Mac Security vs Windows Security

Question

Is the Mac OS rapidly coming up to a point where it has the same amount of security flaws as windows machines?

The more macs in the world means the more people have them, and if more people have them, people can find the flaws in the OS, is this correct?

Answer 1

In the question you assume the Mac market share is rising. I'm not sure about that, and it requires to get some real numbers.

Regardless, looking at what happened with other major attack vectors, such as web browsers, once a product gains a big market share, it becomes a target. Take Firefox for example. When less than 10% of the users on-line used it, no one cared looking for exploits in it. Once the market share reached a certain percent, it became a target just like IE. Today, there's isn't a single exploit toolkit which doesn't target FF. Other examples: iPhone, Adobe Flash Player, Adobe Acrobat Reader, ...

Since (my assumption) no software product is perfect, I can only assume there are vulnerabilities in the Mac OS just waiting to be discovered. If finding these vulnerabilities would become profitable for the cyber-crooks, it will be discovered.

EDIT: I'm not sure there are more known vulnerabilities in Windows 7 than there are in OS X 10.6.

Answer 2

This is such a loaded question. There are flaws in all software, and flaws are relative because you're not taking into account severity.

For example, let's pretend I have an OS that has absolutely no remote access flaws. It is verified to have no bugs you can get to over the network. Unfortunately, if you hit the F6 and shift and numlock key at the same time at the console you can log in as root. That's a pretty significant bug. But over a network, it's absolutely rock-solid safe from hackers.

And what about the opposite? Where anyone can connect via a connection to port 37, for example, to a terminal session?

Then there's third party apps. Linux gets dinged by other vendors comparing vulnerabilities because companies like Microsoft count an APACHE vulnerability that gives access to privileged directories as a red mark against, say, Ubuntu or Red Hat. It's not something in the kernel, it's not their problem, it's the Apache foundation's. But it counts against them.

There's people who assume that the more people use it, the more of a target it is. That's still flawed, because it only serves your purpose if you are targeting those platforms for your purposes. For example, if you know how to remotely open a Chevy's car door with a hacked keyfob, would you sneak into a Ford dealership? Duh.

So if you're targeting servers, do you care about the number of people using Windows XP at home?

Or why are you hacking it in the first place? There was a time when hackers did things for reputation. Apple likes tooting the horn that they're far more secure than Windows. Well...what do you think gains more credibility points with fellow miscreants?

And no, the more that people use the software, it's not the case that they'll necessarily find more bugs. They find bugs in their workflow. That's it. Not many home users are hammering away at the IP stack finding flaws with buffer overflows. Two researchers hammering on OS X's IP stack are going to find far more bugs and flaws than thirty thousand home users sitting on their duffs playing World Of Warcraft. And neither of them are open source so they don't have full access to the source code anyway.

Then there's the tipping point. How many computers does it take to be a major pain in the butt on the Internet? Do some math and you'll see that crippling a major website isn't a task that requires half the planet's home PC's. There's MORE than enough Macs to do it. So whether your bot army is 500,000 strong or 50,000 strong, either one would make a nice platform from which to wreak havoc.

They're all vulnerable. The MOST vulnerable part is the people. If I can get you to install a program on your PC then you're a target. And it's your fault for installing that naked women of summer screensaver I told you was so nice but didn't tell you was also installing a keystroke logger when you gave the installer permission to write to the system directories. There was a study that showed most people would give up their computer passwords for a @#!%! chocolate bar!! C'mon! What good are your security measures if your users will spill their guts for a Hershey's bar? I have users that share passwords all the time. If you start a porn site and watch where users come in from, chances are the passwords users are using on your site will match or be of the same theme as what their company servers or company accounts are using. If they're all numbers you're probably going to end up with birthday information or social security number information, meaning maybe even access to bank records via ATM. Your VPN encryption and lack of bugs in your web server and careful sanitizing of database access on your fancy website isn't going to protect against dumb users with a password of "GOD".

Answer 3

I no longer fully buy the idea that Macs have basically zero malware problems primarily because of market share (currently 9.5% and growing the last I looked.)

I used to work for Apple tech support back in the 90's when Macs had a 2% market share. Mac classic was awash in malware. Every Mac user had to use third party anti-malware software. At one point, there were more Mac malware versions in the wild than PC. When the internet took off, it just got worse. Clearly, market share had little to do with people writing malware targeted at Macs.

Then Apple transitioned to MacOS X and the problem stopped cold. At first, I just assumed that crackers needed time to learn the new system and that "any day now" the first OS X malware would arrive and spread like wildfire. However, its been ten years now and nothing.

It's not just that MacOS X has a 10% market share and therefor just 10% of the malware. Macs don't have a single piece self-propagating malware and only two(!) trojans. Compare that to the estimated 9,000+ PC malware count. Even if we assume a "tipping point" that is for some reason much higher than that for Mac Classic, we should have seen at least a few dozen pieces of active malware.

The first person to write a virus for the Mac in ten years will be a cracker god. That alone should provide enough incentive for one of the millions of programmers out there to take a run at the Mac. Moreover, even though Macs have only <10% market share, that comes to 30 million Macs almost all running without any malware protection beyond that provided by the operating system. A clever cracker could make a huge fortune infecting just 1% of those Macs.

I don't know if the final explanation is technological i.e. MacOS X is simply highly secure or cultural i.e. people who learn to program Macs aren't interested in malware but clearly market share alone is not a significant factor.

However, the idea that more programmers equals more malware might have merit. There are far more Linux programers than Mac programmers and Linux does have a couple of dozen pieces of malware in the wild compared to two for the Mac so there might be something to the idea. But the scale of the problem between the Window's world and Linux/Mac suggest something else is going on.

Answer 4

As a user of both Mac and Windows I can only tell you that I have to apply a lot more Windows patches than Mac patches. Admittedly I no longer worry about reading all the detail about what those patches are for (life's too short!). As far as security being related to the number of users, I don't believe that's a real factor, at least not now.

The way I see it the prestige a hacker will gain from being the first to seriously compromise a Mac in a repeatable manner means there is more determination by real hackers to do so. On the other hand, most attacks on Windows machines are performed by kids (mentally, if not in years) who use tool kits created by others. The sad part is that this is often all that's needed.

Answer 5

As is often the case, the answer is "it depends"...

If your definition of "security" is strictly concerned about the traditional type of malware that you buy Symantec or McCrappy software to fix, than the answer is no. Although the security press has been talking about impending doom for many years, that sort of malware has yet to emerge on any Unix platform, OS X included.

If you are worried about privacy, tracking or other information leakage from web browsers, than YES, Apple browsers (Safari & Firefox) and ancillary applications like Quicktime and Flash are very similar to what you find in the Windows world, although I would argue that IE is still the worst browser from a security POV.

If you're worried about granualar access controls to files and folders and the administrative model for assigning administrative and other access rights in an enterprise setting, than I would argue that Windows client/Active Directory is the best solution out there.