viruses

[Unregistered]

I recently bought a G4. I hear that Macs don't get viruses, and I also hear that they could get viruses. Is it a good idea to get antivirus software? If so, any suggestions?

[abudhu]

I hear that Macs don't get viruses, and I also hear that they could get viruses.


This is a common mis-understanding. Mac's CAN and DO get viruses. The reason you don't see Apple, like Microsoft, pressed to develop anti-virus software / secure their kernel is that no one targets apple as it has a low market share.
However, from time to time someone does code a virus for Apple and without any anti-virus software it may be annoying to track down. With that said, I would urge you to download / obtain any type of Anti-Virus software as it is always better to have it.

[trees]

Don't wish to be picky about it, but in actual fact, there have been no viruses on the Mac since OS X was introduced. It can be debated if this is an artifact of low market share or just a more secure OS. I would tend to say that it is both. In any case, there is anti-viral software for the Mac. The University site license web site carries a copy of Sophos for Mac. The instructions for setting it up with auto-update, which is also supported by the UofA, can be found elsewhere on this forum.
But it doesn't exist to block Mac viruses. In fact, the virus definitions and updates that you get have no info in them on Mac viruses. They can't, since there are none. Instead, the idea is to be a "good citizen" and help the Windows people take care of their more attack prone machines. Sophos on Mac simply stops you from forwarding on Windows viruses to Windows users. The Mac could care less.

[Unregistered]

Do you know of any antivirus software that is available for the Mac?

[amccabe]

As Tom said in his response, there is Sophos for Mac on http://sitelicense.arizona.edu

There is also MacAfee - this comes with a .Mac account from Apple or can be purchased separately

[abudhu]

Touché Tom, Touché. In any case, there has been sitings and listings of mini-exploits to OS X. Besides that I'll agree. :) I still am I strong advocate that one of the major reasons Apple does not see Viruses is their small market share. After all what Hacker is going to spend hours making a virus that will affect 4% of the computer using world, when he could make it affect 80%? Anyways, like I said, Touché Tom. =D

[trees]

No touche intended.
The belief appears to be endemic to the Windows world that all OS'es have at least some viruses. I guess misery loves (or at least, demands) company. But that is simply not true. Viruses are only a major problem in the Windows world. Not that there aren't vulnerabilities that have appeared in OS X. Like all UNIX OSes, there have been numerous processes from primarily the Open Source world that have needed patching. On the other hand there have been very few exploits written to attack these vulnerabilities.
A good example of why I think OSes like OS X are inherently more secure than Windows is the recent 'root-kit' that appeared for OS X. Unlike root-kits and the like that are written for Windows, a root kit made for OS X will ask the user for an administrative password at least a dozen times before it could even install itself. That kind of secure behavior is a real deterrent for a hacker to go up against. Windows attacks work well because of the ease to run as root, and lack of authentication necessary to run as a privileged user. That kind of permissive behavior doesn't occur in most other OSes.

[abudhu]

No touche intended.
Unlike root-kits and the like that are written for Windows, a root kit made for OS X will ask the user for an administrative password at least a dozen times before it could even install itself. That kind of secure behavior is a real deterrent for a hacker to go up against. Windows attacks work well because of the ease to run as root, and lack of authentication necessary to run as a privileged user. That kind of permissive behavior doesn't occur in most other OSes.


Side Note to this: Windows Vista has since moved to a more *Nix like setup of users. That is, the standard Admin Account is no longer a Root User. Windows Vista now prompts, on certain actions, that passwords be put in specific to the root user. Which, is once again a lot like *Nix os'es. In Windows Related News, a new CTP build was released. :)

[amccabe]

http://www.techworld.com/news/index.cfm?RSS&NewsID=5392 (http://www.techworld.com/news/index.cfm?RSS&NewsID=5392)

and

http://macobserver.com/article/2006/02/16.3.shtml (http://macobserver.com/article/2006/02/16.3.shtml)

and

http://securityresponse.symantec.com/avcenter/venc/data/osx.leap.a.html (http://securityresponse.symantec.com/avcenter/venc/data/osx.leap.a.html)

Check it out - it's for real. But it looks like it is a "proof-of-concept" rather than anything too bad.

[abudhu]

Darn't You beat me to it. Welcome to the Club Apple.

[lnp]

The larger issue that I've posted here before is that antiviral software isn't just to prevent an individual from getting a virus. While a good program certainly does do that, I view my anti-viral program as a way to make sure I don't pass a virus containing document to a PC friend of mine. It kind of goes along with the concept of herd immunity...if more people had anti-viral programs, viruses would be less attractive to write.

[abudhu]

And yet another one:

http://www.theregister.com/2006/02/17/macosx_bluetooth_worm/

Proof-Of-Concept again.

[jharriso]

Looks like there is a fairly serious vulnerability in Mac OS X:

http://isc.sans.org/diary.php?storyid=1138

Mac bugs galore!

[trees]

Please see http://forum.oscr.arizona.edu/showpost.php?p=8987&postcount=13

[lnp]

Just as a heads up to the consultants in the labs today, news of a "in the wild" OS X virus have been making the rounds on CNN and Newsvine. As far as I can tell, its no so much "news" as reporting of the same proof of concept stuff that we talked about earlier. Essentially the story is that some dude was attempting to download an unreleased OS update from some unnamed website and got bitten. Clearly, he's a winner in the first place ;) .

Here's the link so you can read it for yourselves: http://www.cnn.com/2006/TECH/04/30/apple.security.ap/index.html

Also, the creepiest photo of a "security consultant" I've ever seen.

[sfontes]

Wow...that's definately a stroke of genius. Let's download an unreleased update from some link!

Yeah..he's creepy. :/