Ok, you want one, you got one:

http://www.symantec.com/security_response/writeup.jsp?docid=2006-021614-4006-99

Again to reiterate Victor’s comments, complacency can be dangerous. I’m not bashing the Mac at all – I use one every day, all day. I like it better than the PC! the problem is that I practice Defense in Depth so that when something does happen, I’m not one of those saying “I’m have a Mac, I’m invincible!”. I don’t want to be, nor can I afford to be in a situation where it comes back to bite me.

Sometimes a little proactivity goes along way. Ultimately, you are going to do what you want, because you’ll accept a certain level of risk. This may be one of those situations where you deem this risk acceptable. It is “my job” to be sure that you can make informed decisions. I know that this risk is not acceptable to me.

I don’t feel that Macs are invulnerable and I keep up to date with all my patches and updates as well. I just find that there is way too much FUD out stating that there are viruses with out support, or they go along with the old “security through obscurity” line. Come on guys, look at the source of your posts. Don’t you think there’s a little motivation behind that? That’s not a virus, it’s a worm, and it’s really social engineering. The only way you get infected is through your behavior. Just hit decline. I understand that there is always a potential out there for a virus to be developed some day, but my contention is that on the podcast, Larry stated that there are a few viruses out there on OSX. That’s just plane wrong.

Note my post called it malware not either a virus or worm. I am well aware of the debate. But that does not make it less malicious. Sooner or later someone is going to combine exploits against vulnerable systems either in the OS or applications. More likely both. All it will take is one that requires no user intervention, the exploit will run in the user context and move on from there.

The point being. Practice defense in depth and you will be better off for it. Do things like run as a normal user not admin and so on. The risk management decision is yours to make. We are just trying to help people make the best one they can.

Thanks for the feedback.

Hi Victor & George.
Avid listener, great show.
George mentioned something that I would love for you guy’s to expand on. Using SSH on a desktop mac to secure the session of a laptop using an open hotspot. I thought you needed to use something like openVPN to do this. I would be very interested on hearing how all the laptops connections to be routed (browser, mail etc) through the SSH connection.
Please Please Please Please Please Please Please Please.
I’m sure I’m not the only one.

Man, how I wish I had been able to participate in the live podcast on Sunday. Both George and Larry are exceptional when it comes to computer security on any platform. The same goes for Paul and I hope that Victor can have him as well as Larry and George back on really soon.

I’ve been a Mac user for many years, and in all that time I have rarely encountered any type of malware on the Mac (I can count maybe 2 or 3 instances, and that was in the old Classic Mac OS). Note that I didn’t say NEVER. Apple marketing has exploited the robust UNIX nature of OS X by saying that it is not affected by malware at all compared to Windows. As has been shown in the past many times, OS X (while more robust) is not impervious to exploits especially if the system is not patched (as is evident in the proof provided above). Sometimes for those of us who DO patch our Macs on a regular basis, the fact that Apple is slow to release many of the patches for known exploits (sometimes for months at a time) is cause for concern since it leaves the responsible users vulnerable to these exploits as well. So it’s important to heed the advice of Defense in Depth…it’s your only cover when you have no other.

Here’s another example. The GNU/Linux community is proud to say that GNU/Linux is quite secure, but they are also careful not to say that it’s not affected by malware/exploits. IMO, there are more exploits and malware in GNU/Linux compared to OS X. The difference is that those vulnerabilities are patched within hours at best, barely giving the bad guys an opportunity to even take advantage of the vulnerability, save for those systems that aren’t properly patched regularly. I even remember a privilege escalation exploit that “Twitchy” mentioned in the PaulDotCom Security Weekly podcast which didn’t even require knowledge of the root password! All you had to do was run the exploit as a regular user and voila, you were instantly “root”! This exploit has been LONG patched but I personally know of instances where systems running affected Linux kernels weren’t patched by the vendor because it would break their proprietary proxy solution.

If a community as large as the GNU/Linux community can accept that they are not invulnerable and can act responsibly, what makes the Mac OS X community different? As George and Larry said, operating systems are software created by humans, and humans make mistakes. Yes, Mac OS X is more secure by nature than a stock Windows PC, but it’s up to the user to be responsible and use preventative measures to avoid possible disaster in the future.