November 19, 2008 6:07 PM
Maybe the OS X is inherently more secure, or maybe not. Either way, the undisputed truth is that, to date, Mac users have not been inconvenienced by virus attacks.
But let's assume that the lack of Mac exploits is in fact due to its comparatively low market-share. Mac users can still look forward to many more years of virus free computing, as Windows will be around as long as there are Mac-phobic corporate IT departments, do-it-yourself system builders, high performance gamers, netbook- and tablet-cravers, bargain-hunting bottom-feeders, and Windows zealots.
Ya pays yer money and ya takes yer choice.
Posted by Brett | November 19, 2008 6:12 PM
Joe, its strange you call this blog Apple-Watch, yet you end up writing 99.9% Microsoft bashing. What gives?
As of that bank analogy, maybe its the fact that Bucky's has more customer transactions and more customers sign up with Bucky's for its exceptional service and interest rates compared to Brady's. So basically, there is not much money in Brady's bank to go after because everybody banks with the best: Bucky's.
Quote: "Now a seeming counterargument comes from Windows Vista. The operating system's market share is more Mac-like. Microsoft has sold bunches of licenses, but most haven't been deployed. For example, Gartner estimates that only about 10 percent of enterprises have deployed Vista."
Joe, how ridiculous is that. Ok, you are saying out of 250 million Vista licenses sold only 25 million have been deployed? No seriously, that's just ludicrous, even with downgrades to Windows XP, alternative platforms the most pessimistic person wouldn't assume such a thing. The Mac OS has stayed at its same stagnant 22 million user base since the 1990's even after the introduction of OS X. Its without a doubt that Vista is actually running on over 200 million systems.
Quote: PC and can gain broader permissions, particularly for Windows XP and earlier Windows versions, than Mac OS X.
Oh, that does not make sense. As far back as Windows 2000, I have setup account primarily with Limited User privileges. Yes, by default Windows XP and 2000 by default setup the user as an Administrator which is the opposite on Windows Vista and OS X. But for most corporations running these operating systems, of course they would be set with Limited User accounts. There is nothing wrong with the permissions themselves in Windows XP or 2000, its how they are implemented and used.
I personally always run as Administrator and have never encountered malware or viruses. Its not a good example, but I have not suffered for it.
Posted by Andre Da Costa | November 19, 2008 8:03 PM
Andre:
Quote: you are saying out of 250 million Vista licenses sold only 25 million have been deployed?
No, that is not what he said. He said 10% of the ENTERPRISE licenses have installed.
Quote: The Mac OS has stayed at its same stagnant 22 million user base since the 1990's even after the introduction of OS X.
Where in the world did you get that number from? (I can guess which orifice). According to the Guardian in March 2007:
"Apple Inc.'s install base of Mac OS X users will be approximately 22 million strong come the end of March,"
Notice that is the OSX installed base, not the Mac OS installed base. There are still lots of folks out there running earlier version of MacOS, numbering in the millions. And, since March of 2007, Apple has sold around 12 million more copies.
Posted by Max | November 19, 2008 10:10 PM
@Max, darn you beat me to it. Clearly Andre is doing the math wrong and thus implying that the 250 million Vista licenses sold all went to enterprises. That's the only way to equate 10% enterprise adoption to 25 million Vista licenses.
@Joe, there's another point to be added to your argument. CPU architecture. When OS X ran only on PowerPC another strong argument was that there were not as many script kits for PowerPC as there were for x86. There were comments on heap models and CPU registers being different and exploits being well known for x86, etc etc etc.
Apple moved to x86 and I didn't see a surge in malware. Did you? And its been what? 4 years?
@Andre, there's another inconsistency in your points:
First you setup limited user accounts:
"As far back as Windows 2000, I have setup account primarily with Limited User privileges."
Then you leave those accounts sitting there and login as admin:
"I personally always run as Administrator and have never encountered malware or viruses."
Which one is it?
Posted by Gerardo Tasistro | November 19, 2008 10:49 PM
A simple comparison of the extant threats to Windows and Mac OS versus sales of both, reveals that the ratio of Windows to OS X threats is over 1000-1 while according to Steve Ballmer's optimistic assertion, Windows outsells OS X 33-1. If only Vista is considered, then the threat ratio drops to over 500-1 while the market share figure would shift to approximately 5-1. That represents 30 to 100 times the extant threats to Windows/Vista users per machine.
Even if the above logic doesn't persuade, who gets a good job, marries, has kids and moves to Cracktown, USA? Even if affluent bedroom communities were only more secure because of their lower population, you would certainly choose to live in a more secure environment if offered the choice.
(Threat numbers are from a search of the McAfee Threat Center)
Posted by Sean | November 20, 2008 5:44 AM
Nothing like a good Mac v Windows argument. Let's look at the permissions REQUIRED to run some Windows applications shall we? Quickbooks required until 2007 model, that all users of the application belong to the Administrators group of the PC they were on to use. Several bank applications run at that level as well. This is a very bad situation that only exacerbates the already weakened security of the OS involved. So until vendors like Intuit get it through their thick skulls to change that, they now require "Power-User" status, there will be issues with drive-by installs. I use a Terminal application that, if the user is not an administrator, throws up an error message stating that the default settings cannot be changed. Gee, why would you need to be an administrator to change a setting on a TELNET application? Heavens forbid that the user accidentally changes the color of their text! Bad programming at the OS level creates these needs, and until MS actually fixes the OS by throwing away EVERYTHING it has done in the past and starts over with CLEAN code, we will continue to have these problems. I believe that computers are a tool, and that you should use the one that best fits your style of work. But we have traveled a path built and maintained by Redmond for so long, that we will need a major over-haul caused by some vast destructive event. Unfortunately, that is what it will take for vendors to finally get a clue.
Cheers
Posted by Nat Strickland | November 20, 2008 1:39 PM
Joe, I usually demolish the "Macs are just as vulnerable as Windows" canard with the following question:
----
"Please list for me all the OS X viruses spreading--or spread at any time in the past--as a result of normal day-to-day operations on and between the computers of unsuspecting Mac users.
.
We'll wait.
.
:Crickets chirping:
.
Thank you.
.
WildList.org, the antivirus researchers organization that tracks such data, currently lists 762 viruses that currently meet the In-The-Wild criteria. All are Win32 or VB-based."
----
.
Now for the reason why: architecture. Joe, Windows had always been purposely designed to make it easy for developers to programmatically access core OS functions with little or no restrictions. This is great for 1993 standalone use, but security suicide in a connected world.
The most egregious example: ActiveX was basically designed to allow freakin WEBPAGES programmatic access to the entire OS (originally in a concerted MSFT effort to preserve the Windows desktop monopoly.) Sandboxing, permissions, and kill bits after the fact do little to relieve the potential danger of ActiveX. It's akin to storing 1000 pounds of TNT in your basement. You're only one security breach away from blowing up your house.
Vista remains a Win32-based nightmare with a complex web of (some very effective) security band-aids laid over it. It helps, but doesn't correct the UNDERLYING architectural security problem.
Commenter Nat is absolutely correct: until Win32 is thrown completely out and new clean code is written with security first in mind, Windows will always be an accident waiting to happen.
Posted by Dev | November 20, 2008 6:15 PM
Sean - "you would certainly choose to live in a more secure environment if offered the choice."
m8 there is a differnce between human beings and computers.
Posted by wek | November 21, 2008 3:25 PM
Worldwide, the Mac's market share has "skyrocketed" all the way to 3.x%. Malware writers don't want to waste their time with such a teeny, tiny, target.
The internet is a worldwide network, so your comments about the Mac's USA-only market share are irrelevant.
Speaking of NPD's USA-only market share numbers, my understanding is that they exclude sales on both hp.com and dell.com.
Posted by JohnJ | November 22, 2008 11:36 AM
@JohnJ, it could be counter argued that being Macs more expensive than PCs (or so goes the claim by the PC community), their owners probably have heftier credit card accounts. They would thus be a more attractive target than someone who can only afford 600 bucks for a laptop.
The analysis of USA-only market on Joe's part is also valuable in this case. For one it is still a test population to be examined statistically. There is no reason to discard events occurring in this population as possible behavior to occur in other populations (European or Asian) if Mac were to raise its market share there.
Finally while said market share may be confined to the US, malware writers are not. More so you'll probably find overseas malware writers attacking US residents more than you'll find US malware writers attaking US residents. Simply because it is easier to prosecute some malware writer from Alaska for crimes committed in Florida than a malware writer from some overseas country for crimes committed in Florida.
So Joe's USA-only Mac market share comment IS relevant because the internet is a worldwide network.
Posted by Gerardo Tasistro | November 25, 2008 9:29 AM
It's good to know reality doesn't ever phase the mac user population. It's things like that which give me job security.
As far as more expensive in Gerardo's comment, they are. They also top out at a much lower point than PCs do. My pc runs a dual xeon core i7 processors with a 6.4gt/s fsb. It also has triple sli geforce GTX 280 video cards, with manufacturer provided forceware integrations and overrides, and to top all that off, it is capable of 24gb per processor of triple channel DDR3 @ 20000mhz for a total of 48gbs. All this for just over 8000 USD.
Specs on the top end mac pro:
Dual xeon quad core (not core 2 extreme, apple doesn't support them yet, so on top of not truly being quad core, it's also not 45nm), with a max fsb of 1666mhz, and are 120% slower per processor. Tops out at 16gb of ddr3 per processor, dual channel memory, and that at 13000mhz. You also can't put anything better in it than a 9800 GT gpu.
And for all this limitation and a fancy case, you pay 24 THOUSAND dollars. Btw, my case is better constructed as well, as NZXT's cases don't use pop rivets and screws like the mac cases do. Even lian li cases are better constructed, though I bet mac users don't get the significance of that.
Posted by Kitty | December 3, 2008 1:33 PM
This blog is really nice and informative. We are pleased to know this blog is really helping people.
The explanation given is really comprehensive and informative. I am feeling happy to comment on this blog
Posted by Indian Stock Market | December 17, 2008 3:02 AM