Mac malware threat getting serious
The first construction kit for creating Trojans for the Mac OS X has appeared; it may auger tougher security times ahead
CSO - Apple -- and many Mac users -- have argued that Mac OS X has a special recipe for security that makes it less likely to be infected with malware. Many security researchers counter that the Mac's seeming immunity stems not from its security, but from its lack of market share.
The debate may finally be settled.
The emergence of a serious malware construction kit for the Mac OS X seems to mimic a 2008 prediction by a security researcher. The prediction comes from a paper written in IEEE Security & Privacy ( in .pdf), which used game theory to predict that Macs would become a focus for attackers as soon as Apple hit 16% in market share.
Security researchers pointed to the recent emergence of the construction kit for creating Trojans for Mac OS X as a major issue for Mac users. Currently, three countries -- Switzerland, Luxembourg and the United States -- have Mac market share at around the 16% level.
"The kit is being sold under the name Weyland-Yutani Bot and it is the first of its kind to hit the Mac OS platform," Peter Kruse, partner and security specialist at security firm CSIS, writes in a blog post. "CSIS finds this crimekit to be quite disturbing news since Mac OS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years."
Weyland-Yutani Bot, named for the corporation in the 1979 movie Alien, is currently being sold by its developers. While it is not the first attack on the Mac OS X, crimeware has enabled criminals in the past to scale up attacks quickly.
"What is happening is that people are testing the waters," says Adam O'Donnell, chief architect of the cloud technology group at SourceFire and the author of the 2008 paper. "It just becomes economically viable to do it, so you start seeing these attacks becoming more common."
The 2008 paper calculated when attackers would start seeing a payoff in focusing on the Mac OS X over Windows. It simplified the problem by assuming that all PC users ran antivirus software and that no Mac users did. The assumptions helped reduce the problem down to two factors: the effectiveness of the defenses and the market share of the dominant platform.
With detection rates for antivirus in the 80% range, the Mac OS X becomes an attractive target around 16% market share, the paper predicted. If PC defenses are better than 80%, then the Mac market share at which attackers become interested drops. For example, if antivirus programs detect attacks 90% of the time on the PC, then attackers will focus on the Mac OS X at approximately 6% market share, says O'Donnell.
"It is much more of an argument that at the low rates of penetration of the Mac in the market is why there is no malware," he says. "You get a few points up, and like we are seeing now, you will start seeing malware."
Will the same model work to predict when significant malware will appear on smartphone handsets? Not necessarily. One of the assumptions is that the value of compromising a PC and Mac are identical. That assumption is less likely to hold up between a PC and a handset.
"The difference between a PC and a handset is that there is going to be different values in attacking each," O'Donnell says. "That difference will be a big factor in when people move to attacking a new platform."
Read more about network security in CSOonline's Network Security section.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!