You Can Steal but You Can't Hide

There's a sordid kind of justice about two Trojans affecting Mac systems: People got them from stealing software. The first Trojan appeared last week in pirated copies of iWork `09. A variant is out with pirated Adobe Creative Suite 4.

GOT A TIP OR RUMOR?

In the real world, many (I assume most) people have sense to stay away from bad neighborhoods. They know where they don't belong; where it's not safe for them. But there's a real lack of good sense when it comes to bad Internet neighborhoods. There, many (I assume most) Mac users have no sense at all.

Bad Internet neighborhoods have been a major source of Windows viruses for years. Nearly every malware-infected Windows PC that I've serviced got infected some place bad: Porn or gambling sites, video or music shares or software crack distributors. Many torrents are currents for distributing malware.

Mac users have been able to go invisibly into bad neighborhoods. No one there even really acknowledged their presence. Now that's changing. These two related Trojans aren't the only recent Mac malware distributed in bad Nethoods. Another example: Malware posing as video codecs distributed through some porn sites.

The video codecs and Trojans share something in common: How they use end-user behavior to push past Mac OS X security. To date, Mac malware infection generally involves getting end users to grant permission to install something. The installation was direct for the fake video codecs and piggyback for the newer Trojans.

Hacking and malware have long histories of exploiting end-user behavior. The Conficker worm continues to spread among Windows computers. Bad behavior is a major reason. Microsoft released a patch last year. But many computers run unpatched and/or without anti-virus software. They're screwed.

Time is quickly coming when Mac users pay for their bad behavior. Here's why: For years, I've defended Apple against the security vulnerability marketshare myth. The idea: Windows is a bigger malware target because of bigger marketshare than the Mac. If Apple had more marketshare, Macs would be attacked, too.

These new Trojans suggest that Microsoft was right. Of course, Microsoft was right and just as wrong, too. There's more to malware vulnerability than marketshare. There's resilience to attack. Mac OS X has proved hardier than Windows, with rights administration being a major reason. But Mac OS X's hardiness, which Microsoft's marketshare myth ignores, doesn't mean there's nothing to the theory, either. There is a perceptible increase in Mac malware, which suggests that, yes, increased marketshare makes for a bigger target. That said, the malware isn't hitting the Mac mainstream but the fringes, meaning bad Nethoods. It is in these bad neighborhoods that people grant malware installation privileges. They unlock the doors to intruders.

Many (I presume most) Mac users are even more at risk than Windows users. I didn't say Macs, but the users. Long-time Mac users aren't used to being held accountable for their actions:

• They've had free run of the Web, without many consequences.
• Most Mac users could run OS X without anti-virus software.
• Trust is the major check against piracy. Some software developers, such as Adobe, require product activation but most others don't—and certainly not Apple.

By comparison, Windows users' experience is different:

• Even good Internet neighborhoods pose malware risk; infections and their consequences are quite real.
• All Windows users should run anti-virus software, and most new PCs ship with some kind of anti-malware software.
• Microsoft introduced product activation nine years ago, which led to the anti-piracy mechanism's pervasive use; Windows also checks for counterfeit or pirated copies.

Living has been tougher in the Windows world, but many end users are hardier for it. Bad Mac users, I dunno. I agree with Darrell Etherington, who today posted at the Apple Blog:

Really, as it stands, the only people at risk are those trying to pirate software, so it's not really a case of 'Is the OS less secure?', so much as it is one of 'Are Mac users security savvy?'. Pirated software distributed via torrents has always been a high-risk area, but those running a Mac OS have had the luxury of being less guarded about those types of threats because the malicious code they contained was generally written to attack Windows machines.

Times change. Clearly someone sees a market in and opportunity from Mac malware placed in bad Nethoods. As I post, Intego reports at least 20,000 Trojan.iServices.A infections (from pirated iWork `09) and about 5,000 Trojan.iServices.B infections (from pirated Creative Suite 4).

If the Trojans' tale was a morality play, the lesson would be simple: Don't steal. Windows users have long had reality checks—malware infections and other consequences for their bad behavior. Mac users have largely been consequence free—at least in this century. No longer. They will pay if they play in bad Internet neighborhoods.

[Please send your tips or rumors to watchtips at live.com].

Posted by Joe Wilcox on January 26, 2009 7:42 PM