New Mac threats?

July 3, 2008 - 10:44AM

The anti-virus vendors have begun circling over Apple as the legendary virus-free status of its Mac OS begins to fade.

A victim of its own success, the global install base of OS X is now estimated by some to be approaching 8 per cent. Double that figure for developed countries, and it makes for a far juicier proposition for virus writers.

In addition, industry experts say the nature of malware is shifting, with the new breed of "socially engineered" threats far more effective at penetrating even the Mac's robust defences.

PC Tools is the latest anti-virus company to bring a Mac-flavoured solution to the market with a lightweight but highly targeted anti-virus and spyware tool that it says will offer an alternative to the bloated offerings currently available.

Now available in beta, the company said the product had been created to address the misconception that the Mac OS was inherently secure - which was not being backed up by its own internal research.

"Up until the end of last year there were only a handful of threats, but in calendar 2008 we have seen more threats that have both Windows and Mac variants," said Simon Clausen, PC Tools chief executive.

Research conducted by the company in the first quarter found that 95 per cent of all identified Mac malware threats were OS X related. Of these, 38 per cent were keyloggers, 30 per cent were hacking tools, 11 per cent were backdoors, and only 2 per cent were viruses.

Apple itself, which has built a number of security safeguards into the operating system, officially acknowledged the role of anti-virus software for the first time in its latest OS X Security Configuration Guide released in May, and even provides a link to a list of third-party suppliers.

According to Mr Clausen, the main type of malware targeting Mac users gets around OS X security by tricking the user into taking some seemingly harmless action such as installing a video. "That is an easier way of spreading threats because they don't have to go searching for holes in the operating system."

But a small proportion of this malware is actually targeting vulnerabilities in the Mac OS. Last week, anti-virus companies reported the release of a new Trojan targeting a flaw in the remote management of OS X versions 10.4 and 10.5.

According to anti-virus company, Symantec, the Trojan contains a piece of AppleScript that can be unwittingly picked up while transacting online, and is also circulating as a compiled script disguised as a poker game that downloads when the game is launched.

"I think the popularity of Mac platforms continues to grow in the context of there being no need for anti-virus software - and the product does do considerably well there," said Robert Pregnell, technical product manager for Symantec Australia. He confirmed, however, that the majority of new threats were now targeting user interactions more than computing devices themselves - making them less platform specific.

"On both platforms we should be thinking about more than just anti-virus protection - we should also be thinking about a client firewall, intrusion prevention, and anti-spam as a minimum."