OSNews

Not particularly.

These equivalent programs get installed in Windows without the "root" privileges.

This means that privilege separation in Windows is just Palin broken and has been since they broke Ring 0.

If these users automatically put in the password when they don't know what in hell they are installing in the first place... then this is not a real problem with the OS design, but with the person operating the machine.

Someone installing a program outright in OSX regardless of its supposed or real intent does not constitute an OS design flaw.

That's really broken. I guess the only thing worse is Sony broken.

Actually, according to most security researchers, from a technical standpoint, Macs are more vulnerable than Windows. Apple has been pretty lax on security. Safari, for example, has more security issues than IE does. it's easier to root a Mac than it is to root Windows. The first commenter is correct. The only reason we don't see more widespread Mac infections is because it's not a high profile enough target.

Only if running as administrator.

Show me a Windows machine properly up to date, with a user running with a limited account, where he can install such applications?

They get installed as the current user if you are not an administrator, just delete the account, and you are good to go, just like in Unix.

It's only when you are running as admin do they get access to the entire machine.

Whatever makes you feel better, these "viruses" require you to purposefully download them and give them root privileges.

Mac users still don't have to care as per the usual since they can only get pwnt if they do something obscenely retarded unlike other OSs that will remain unnamed that might as well come preloaded with viruses since it already comes with preloaded malware 90% of the time anyways.

Visualize this: I'm playing a tiny violin for you M$ devoted folks.

As mention by others...this virus still relies on the Mac owner to be running Safari with auto-open safe files enabled.

Guess what...in Chrome for Mac, the file just downloads. Which means now I have the source for this wanna be virus. And now, because I have forwarded that downloaded zip file, all of the anti-virus companies and researchers also have it.

So .. until the hackers can figure out how to trick Mac users beyond a simple download and hope that the user will not only open the file, but run it, and give admin privileges - Mac virus impact are still a long way off in comparison. Oh, I am sure there will be at least one, but comparatively, Mac users are more savvy and don't tend to get caught up in dumb phishing or fake av traps.

On a side note...closing what ever browser you are running stops the Fake AV from running and moving to the download phase.

Jeff

Until about two years ago, it was possible to use DNS cache poisoning to trick a Mac into downloading malicious software updates from a bogus update server. Apple's update mechanism didn't properly verify the authenticity of the server it contacted for updates. Apple knew about this vulnerability for years, and did nothing to fix it until it was widely publicized and became very easy to do using a plugin for metasploit.

Also, a couple of years ago, there was a critical vulnerability in Java that allowed applets to break out of the sandbox. Apple didn't patch this vulnerability in their JVM until 8 months after Sun had announced it and patched their own JVM.

So there have been at least two cases in the past that I know of just off the top of my head where it has been possible to target Macs without tricking the user into running an application. One vulnerability was left open for years after it should have been closed. The other was left open for 8 months longer than it should have been.

Are they, now? Hmph, I had no idea, must've missed that memo.

Please pass along the study or studies this information was uncovered, as I would greatly enjoy reading them. Hopefully my tiny pea-brain of a non-Mac user will be able to comprehend it. If I'm lucky, they'll have pretty, colorful pie charts of "savviness".

Actually, according to more than one security research firm, Mac users are MORE likely to fall for phishing traps than Windows users are. The reason is because Windows users are well aware of these threats and that they need to watch out for them. Mac users, on the other hand, have largely bought into the Apple propaganda and such that their systems are immune from vulnerabilities. And the average Mac user lumps phishing traps right in with viruses and malware, believing their Macs to be immune to phishing traps.

So basically, the average Mac user is more likely to fall for a phishing trap because the average Mac user doesn't even know what a phishing trap is. Hardly what I would call more technically savvy than Windows users.

It also doesn't help that Safari and Apple's Mail.app are about the worst on the market when it comes to detecting phishing traps and providing the users with any kind of warning if something looks suspicious. So Mac users just go along fat, dumb, and happy, unaware of the threats to their systems. And because of that, they are more likely to fall for those threats.

Edited 2011-05-20 14:10 UTC