03 December 2008

We knew that

The Gizmodo 'gadget blog' has the story by Matt Buchanan:
Mac OS X, mythically immune to common computer plagues, has actually always welcomed antivirus software. Or, uh, maybe not. Confused? No worries—here's how OS X and Windows differ on resisting viruses and other nasties.
It's not a matter of opinion: OS X is less susceptible to catching a cold than Windows. So is Linux, for that matter. There are two major reasons (and Steve Jobs actually isn't one of them). First, Windows is on 89.6 percent of the world's personal computers, while OS X is on just 8.9 percent of them. Second, the Unix architecture that OS X and Linux are based on is inherently more secure than Windows, particularly pre-Vista versions. (If these reasons are familiar to you, you may not know the subtler side-effects of each reason that strengthen the case even more, so read on.)
There are a few different ways that Microsoft's mammoth market share actually hurts Windows and helps OS X. For one, writing nastiness that the vast majority of the world's personal computers are susceptible to is a more efficient use of resources than writing the same evil for a sliver of the population. In biology, a more homogeneous population is more susceptible to a genocidal plague. Same principle applies to the vast, Windows-powered ecosystem. I don't mean someone could write a virus that wipes everybody out. Just that if everybody's running Windows, the population is a much easier target.
The flipside of this—which you might not have considered—is that most malware writers obviously use Windows. They're going to whip up code for the OS they're familiar with and know best. And more to that point, most of the tools and scripts used to wreak havoc on computers are written for Windows. The same ecosystem that provides the biggest, most susceptible audience also provides the most fertile breeding ground for the nasty executables.
But suppose this was some bizarro world where OS X was king. Would Microsoft run ads about how virus-plagued OS X was? Well, it would still be more prudent to run anti-virus software, since there'd be a lot more crap thrown at the Mac OS, but if malware acted mostly like it does today, it likely wouldn't have the same impact as it did on Windows pre-Vista.
A lot of that is because of the way permissions work in OS X vs. Windows. Basically, Unix-based systems are architected so that they require administrator privileges to modify the OS and are traditionally more strict in enforcing them. Critical areas are walled off from normal users—you see this when OS X asks for a password to install updates or change a system setting. A standard non-admin user account is restricted; bad software can't wreak much havoc at all without that password.
This is precisely what Vista's somewhat-maligned User Account Control attempts to replicate, limiting points of intrusion and requiring explicit user permission to get anywhere deep. On Windows, historically, the enforcement of these restrictions has been lax in the name of convenience.
This is not to say that OS X is invulnerable, by any means. The main applications folder is relatively unprotected, and any running app can write to it and most of what's inside. Coupled with OS X's app-bundling architecture, this makes it easier to replace program executables or sneak in a piggybacking one. Even then, however, the malware would need to elicit elevated permissions to do any hardcore damage to the core OS; it could, unfortunately, nuke your relatively unprotected Home folder though. Another point of vulnerability, or at least a pain point, according to Mac Forensics Lab, is OS X's centralized address book, which also has weak defenses. If the Home folder book did require the same level of permissions, it would be kinda unusable, because you'd have to elevate permissions to make any and every change.
This brings us to OS X's biggest security hole, the one that it actually shares with every operating system: you. It doesn't matter how good baked-in security is if a user throws out the welcome mat for whatever crap comes their way. On the flip side, you're also the first, and best, line of protection. Don't do anything stupid, and you'll be fine, anti-virus software or not—whatever OS you're running.

No comments:

Post a Comment

No more Anonymous comments, sorry.