Mac Defender - Old Lessons, Still Unlearned

...

I use generic PCs and Linux because they are cheap.  I have (almost) nothing against Apple's OSX or even Microsoft's Windows except for their cost.  Now the truth is I would prefer Ubuntu, SUSE or Fedora anyway, because of the small footprint, flexible configuration and willingness to abandon legacy technology that makes the commercial OSs so huge and clumsy.  But all in all, it's really just an economic and personal preference decision.

But one of the most odious things about Windows is the hordes of clamoring, shambling malware always pawing at the doors and windows like a legion of the undead, requiring an unacceptable amount of time and money to hold mostly at bay.  I've had not one, but two computers slowly die, groaning under the weight of too much malevolent and greedy software, installed dishonestly or even surreptitiously.  It's an unpleasant and somewhat creepy feeling to know that there are constant probes and attacks coming in just under the surface, all manner of unsavory and straight-up criminal attempts to steal or break your stuff.

Now, there are two ways to protect an OS from software with bad intentions.  First, you can harden the OS.  This may seem obvious, but it requires users to understand and explicitly approve any software installation at all, and unbelievably, users seem to be resistant to this minimal effort to control their computing environment.  Second, an OS can develop an ecosystem of for-profit companies that provide subscription-based protection against MOST viruses and malware.  It is important to bear in mind that these companies would be out of business in a year if Operating System vendors actually DID ship a secure, hardened OS, so one has to be suspicious of the symbiotic profit relationship between these industry segments and wonder just how high a priority the elimination of these sorts of threats might actually be.  In fact, we already know that they have the capability to detect and defeat threats heuristically, but insist upon the older, less capable 'pattern matching' approach.  Why?  Well, could it be that pattern matching requires continual updates that lends itself well to a subscription based approach that creates a recurring revenue stream, where software intelligence that could detect and disable a threat based on its behaviors would be a one-time purchase at best?

But as for the Mac, OSX and iOS, there is no real technological impediment to creating the same kind of horrific miasma of infections, rootkits and malware as we see on Windows.  Sure, it might be a little harder to write these packages for the Mac, and it might require a little more in the way of social engineering to convince people to install them, but that's nothing that can't be overcome with relative ease.  No, the real reason that the focus has been on Windows has been the overwhelmingly larger numbers of potential targets in the field.  But Apple has been having a LOT of success, not just with the iPod and iPhone, but with their computers too, and that makes them a more 'interesting' target.  And importantly, this is a user base that has zero experience dealing with the kind of high-threat environment that is the every day user experience using Windows.

Which brings us to Mac Defender and the seemingly out-of-proportion buzz around what would, in the Windows world, be an unremarkable and garden variety attempt to extract credit card information from a particularly gullible user.  It seems to me that it signals a widening of the fetid swamp that surrounds commercial operating systems.  At least one group of MalWare authors decided that there are enough Macs in the field at this point that they now represent a viable and potentially profitable target.  And although the Mac Defender infection is a clumsy and easily avoided one, you can be certain that its success in penetrating and disrupting the Mac user community has been noted, and will be quickly exploited by both the MalWare development and Anti-Virus communities.  Think of it as nothing more than a proof of concept, with more toxic and destructive keyloggers and rootkits, along with a new marketing message to drive the adoption of commercial anti-virus software to follow.

In short, Mac users can now expect to have to spend more time and money fending off the multitude of exploits, attacks and probes that have been a constant in the Microsoft world for decades.  In that respect their life will become more like Windows users, and their experience with the online universe will be more adversarial, and much less pleasant.  The snake is loose in the garden and nothing will ever be the same again.
...