
Apple Quietly Pulls Claims of Virus Immunity - w1ntermute
http://www.pcworld.com/article/258183/apple_quietly_pulls_claims_of_virus_immunity.html
======
reidmain
"Let's hope more Apple Mac owners are also learning to take important security
steps -- such as installing antivirus protection."

This is the worst possible step to take.

When I switch someone over to Mac I take the opportunity to recalibrate how
they see their computer as secure. I teach them to be more aware of what they
are doing and how potential viruses could infect them. I find this is 100x
more effective than installing antivirus software which is shit most of the
time and instills a fake sense of security.

I had a family member who would always click "OK" whenever a window popped up
in Windows or would blindly enter in their password because they figured
Windows was just annoying them. When they got their Mac I taught them that
whenever OS X opened up a window asking for their password or asked them if
they really wanted to open up a file, they should freak the hell out and be
100% sure of why that box appeared. I actually got a couple of phone calls
from them asking if certain popups were OK. Sure this was annoying at first
but after a week or two they started to understand why these things were
happening.

The great benefit of changing their way of thinking and making security a
priority was that when Flashback hit I told them that disabling plugins was
one of the best ways to prevent from being infected and they immediately
accepted this.

Macs are not 100% secure. No one should be under any delusions of this. But
teaching people why they are not secure is the solution. Not hiding behind POS
antivirus software.

~~~
hcarvalhoalves
All the noise the media is doing around this case is to actually drive a
demand for antivirus software for Mac. You don't see _any_ article mentioning
installing software from trusted sources (like Mac App Store), digital
signing, configuring firewall, keeping software up to date, etc. Their whole
point is to compare the Mac platform to the Windows one, so they can conclude
that installing antivirus software is the obvious choice.

~~~
cldrope
Thanks for recognizing one of the biggest downfalls of it. They could be
opening the Apple platforms for massive "protect yourself" scare sales.

------
brudgers
_According to Sophos U.S. senior technology consultant Graham Cluley, this is
a sign that Apple is starting to take security seriously. "I view the changes
in the messages pushed out by their marketing department as some important
baby-steps," he wrote in a blog entry._

The idea that the removal of technical falsehoods from Apple marketing copy
represents a watershed moment in their attitude toward the security of their
customers' computers is based upon a bar set remarkably low.

~~~
einhverfr
I keep trying to find a way to set it lower but I can't. Maybe someone can
help me.

~~~
mkaltenecker
You can’t set a bar for Apple because they just say nothing at all.
Interpreting Apple is akin to reading tea leaves.

It’s not a low bar, it’s just that Apple never says anything.

~~~
iuguy
That means the bar is glued to the floor. OS vendors should be looking to help
their users have a more secure experience, not finally getting around to stop
lying about security through obscurity as a positive feature because they're
no longer obscure enough.

~~~
shinratdr
> not finally getting around to stop lying about security through obscurity as
> a positive feature because they're no longer obscure enough.

That isn't what happened. It used to be true, now it's not so they changed it.
Security through obscurity was a positive feature, there is little denying it.

Just because it wasn't going to last doesn't make it positive and just because
you think it's not something they should be touting doesn't make it a lie.

> OS vendors should be looking to help their users have a more secure
> experience

For the record, Apple has been working on OS X anti-malware since 2009 when
Snow Leopard was released. It was a pretty cursory effort yes, but considering
Microsoft hadn't even released MSE yet at that point it's still not bad.

Marketing and engineering are two different departments. Just because someone
is writing dumb copy about security in the marketing department doesn't even
begin to indicate how engineers are tackling security issues in practice.

In other words, Apple is both helping users to have a more secure experience
(what do you think Gatekeeper is for?) and rolling back their boastful copy
now that it's no longer true.

How is that a bad thing?

~~~
iuguy
> That isn't what happened. It used to be true

Stop drinking the kool aid. It was never true. OS X was exploit central for
years. It was only the BSD base that stopped it from being exploitable from
the network. All the client side stuff Apple added for years was RCE-you-like.

Also a fundamental thing about security is the acceptance that security by
obscurity is not a defensive measure. Genuine security doesn't rely on it.
Smoke and mirrors might scare the wolves for a while but won't keep them away
for long.

> For the record, Apple has been working on OS X anti-malware since 2009 when
> the sixth major release of OS X was released.

That's right, 5 major releases of the OS with no anti-malware effort, and it
only became necessary for them to do it when it started to become an issue
because people were getting owned.

> It was a pretty cursory effort yes, but considering Microsoft hadn't even
> released MSE yet at that point it's still not bad.

Don't even bother comparing it to Microsoft. The source operating system
FreeBSD has been doing this for years before OSX even existed. Microsoft was
doing security way before MSE. MSE was held back because it had the potential
to damage industry partner relationships. If Apple releases an AV no-one
cares. If MS releases a good enough AV product the AV industry jumps up and
down because MS just stole their lunch.

> In other words, Apple is both helping users to have a more secure experience
> (what do you think Gatekeeper is for?)

Apple is not helping users to have a more secure experience. It's helping
users to have a more controlled experience - the controller being apple.
Gatekeeper is not a security measure, it's a tool designed to lock users into
the Mac App Store. Do you really think that an App in the Mac App Store has no
way of being malicious? Have you not seen what can be done by an app in iOS?

~~~
shinratdr
> Stop drinking the kool aid. It was never true.

It was always true, and it was a tangible benefit. Your arguments rely on it
being considered "genuine" security or an effective defensive measure. It's
not. That doesn't make it false, or not a benefit to end users.

> and it only became necessary for them to do it when it started to become an
> issue because people were getting owned.

What were people getting "owned" (ffs, I thought this was HN?) by in Snow
Leopard. Care to provide a real world example, because I know you're full of
shit. There was no well known dangerous trojan/malware/virus for SL that had
any notable number of infections. The anti-malware in SL was a preventative
measure.

> Don't even bother comparing it to Microsoft.

Watch me. I don't care about the reasons behind it, the long and short of it
is Apple introduced an anti-malware system in OS X before it was a big issue
and Microsoft pushed it until 2012, long after they've had countless brutally
utilized exploits.

> If MS releases a good enough AV product the AV industry jumps up and down
> because MS just stole their lunch.

So MS sold out their customers to please their partners? Yeah keep trying to
spin that one. And I'M the one drinking the kool-aid.

> Apple is not helping users to have a more secure experience.

Yes they are. FFS, you don't even understand what Gatekeeper is. FYI, it's not
just the Mac App Store. Do some research before you continue to run your
mouth.

> Do you really think that an App in the Mac App Store has no way of being
> malicious?

Of course not. Does it have a much, much, much smaller chance? Absolutely. Is
it far and away the most effective measure against malware besides not
installing anything? Also true.

> Have you not seen what can be done by an app in iOS?

An App Store app? No I haven't, care to demonstrate?

~~~
jpxxx
Dropbox, Skype, and Microsoft Office being distributed through App Store would
be a hallelujah moment for me beyond all other hallelujah moments.

A _staggering_ number of people I meet either can't get the job done, are too
intimidated to start, download some malicious garbage, get waylaid by virus
scareware, have no idea how to get the app into /Applications, get frustrated
with Auto-Start naggers, freak out on Sparkle update dialogs, or never figure
out how to pin the app to the dock.

Mac App Store is the answer to a lot of questions nobody "in the know" has had
to ask in a decade or three.

------
jiggy2011
Apple seem to be less interested in comparing themselves to MS and PCs in
general these days.

In ~2005 their entire marketing was based around trying to sell you a Mac as a
PC replacement "Your next PC should be a Mac".

I guess they are less interested now because it's a smaller % of their revenue
and most of the people who would want/can afford a Mac are already giving them
plenty of money so there's no desperate need to increase their market share in
that area.

~~~
silvestrov
Apple's current focus is iPhone and iPad.

Microsoft has zero market share in the table market ("there is no tablet
market, there is an iPad market"), and a very small share in the mobile phone
market.

When you are #1 in a market, you don't do comparisons.

The Apple Stores are probably the best marketing the Mac can ever get. So it's
better for Apple to spend money on the stores than on making TV ads for the
Mac. And so they have: <http://www.asymco.com/2012/06/25/the-face-and-the-
brand/>

~~~
technel
It's pretty clear that the next Microsoft v. Apple war is being waged in the
tablet market (the show is over for cellphones -- Apple won). Traditionally
Microsoft hasn't done well at competing with Apple on their own turf (mobile,
mp3 players, etc), but it'll be interesting to see what the Microsoft Surface
means for all of this.

~~~
mrich
Apple won big in smartphones, but Android has a bigger marketshare.
Competition between all smartphone vendors have made the customer the biggest
winner in any case.

~~~
wfarr
Is that even relevant when Apple is taking home the biggest slice of the
profit pie?

~~~
idspispopd
This article sums up quite a bit of why that is:

[http://www.thestreet.com/story/11586384/1/android-users-
dont...](http://www.thestreet.com/story/11586384/1/android-users-dont-know-
enough-to-matter.html)

------
esonderegger
I love the way the article only quotes two people, both from companies that
sell antivirus software. Not that their views should ignored just because of
who they work for, but their self-interest was clear.

The first suggests that Apple should be encouraging their users to install
antivirus software. My understanding is that Apple's position is the opposite:
3rd party antivirus software on OSX provides so little extra security that it
is not recommended. Does anyone know of a 3rd party antivirus application that
would have stopped flashback?

The second suggests Apple should do more to support older versions of OSX. I
view it as a positive, security-wise, that Apple does such a good job of
keeping its OSX users current. Mainly it does this by making new versions
affordable, but discontinuing support for old versions is an important part of
that.

~~~
trotsky
Mac OS X Security Configuration Guide:

[https://ssl.apple.com/support/security/guides/docs/SnowLeopa...](https://ssl.apple.com/support/security/guides/docs/SnowLeopard_Security_Config_v10.6.pdf)

 _Installing antivirus tools helps prevent infection of your computer by
viruses, and helps prevent your computer from becoming a host used to spread
viruses to other computers. These tools quickly identify suspicious content
and compare them to known malicious content._

Quoting the Snow leopard one since that seems to be the most recent. They've
also used stronger wording in the past: "Apple encourages the widespread use
of multiple antivirus utilities so that virus programmers have more than one
application to circumvent, thus making the whole virus writing process more
difficult." and "Regularly check for viruses on your hard disk using an anti-
virus program, especially if you download files from the Internet or share
files with others."

While I agree that the state of AV software is generally rather poor and
provides weak protection, I'd be surprised if the major AV choices didn't
prevent a flashback infection at least by the time it had become commonly
talked about.

------
zdw
"It doesn't get PC viruses" will, by definition, always be true. It's just not
as relevant as it used to be, as Windows is much better in this regard today.
If anything, this change is a nod to how the computing industry has moved on -
using a Mac is no longer PC virus avoidance, but more "use this because it's
great".

That said, most of the "virus" writers have turned to spyware and adware, and
other scummy malware that demands money, and there is nearly none of this on
OS X.

~~~
paulmcpazzi
>> "It doesn't get PC viruses" will, by definition, always be true.

Macs are PCs.

~~~
idspispopd
"PC" has been appropriated numerous times by vendors to mean a specific
platform. In the times were personal computers were less-standardised "IBM PC"
and later "PC Clones" referred to the platform and not "personal computer"
specifically. This naturally led to Macintosh computer being referred to as
Macs, even though they too are "personal computers".

The problem is that many people today don't understand the history of personal
computing and that "PC" has an established history of meaning a specific
mainstream platform. I think some mistakenly poke fun at Apple, as if they had
invented the label 'PC' for their ad campaign. When actually Apple merely took
advantage of this convenient, existing differentiator for their PC vs Mac ads.

Apple have been working references to other platforms out of their marketing
materials for years. Comparisons are no longer needed when a company has found
their publicly-held niche.

~~~
molmalo
just asking seriously.. aren't Macs x86 now? Doesn't that distinction comes
from the time when Macs used a totally different architecture (risc) based on
something called Ironically "PowerPC"? I still can't see the difference now.
Why then don't call Linux-PC or BSD-PC to others if based on the platform? I
may be wrong, but the way I see it its just something anachronistic with an
historical basis, but now just used for marketing purposes.

~~~
idspispopd
The early intel macs were "x86". The current line up is x86_64. Depending on
who you ask in the industry this is called AMD64, Intel64, EM64T, IA-32e. This
is the 64 bit platform as developed by AMD, it's not to be confused with
Intels IA-64 as sold in "Itanium" chips.

------
ghurlman
I don't think it's a sign of Apple taking security seriously as much as it is
a lawyer avoiding liability suits.

~~~
s_henry_paulson
I think any competent PR representative would have inevitably pulled those
statements, as they were never true even when they were written.

~~~
Zr40
Untrue. This[0] is what was written in 2010:

> The Mac is designed with built-in technologies that provide > protection
> against malicious software and security threats > right out of the box.
> However, since no system can be 100 > percent immune from every threat,
> antivirus software may > offer additional protection.

Something similar is still present in today's security page:
<http://www.apple.com/osx/what-is/security.html> (near the bottom)

[0]:
[http://web.archive.org/web/20100123154433/http://www.apple.c...](http://web.archive.org/web/20100123154433/http://www.apple.com/macosx/security/)

------
crazygringo
I'm genuinely curious... are there viruses that spread in OSX?

Not trojans or whatnot that require users to click on files they shouldn't,
but rather actual viruses that make use of vulnerabilities in OSX to spread
from computer to computer, either via Internet or thumb drives or something?

In other words, if I always follow responsible practices (never opening files
from untrusted sources), has there been any threat up through now that could
compromise my OSX installation?

~~~
jlouis
The real question to ask is not "Has there been?" but "Will there be?"

Given that Mac OSX is on the rise on the popularity scale I am almost dead
positive we will see a lot of increase in malware for OSX, even remote attacks
where the user will be infected even if he acts sensibly.

The risk of that happening to you though is fairly low. The risk of clicking
something and then getting malware through that is way higher, from a risk
point of view.

~~~
rimantas

      > Given that Mac OSX is on the rise on the popularity scale 
      > I am almost dead positive we will see a lot of increase
      > in malware for OSX
    

This was repeated so many times, over so many years. Yet OS8-9 had more
viruses in the wild despite much smaller market share.

------
mbq
Microsoft should put "doesn't get Mac viruses" on Windows.com.

~~~
MartinCron
Similarly, I always tell people that I don't get Dutch Elm Disease. Puts a lot
of concerns to rest.

------
mkr-hn
Apple tried to claim Apple PCs were special, but it didn't remove the single
biggest hazard to any claim of security.

PC means personal computer, which means a system owned by millions of people
without the technical skill to assess whether or not that attachment (whether
it's birthday_card.dmg or birthday_card.exe) really came from grandma.

All PCs are vulnerable to users. I'm glad Apple figured it out a few years
sooner than Microsoft did.

~~~
slurgfest
How do you figure that 'Apple figured it out a few years sooner than Microsoft
did'?

I don't endorse Windows. But for all Windows' brokenness, Microsoft has not
claimed invulnerability to viruses and has put a significant amount of effort
into improving security from XP to today. The main reason it has had more
trouble with malware is that it has been a much more popular platform, meaning
that is where all the victims are.

~~~
mkr-hn
Microsoft didn't make the same claims, but they showed the same lax attitude
toward security for years. Apple only needed to see a few malware outbreaks to
come to terms with reality.

------
allaun1
I'm mildly surprised no one has sued over this yet. And since I keep seeing
the mantra that flashback is a trojan. Here's some history: [http://mac-
antivirus-software-review.toptenreviews.com/histo...](http://mac-antivirus-
software-review.toptenreviews.com/history-of-macintosh-viruses.html)

~~~
demallien
Considering the effort that Apple marketing has made to make it clear that
"Macs" and "PCs" are not the same thing, it would be very difficult to win a
case, as Macs clearly _don't_ getinfected by "PC" viruses.

Which is not to say that your stement is wrong - it _is_ surprising that
nobody has tried to sue, even if they would almost certainly lose...

------
jpxxx
Free and unprofessional advice on how to avoid Mac malware and headaches:

\- DO NOT INSTALL A VIDEO CODEC PACKAGE

\- DO NOT RUN COPIED OR TORRENTED SOFTWARE

\- DO NOT DOWNLOAD ANTIVIRUS PACKAGES OR "SYSTEM CHECKERS"

\- Enable Firewall (System Preferences -> Security -> Firewall Tab)

\- Uninstall Adobe Acrobat Reader unless your PDF workflow absolutely requires
it

\- Disable Java immediately (Spotlight Magnifying Glass -> 'Java Preferences'
application. Uninstall Java entirely for extra credit.)

\- Make sure Adobe Flash is at the dead latest self-updating version and set
to auto-update (System Preferences -> Flash. Must be 11.3.x.x or greater)

\- Update all non-stock browsers to self-updating versions (Name of browser ->
Updates...)

\- Allow Microsoft Office to check for updates weekly. (Help -> Check for
Updates)

\- Allow Software Update to do its thing, at least weekly (System Preferences
-> Software Update)

------
ryegye24
>"Safeguard your data. By doing nothing."

For a brief moment after reading that I had to consider if the article was
satire.

------
Someone
This is somewhat of link bait. Yes, they changed the wording on their site,
but what do you expect them to do in addition? Plan a press conference about
the change? Have a press release? Of course it is "quietly"; Apple has product
upgrades that they do not feel worthy of a press release.

Back to the subject: this possibly/partly is a response to the outcome of a
complaint at an advertising complaints commission in the Netherlands
(correlation is present, but the Dutch Apple site still had the original text
while the US site had the updated text). They got the short end of the stick
there, but the commission cannot do more than naming and shaming
([https://www.reclamecode.nl/webuitspraak.asp?ID=76881&acC...](https://www.reclamecode.nl/webuitspraak.asp?ID=76881&acCode))

------
muraiki
Wow, I had no idea that they said stuff like that on their site. Even though
it specifies "PC viruses," the average computer user doesn't understand the
distinction. Just last night a relative mentioned how Macs don't get viruses
(which I corrected).

~~~
recursive
Are macs not PCs? Perhaps I'm an average user, but I thought PC stood for
"personal computer".

~~~
rmc
That depends.

To lots of people (myself included), "PC" means "personal computer" and
include desktop and laptops from Apple.

However in the 1980s/1990s, there were "PCs" and "Macs". PC was anything
running Windows (etc.) and a "Mac" was from Apple (i.e. a Macintosh). Apple
(and many Apple fans) continue to use "Mac" instead of "PC". I've had Apple
fans ask me if I use "a Mac or a PC?" (Since I use Linux, I don't know what to
say :P)

~~~
einhverfr
I usually say "I run Linux."

------
fjorder
While Apple's install base is steadily growing, I still think they have a
significant advantage in obscurity that grants them security.

i.e. Why do virus-writers target Windows? Sure, it has the largest install
base, but Windows also runs a lot of servers and embedded systems. These two
things are the real jackpots. What's taking control of one person's computer
compared to taking control of a server with credit card information or a
system running a billboard in Times square? Apple doesn't do embedded systems
and their servers, while some do exist, are exceedingly rare.

Is security through obscurity enough though? That depends on who you are and
how interesting your data is.

~~~
yalogin
What do you mean by obscurity? Which level of the system are referring to? You
seem to indicate that Windows is somehow open. Can you explain what you have
in mind?

~~~
fjorder
I said what I meant by "obscurity" and I did not say anything about Windows
being open, but I'll restate things in other words in case it clears things
up.

OSX and iOS are used predominantly to run personal computing devices. In
addition to PC's, Windows also runs a significant number of the world's
servers (although Linux dominates here) and embedded systems (see
[http://www.microsoft.com/windowsembedded/en-us/windows-
embed...](http://www.microsoft.com/windowsembedded/en-us/windows-
embedded.aspx)). Despite OSX and iOS gaining significant market share, virus-
writers may still find that the sweetest targets are disproportionately
running windows. OSX and iOS are more "obscure" in the sense that they don't
run many of the systems virus-writers want to target.

------
thebigshane
Can anyone here speak to the risk to FreeBSD (or other BSDs)? As MacOS becomes
more of a target, how much more vulnerable does FreeBSD become?

~~~
tedunangst
Most BSDs aren't running stuff like Bonjour which increases exposure to the
network.

~~~
tensor
Bonjour is just Apple's name for zero config networking which most Linux and
BSD distributions _do_ support to various degrees.

~~~
tedunangst
I was under the impression it also did file server and printer discovery among
other things. I know OpenBSD doesn't do that out of the box.

------
jodoglevy
Good to see Apple not contributing to the "Macs can't get viruses," "Macs
can't get spam" misinformation any longer. Users need to learn to defend
themselves, not just rely on the OS, which can't really protect users from
phishing attacks. Reminds me of this post:
<http://news.ycombinator.com/item?id=4004154>

------
cldrope
This is a great step. I am personally pretty hateful of Apple's decisions as
far as hardware lockdown and restrictive use, but it's a tradeoff they offer
customers and many consider it a good deal.

That aside, being more security minded as opposed to claiming immunity for
marketing purposes is a fantastic move and one to be applauded by the tech
community.

------
lawnchair_larry
This article invokes a memory of reading one of PG's essays about the PR
machine seeding news stories.

<http://www.paulgraham.com/submarine.html>

------
Uchikoma
Title should be "Apple (Quietly) Pulls Claims of PC Virus Immunity".

------
philip1209
This may be an offshoot of having an engineer as CEO - bringing a degree of
rationality to the marketing campaigns.

------
mkaltenecker
Being immune to PC viruses used to be a great advantage. You can talk about
theoretical possibilities all day long, in practical terms the difference used
to huge. Apple’s marketing exploited that – and why shouldn’t they?

Microsoft, however, has improved massively and that advantage is just not
longer there. PC viruses still don’t affect OS X – but they also don’t affect
any modern Windows very often.

