ZDNet recently quoted security expert Eugene Kaspersky commenting on a recent rare piece of OS X malware in the wild:
“I think [Apple] are ten years behind Microsoft in terms of security,” Kaspersky told CBR. “For many years I’ve been saying that from a security point of view there is no big difference between Mac and Windows. It’s always been possible to develop Mac malware, but this one was a bit different. For example it was asking questions about being installed on the system and, using vulnerabilities, it was able to get to the user mode without any alarms.”
It is true that OS X benefits enormously from obscurity relative to Windows’ ubiquity by presenting less opportunity to criminals. But what’s driven me to expend the energy to write this blog posting is Kaspersky’s apparent ignorance of Apple’s protracted efforts to redefine the operating system contract in a dramatic way–with security no doubt as one of the foremost motives (and if not, certainly a material by-product).
This game-changer is (as anyone paying attention knows) the introduction of the app sandbox in Snow Leopard and Lion via the Mac App Store, and identified developers aka Gatekeeper, coming in Mountain Lion. If you’re in the consumer software business, I’m not sure how you’d miss these developments, but ignorance of them is even less excusable in the light of the success of iOS, which has pioneered OS X’s sandbox architecture on the world’s most popular smartphone. It’s done a pretty good job, given the complete absence of malware on iOS combined with the world’s largest app ecosystem (by at least one order of magnitude).
It is somewhat valid to point out that Gatekeeper hasn’t shipped yet and the app sandbox on OS X is opt-in and partial, but these are clearly initial, concrete steps towards migrating OS X from Unix openness to a consumer-grade, iOS-ish platform (that will presumably always let the power users opt back out into the wild west).
So yeah, Apple may not have setup a robust mechanism to respond to vulnerabilities in third-party code they modify and distribute (i.e., Java) as fast as we would like, and they may not have something as high-profile as Microsoft’s SDL to market security-consciousness to the world, but given how squeaky clean the platform has been traditionally, this seems rather forgivable (and solvable).
But it should be noted that while Microsoft has simply reacted tactically to insecurity for nearly a decade, causing untold misery and chaos for their users, Apple is taking steps to change the game. It seems that’s how they roll.
A decade behind? Hardly. But then, it’s not to hard to see how self-interest may have colored genuine perspective in this case. After all, the expert in question now has the opportunity to create a new market for their wares in a world where Windows’ dominance is finally on the wane.
UPDATE: Friday, April 27, 8:30 am
In the comments, Dan “dfabulich” writes:
I was right with you up until this point: “Microsoft has simply reacted tactically to insecurity for nearly a decade”
Vista was a huge step forward for platform security. ASLR, NX/DEP, Mandatory Integrity Control, and IE Protected Mode were huge at the time.
The problem is that Vista was late, and so buggy that nobody upgraded. Windows 7 security may be better than OSX Lion, but lots of people are still on Windows XP; their only real upgrade path is to buy a new computer.
I agree with Dan; I shouldn’t have written what I did about Microsoft. Whether Microsoft has reacted appropriately to the massive sea change in internet safety and security that occurred at some point in the 90’s / 2000’s is a separate issue and one I would have been wise to avoid.
But since I did step in it, let me expand on what was going on in my head when I wrote that:
While Microsoft is great at creating security patches and has introduced various technologies to make new versions of Windows more secure, they haven’t been at all effective at incentivizing people to upgrade to these versions of Windows nor at incentivizing software providers to require newer versions of Windows. It would seem that this latter point–putting secure software in users’ hands–is at least as important as introducing the new security features to begin with.
“see7” writes:
Regarding the Microsoft windows XP situation, this is where apple is now too. OSX 10.5 already ignored albeit still used by quite a few people (e.g. Some in our company) and I don’t think gatekeeper or whatever “magic” apple builds will be backported to even 10.6 or 10.7.
Consider that Windows XP was released in 2001; its Apple peer was OS X 10.0. 10.5 was released in 2007; that makes it contemporary was Windows Vista. Take a look at the relative marketshare between the two; Apple has done a fantastic job of migrating their users forward by any measure, certainly relative to Microsoft.
Is this because Apple users are fanatics under the thrall of a charismatic salesman? Maybe, but there’s a lot more to the Apple upgrade cycle than that. Consider all that Apple does in this regard:
- regularly introduce innovative operating system features that incentivize users to upgrade
- block developers from supporting older operating system releases without going out of their way (by regularly updating their developer tools and gradually removing older OS libraries and docs)
- dropping support for older hardware in OS releases
- aggressively pricing OS releases, making them extremely affordable relative to Microsoft
- rapidly refreshing the hardware line, which takes older hardware out of the system and brings an OS upgrade along for the ride
In my view, Microsoft is not as effective or aggressive as Apple in these points (though obviously the last one doesn’t apply to them directly at all, though given their leverage and influence with OEMs, they cannot be completely exonerated from the last point).
But is it really fair to hold Microsoft accountable for today’s massive Windows XP install base or claim that they aren’t viewing the problem strategically?
That’s a different point and not one I had intended to explore with this post. I’ll just leave it where I should have and say that I don’t think it’s at all accurate to characterize Apple’s position as ten years behind Microsoft.
Thanks Dan for calling that out.
Ben Galbraith 
Nice article. I can understand your irritation. I think a lot of this crap comes from us programers, and our creations, the software/hardware we create, having to deal with the business world. Programming at its best is a science, where as business at its best is the best spitter in a spitting contest.
I was right with you up until this point: “Microsoft has simply reacted tactically to insecurity for nearly a decade”
Vista was a huge step forward for platform security. ASLR, NX/DEP, Mandatory Integrity Control, and IE Protected Mode were huge at the time.
The problem is that Vista was late, and so buggy that nobody upgraded. Windows 7 security may be better than OSX Lion, but lots of people are still on Windows XP; their only real upgrade path is to buy a new computer.
Really?
Gatekeeper is just another Authenticode invented and widely deployed by MS in 2003.
FileVault is lame copy of old MS Bitlocker.
Xprotect and Filequarantine is weak and can not be competitor to Microsoft Smart Screen deployed years ago.
What about DEP, Full ASLR, SEHOP and BUR technologies used in Windows for year? No match on Apple side?
If sandbox is perfect silver bullet then Java must be invulnerable. But it is no the case in reality!
What about cadence of software updates? Whole problem of Flashback bonnet was created by Apple itself waiting 6 week to release Java update already available for all over platforms.
It is not just technologies Apple just lags behind in process and people.
One thing Apple is good at is bullshiting people about there security.
When I read the other comments it seems apples pr does again work well :|. Anyway, my knowledge in this area is not much but I have a clean windows albeit 7 system. And regarding the Microsoft windows XP situation, this is where apple is now too. OSX 10.5 already ignored albeit still used by quite a few people (e.g. Some in our company) and I don’t think gatekeeper or whatever “magic” apple builds will be backported to even 10.6 or 10.7. Apple arrogance at its best forces you to buy new hardware if you can’t upgrade. Or you do not want – quite understandably – to upgrade to the mess 10.7 at least in parts is. Maybe not 10 years behind but quite a bit and with the the apple arrogance not a good thing for users. Actually as a windows user I have to admit, I have a certain amount of Schadenfreude…
dfabulich: I agree with you; updated my post accordingly to address that and some of the other comments. Thanks all for stopping by.
I always spent my half an hour to read this website’s articles or reviews daily along with a cup of coffee.
Hello there! Do you know if they make any plugins to assist with SEO?
I’m trying to get my blog to rank for some targeted keywords but I’m not
seeing very good gains. If you know of any please
share. Thank you!
I used to be suggested this web site by means of my cousin.
I’m now not sure whether or not this post is written by way of him as no one else recognize such distinctive about my problem. You are amazing! Thanks!
hi thanks for posting like this topic,,, this is relay help users to select best antivirus for there needs.
Hey there! I’ve been following your blog for some time now and finally got the courage to go ahead and give you a shout out from Lubbock Tx! Just wanted to say keep up the excellent job!
If you are going for best contents like me, just go to see this web site all the
time because it gives feature contents, thanks
Your site could use some social media boosts. They can help
pc security http://www.store.legalnursenetwork.com/
It’s not my first time to pay a visit this website, i am visiting this site dailly and take pleasant information from here everyday.
You are so awesome! I don’t suppose I’ve read a
single thing like that before. So nice to discover another person with some original thoughts on this issue.
Really.. thanks for starting this up. This site is one thing that is
needed on the web, someone with a bit of originality!
Hey there! This is my first visit to your blog! We aare a team of volunteers and starting a new project in a community in
the same niche. Your blog provided us useful information to work on.
You have done a extraordinary job!
Hello, I desire to subscribe for this blog to take most recent updates, so where can i
do it please help.
Right here is the right site for everyone who would like
to find out about this topic. You understand so much its almost tough to argue
with you (not that I really will need to…HaHa). You certainly put a new spin on a subject which has been written about for decades.
Excellent stuff, just great!
%first_paragraphIt may be true or false and it is harmful for the people who are being gossiped about. It may be harmless sometimes but it affects one’s personal life. Gossips are mainly about friends, celebrities and politicians. Gossips and rumors are false news that spread from one person to another or group of people. Gossips and rumos are the titbits which are entertainment among the people when especially about celebrities and politicians.
At this time, I am going to do a very simple contrast to this pair of mobile phones. The phone is presumed to be offered to the public in September 2011. It really has been a while since the announcement of Nokia N9, even though it hasn’t been available yet, for most people, would rather wait-and-see than put into practice. The Nokia N9 was announced on June 21, 2011 at the Nokia Connection event in Singapore. If you appreciate N9, you may like it more after this contrast; if you don’t, now you’re able to realize why. As N9 is akin to N8 published last year, a lot of users may show concern in this.
i have been attempting to take advantage of the Nokia N97 mini to create a thorough review, but I consistently ended up placing it straight down quickly. The Nokia N97 mini appears damn exceptional and packs many features, but I would advise other gadgets earlier to this one Its hard to such as the S60v5 once more pursuing utilizing a Maemo equipment such as the Nokia N900. need to master what I think within of just one sentence?
It may be true or false and it is harmful for the people who are being gossiped about. It may be harmless sometimes but it affects ones personal life. Gossips and rumos are the titbits which are entertainment among the people when especially about celebrities and politicians. Gossips and rumors are false news that spread from one person to another or group of people. Gossips are mainly about friends, celebrities and politicians.
It has an excellent build quality and start-up time is quick. The Samsung N120 looks great and performs well. We still think it’s too high priced for the features it offers. Graphics – Intel Graphics Media Accelerator 950
We appreciate the lightness, the keyboard size and battery life of this notebook, which is contained in a nice convenient design. We especially like how the touchpad is responsive. The only thing we do not like so much about is money. The portability is due to its durability, low weight and battery life improved. Everyday tasks such as browsing and playing music or videos can be implemented without glitches. However, if you hope to do something more complex than that, it is better to choose another model.
Should you walk across the same path, there is Cervantes Street where Biblioteca Casa Museo can be found. Aside from the city hall building, San Fransisco Chapel that was built centuries back can be found here. This building used to be used like a library however it’s converted into a museum in addition to library and you’ll discover the writing material of Marcelino Pelayo who’s a well known author.
Everybody really wants to spend holidays at some wonderful place and the country may be the country that has lots of wonderful and interesting places. When you have planned to stay in HOLIDAY RENTALS IN SPAIN, it is a much looked forward to event for everybody, whatever age you are, as it is now time of the season whenever we can spend a while away from the hectic and monotonous daily life. The nation is overflowing with lots of great places, sceneries, beaches, monuments, palaces along with other sites.
Another type of gossiping is dishing which is done unintentionally. For example, Making an anonymous call and telling that the bomb has been fixed in a school, which is going to burst in few minutes. Fears or Concerns is involved with rumors being told about any life threats. Without any aim to cause pain to someone, telling something about him or her to others which actually cause pain. Likewise Tsunami Threat, Hijacking are some of the rumors which involve with peoples lives and concerns. It may be true or false. It involves with many lives and it leads to bedlam. It actually brings embarrassement to him or her who is being told about.
There are more than ten beaches in this city which are all worth spending times. All of the beaches in this city are sandy and they are highly attractive for visitors. There are many modern places in this city now that can amuse people from all social classes. El Sardinero was developed in this era which was one of the modern coastal resorts of Spain at that time. Santander grew modern in the 19th century. The water on the beaches of Santander is crystal clear and the sunlight is enjoyable most of the year.
Whether you need your music player or your PDA or a navigation device, the N95 is there with you to help you stay connected. The Nokia N95 also has a striking user interface making it easier for you to find features and services you need. Nokia N95 is an ultimate multimedia computer bringing a range of multimedia features together like an outstanding photo and video capability and high speed connectivity. Nokia N95, an all in one multimedia device with an integrated GPS functionality, a 5 megapixel camera and support for high-speed networks, making it easier to watch and record videos, listen to songs, 2-way slide concept, take high-quality photos, browse the internet, or catch up on email while on the move.%
I used to be by no means bothered by the Cost in my testing interval and stored it on at all
times, except when showering.
Nowadays the SEO business gets a bad reputation from all the snake oil salesmen and outsourced companies around
Kaspersky Security Nonsense – The newest addition to my weekly read