Macs aren’t immune from malware attacks.
After conducting an e-mail interview with Charlie Miller, who has gained notoriety in the Mac community by compromising the Safari Web browser on a Mac laptop to win the PWN2OWN contest two years running, I’m now convinced Macs could easily fall prey to malicious exploits.
I know the notion of Mac vulnerability is unpopular, but Miller makes convincing arguments (see the full interview below). And unlike vendors of anti-virus software, Miller and the company he works for – Baltimore-based Independent Security Evaluators – have nothing to gain (ISE is a consulting firm that analyzes applications for security holes).
Miller has an impressive background: He worked five years for the National Security Agency before becoming a principal analyst at ISE. He’s written two books, one of which is “The Mac Hackers Handbook.”
Furthermore, Miller likes Macs; he prefers them, in fact. His primary computer is a 1.83 GHz MacBook. Although he’s won both a MacBook Air and a MacBook Pro at the PWN2OWN contests, he prefers his trusty old MacBook.
Mac susceptibility to malware is not as black and white as many people believe. Apple haters celebrated Miller’s feat; Safari was the first browser to fall in last week’s contest. (Internet Explorer 8 and Firefox also were breached, but Google’s Chrome was not.)
Meanwhile, the Mac community mostly jeered, noting Miller had prepared his exploit in the weeks before the contest. Although true, it doesn’t change the fact he discovered a valid hole in Safari’s code. Mac users should be less critical and more concerned.
And frankly so should Apple. Imagine the PR disaster that would ensue should an exploit for the Mac become widespread. It would punch a huge hole in one of Apple’s major selling points for the Mac – as a safe alternative to malware-plagued Windows PCs.
Now, the interview:
Q: I've been reading the fallout your, er, exploits have caused: cheering from the anti-Apple crowd, defensiveness from the Mac users.
A: Yes, I mostly notice the defensiveness of the Mac fan boys. I've had them say I cheat, that it’s only in the open source components (which
it isn't this year), that I'm out to ruin Apple, etc. Some people
can't face the reality when it’s staring them in the face. I probably
haven't made a lot of friends with my new book "The Mac Hackers
Handbook" co-authored with Dino Dai Zovi, the guy who won Pwn2Own three years ago.
Q: Should Mac users be worried?
A: They should definitely be a little worried. Any security expert knows
that Mac OS X is less secure than Windows. The question is which is SAFER. Because Mac OS X is still relatively rare, it is actually a
little safer. But it has nothing to do with it being more secure, but
rather, that bad guys are entirely focused on Windows at the moment
due to the overwhelming market share Windows has. At this time, I
still don't recommend anti-virus for Mac OS X users, because there
simply isn't much malware for that platform. However, if Mac OS X
market share ever goes up, there will be a landslide of exploits and
malware.
Q: When you say "landslide of
exploits," does that include self-replicating viruses such as those that plague Windows and spread around the globe within hours? That's not supposed to be possible on OS X, so they say. Could someone get control of my Mac at home, which is behind a router with a firewall
(but sans commercial AV software)?
A: Yes, it is built upon UNIX. However, there is a ton of Apple
developed software running in Mac OS X, so that is mostly irrelevant.
Being based on BSD, there probably isn't a remote root in the TCP
stack, but it doesn't affect whether there is a bug in Safari of Mail
or how exploitation would fail. So yes, a BSD box is very secure. A
BSD box with Safari, Mail, mDNSResponder, iChat, etc is as likely to have bugs as any other operating system.
As for a worm, I could imagine a bug in Mail being wormable, as an exploit could mail itself to all the people who have sent you mail, etc. You are protected from server side attacks from your router, but
then again, so is your Windows PC.
Q: I understand one common objective is to
take control of a PC to use it as a spam-sending zombie. Is that the kind of thing that could happen to Macs?
A: Yes, everything you could do on a Windows machine: turn it into a
"bot,” send spam, perform DDOS [distributed denial of service], etc. can be done from a compromised Mac.
Q: Has Apple been remiss in leaving so many holes in Safari?
A: All software has bugs, so I can't really blame them for that. Safari
may seem to have more bugs because it tries to do more. It tries to make the user experience nice by handling hundreds of different file
formats and URL handlers. With more code come more bugs. (For
example, Safari comes default with Flash and Java installed, Windows
doesn't. I personally like this but it does increase the attack
surface).
Q: If it is indeed so easy to hack OS X, shouldn't we have seen at least a few examples of malware in the wild by now? The Mac's share has been growing in the past two years, especially among the
group least likely to protect themselves: consumers.
A: I think the reason is economics. Hackers don't do things for fame
anymore; it’s a business. It simply isn't profitable to try to make a
botnet of Mac OS X machines when there are so many more Windows
machines. I like to say that if 90% of computers are Windows
machines, bad guys will spend 100% of their time on Windows, not 90%.
Q: Is Windows, at its core, more secure than Mac OS X? And why is the iPhone less vulnerable?
A: Yes. It’s not about the bugs, but rather the technologies which make it difficult to go from a bug/vulnerability to a bad guy running code
on your system. Windows has it, OS X doesn't. The two technologies
that Windows has that Mac OS X lacks, specifically, are Address Space
Layout Randomization (ASLR) and a non-executable heap. These two
things make it very hard to write exploits (the code that gains
control of your computer) in Windows.
IPhone is more secure than OS X because it has a smaller attack
surface (Mobile Safari doesn't try to do everything in the world) and
it has some anti-exploitation technologies built into it (specifically
a non-executable heap).
Q: Do Mac users need to do anything now to protect themselves, or is it safe to wait until the exploits appear?
A: If you are paranoid, there are some steps you can take, the most basic
being anti-virus. However, at this time, I don't think its necessary
considering the expense and potential slow-down versus any benefit
gained.
Q: Could Apple make some easy changes to OS X to make it less vulnerable? Or are the problems so deeply rooted in the OS that major code revision would be needed?
A: Most of the changes are pretty major and will have to wait for Snow
Leopard at least. I heard a rumor that Snow Leopard will have ASLR
for example, although I don't know if this is the case.
Q: Do you think Apple has been too cavalier toward security in Safari and the Mac OS? Does Apple need a Bill Gates-like initiative to start
closing the most obvious holes before it’s embarrassed by a wave of malware?
A: I think Apple has stepped it up in the last couple of years but could definitely improve. It boils down to economics. Apple is in business
to sell computers. Frankly, that is all they care about, as any
company should. Consumers feel Macs are more secure than Windows
(even though they are wrong). Where is the economic incentive for
Apple to spend money on security in light of this fact?
I have been
talking about this issue for a while because I don't want it to come
to some large worm or other security issue to force Apple into action,
although I'm afraid that is what it will probably take. I want to see
Apple become more secure. Until the bottom line is affected, I don't
see major changes coming from them. Ironically, Microsoft spends a
ton on security, is more secure, but is perceived as less secure!
For further reading, Tom’s Hardware conducted a much more technical interview with Charlie Miller earlier this week.
