December 28, 2007

Hackers take aim at Mac OS X

2007's No. 3 most underreported tech story

The Story: It’s not often that an analyst covering computer security issues tells you that he doesn’t do much to protect his systems. But one reputable analyst I know said just that as we talked about the rising threat of malware aimed at Apple’s hardware. I won’t mention his name, but the gentleman is dead wrong. The days when you can assume that Apple’s products are exempt from harm are over.

[ Slideshow: 2007's top underreported tech stories ]

Is it time to panic? No, actual attacks against Macs and the rest of the Apple family, such as the iPhone, are still rare. But as the platform becomes more and more popular, hackers are gearing up to do damage. You’d better protect yourself.

“Most Mac users take security too lightly. In fact, most are quite proud of the fact that they don’t run any security at all,” says IDC analyst Chris Christiansen. “That’s an open door; at some point it will be exploited,” he says.

First some numbers: In 2006, the National Institute of Standards and Testing (NIST) tabulated 106 “vulnerabilities” in Apple’s Mac OS X. (It defines vulnerabilities as a weakness in the code that could be exploited to perform unauthorized, and generally harmful, functions by the application.) In the first six months of 2007 there were 78 vulnerabilities found in Mac OS X. Windows XP (all flavors), meanwhile, had 55 vulnerabilities in 2006 and 19 in the first six months of 2007. Vista, which wasn’t available in 2006, chalked up 19 vulnerabilities in 2007.

In a sense, Apple is a victim of its own success. Savvy hackers read the same stories and watch the same television programs as the rest of us, and so they are very aware of the burgeoning popularity of Apple’s products. Hacking Windows still provides a lot more bang per bug than attacks on Apple, but the smaller rival is a more satisfying target than ever before. And the company’s deserved reputation for building good products has probably made users overconfident.

“Apple has better commercials, but the Mac is no harder to break into than a Windows PC,” says Gartner security analyst John Pescatore. What’s more, most IT shops can automatically patch large numbers of PCs at the same time, while Macs generally have to be patched one at a time, he said.

The Bottom Line: Actual attacks on the Mac platform are still unusual. But as it becomes a juicier target, that will change. Why take a chance? Give a lot more thought to securing your Macs this year.

Complete list of 2007 underreported stories:

1.  Java is becoming the new Cobol
2.  Sun Microsystems is back in the game
3.  Hackers take aim at Mac OS X
4.  There are some threats you can worry less about
5.  Companies may have found a way around H-1B visa limits
6.  Open source’s new commercial strategy
7.  End-to-end Ethernet finally arrives
8.  Blade servers arrive for the masses
9.  BI is dead; long live BI
10. Balance of power shifts to software buyers








Read more about security in InfoWorld's Security Central Channel.

Bill Snyder is a contributing editor to InfoWorld. He also writes the Tech's Bottom Line blog.
Close

On Twitter now

Security

Powered by Twitter

On Twitter now

additional resources
White Paper - How to Improve Delivery of Advanced Web Applications

White Paper

Virtual Workforce: The Key to Expanding The Business While Cutting Costs

Get the independent advice and expertise you need to support a virtual workforce.

Go inside:
The three-step approach to making a virtual workforce a reality.
The four flavors of client virtualization technologies.
The three key initiatives that solve IT challenges.
Download now »
White Paper: Successfully Secure Your Wireless LAN With Wi-Fi firewalls.

White Paper

Addressing Linux Threats Leveraging Fewer Resources

The increase in Linux popularity has increased the frequency and sophistication of malware attacks. Read this 2 page white paper now to learn how you can protect your Linux environment with real-time protection that is certified by all major Linux vendors.

Download now »
White Paper - The 2009 Handbook of Application Delivery

White Paper

The 2009 Handbook of Application Delivery

Ensuring acceptable application delivery will become even more difficult over the next few years. As a result, IT organizations need to ensure that the approach that they take to resolving the current application delivery challenges can scale to support the emerging challenges. This handbook elaborates on the key tasks associated with planning, optimization, management and control and provides decision criteria to help IT organizations choose appropriate solutions.

Download now »
White Paper - Is Your Backup System Outdated?

White Paper

Mid-range Storage Considerations

A common misconception is that mid-range storage requirements are dramatically different than that of a larger enterprise. Mid-range storage users may require less capacity, but they have similar functionality and management requirements. This ESG paper examines mid-range storage needs and reviews a new solution that adjusts size while retaining value, performance and functionality.

Download now »

Sign up to receive Security Resource Alerts

Subscribe to the Security Central Newsletter

Stay informed of the latest security threats and fixes.

White paper

Log Management: How to Develop the Right Strategy for Business and Compliance

This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.

Download now! »

White paper

The Essential Series: Security Information Management

Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.

Download now! »

White paper

Aberdeen: Choosing and Consuming Managed Security Services

Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.

Download now! »
©1994-2010 Infoworld, Inc.