Sophos selling Mac vulnerability
Have you ever had an auto mechanic you didn’t quite trust tell you that your car needed a repair “just to be on the safe side”?
The latest alarm bell from U.K.-based security software firm Sophos reminds me of just such a circumstance.
Last week Sophos announced results of a self-admittedly unscientific poll conducted on the company’s Web site. Of the 350 people who responded, 93 percent said they believed the Mac will be targeted more in the future, up from 79 percent two years ago.
This follows January’s annual “Security Threat Report” from Sophos that devoted an entire page to the “rise of malware for Apple Mac computers.” The discussion centers on the OSX/RSPlug Trojan that emerged last November.
Some of you may recall that Trojan – only a series of poor user decisions (starting with visiting the porn sites where the Trojan was found) can result in a compromised Mac. It does not exploit any vulnerability in the Mac operating system or software.
The OSX/RSPlug does not destroy data on a Mac, nor can it spread from Mac to Mac as a virus would. Instead it changes some network settings to redirect the user’s Web browser to fraudulent sites designed to fool users into punching in such personal information as credit card or bank account numbers (otherwise known as “phishing”).
Sophos was one of the companies to make a big deal out of OSX/RSPlug when it was first detected, trumpeting how Mac users of its security software were protected.
That’s right, Sophos makes Mac versions of its security software, so it’s no shock the company would have strategies to, uh, encourage sales.
Not that the folks at Sophos are lying. The OSX/RSplug Trojan is real, and some Mac users doubtless have fallen victim to it. But that malware relied upon user gullibility, not the sort of OS vulnerabilities that require dedicated security software.
Now Sophos offers a “poll” indicating rising fear among Mac users that the platform is increasingly likely to be targeted by hackers. Hmmm … I wonder who’s been contributing to that?
If nothing else, the Sophos poll shows the drumbeat of shrill warnings from Sophos and other vendors of security software have sunk in. Growing numbers of Mac users – and in particular switchers moving over from the malware-plagued Windows platform – have begun to consider the necessity of purchasing security software.
It’s like the auto mechanic telling you to replace your air filter because it’s better for the health of your engine, you’ll get better mileage, yadda, yadda, yadda. All true. But if your air filter isn’t dirty and isn’t due for replacement for another six months, maybe that auto mechanic is stretching the truth a bit to play on your concerns. So you replace the air filter.
No harm done exactly, but then again you didn’t really need it -- not yet, anyway. That’s how I feel about security software for the Mac. I have yet to see any hard evidence that Mac users truly need anti-malware protection.
I know that vulnerabilities in the Mac OS, Safari and QuickTime are discovered all the time, and that there have been numerous “proof-of-concept” exploits. Nevertheless, we have yet to see a single example of Mac malware that can spread in the wild.
In its annual report, Sophos predicts (as have others over the past few years) that the Mac’s rising market share will attract more attention from “financially motivated hackers.” I believe Sophos will be proven correct. But until we see malware that exploits a weakness in the software rather than the user, I’m not going to lose any sleep over it.
As long as Mac users let Software Update download Apple’s periodic security updates, use the Mac’s built-in firewall and -- most importantly -- exercise vigilance and common sense, they should remain safe.
If someday a particularly gifted hacker succeeds in creating a self-perpetrating bit of OS X malware, I will be among the first to buy and install security software on my Macs.
But not until.
