mac malware reality check

last month david harley wrote a really good piece about macs and malware... of course david is a writer (who i hope will forgive me if that's too much of an oversimplification) and has been following malware on the mac for as long as i can remember (you knew there was malware on the mac before osx, right?) so it's balance and reason comes as no great surprise... it was a fine piece of work...

perhaps too fine...

i regularly keep an eye out for new and interesting security related blogs and the name of adam o'donnell's blog NP-Incomplete appealed to the comp.sci. in me but some of his recent posts about malware for the mac (biological niches and malware prevalence, newsflash, its an issue of market share, not security), not to mention a heap of posts by others like rich mogull that i wrote about before, have made me wonder if perhaps a blunt instrument is called for instead... bluntness is something i ought to be able to handle, after all that's what being {c|k}urt is all about...

i think we need a reality check about where we are with respect to malware for the mac osx platform...

first, there are viruses for the mac osx platform... the first of which, osx/leap-a, has apparently even been seen in the wild by at least one anti-malware vendor (note the prevalence is not at it's lowest level as it is for the osx/inqtana-a)...

"but that's the old model", you say... "that's not what you need to worry about these days", you say... "it's all about the commercial malware now", you say... fine, then let's talk about the DNS changing trojan that was discovered last year... a port of zlob from windows to the mac... as craig schmugar pointed out on the avert blog, zlob was one of the most widely reported pieces of malware for windows and it was most definitely commercial malware...

"it's just one piece of malware" i can almost hear you saying - try one family of malware... it wasn't just a single instance that was made for the mac, there were many variants made as mikko hypponen clearly demonstrates... and if you have any doubts about how serious the zlob gang were about spreading malware onto macs you need only take a look at the posts alex eckelberry made for a while, while tracking the new instances found - it's a list that goes on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on... personally, i'm glad alex stopped filling his blog with these posts, but they certainly are useful for making a point... the point in this case is that some criminals have already started looking at the mac and they've decided it's worth the effort and expense to target them in addition to targeting the windows platform...

"but it's still just one case", you say... WRONG!... did you not hear about the rogue anti-malware apps macsweeper and imunizer? they were (as far as anyone knows) produced by a different group than the folks making zlob so that's at least 2 criminal enterprises that have moved to include the mac platform in their pool of targets...

the mac may not have crossed the chasm in the malware underground yet, but there are already multiple early adopters... as such it's no longer a matter of if the criminals will start targeting the mac, nor is it even a matter of when will they do it... the only question that remains now is how long will it take before it gets bad enough that people to wake up and notice... mac osx' age of innocence is over...