Adobe Flash and Acrobat have also been the source of Mac trojans. There will always be vulnerabilities in 3rd party software. I have not yet heard of anything taking advantage of security holes in OS X (other then Hackers, but we are talking about viruses here). Fortunately Macs are sand-boxed well enough that a trojan shouldn't be able to do more then the infected app can do. I wouldn't be surprised if OS X even sandboxes the documents directory separately (like the iPhone) for each application in the future (Lion maybe?) to make this even less of an issue.
Why not, if they didn't understand the concept of a digital signature? It's all well and good that OSX warns you that something might be up, but by using poorly understood terminology, they increase the risk that a user will blow through the warning signs.
exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.
SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
Good point. How can a program that does malicious things that you _deliberately_ install be considered a trojan? Sounds like this is a misclassification by these "security firms".
It looks like in the near future I may have to purchase antivirus, no?
No.
Quote:
Originally Posted by esummers
Adobe Flash and Acrobat have also been the source of Mac trojans. There will always be vulnerabilities in 3rd party software.
Quote:
Originally Posted by esummers
Good point. How can a program that does malicious things that you _deliberately_ install be considered a trojan? Sounds like this is a misclassification by these "security firms".
Do people not read threads before posting in them? You seem not to understand what a Trojan is, but if you'd read the thread you may be enlightened.
To expand on what's been said already, think about the name: Trojan. Where does that name come from? Answer: the Trojan Horse. The whole point of a Trojan is that it makes the user think they want it, so the user installs it and runs it, but then it does unpleasant things. But you gave it your password, you gave it permission to run, it's your fault that it just pilfered all your contacts or deleted all your files etc etc. Trojans do not exploit OS or 3rd party software vulnerabilities, they exploit user vulnerabilities.
LOL, so the security firms are trying to sell users of macosx virus scanners, haha, 10 years now I have been using macs, never got infected with a virus or trojan. Man I tell ya, there are suckers and idiots born by the minute, I mean, from last I recall, under macosx, you're required to input your username and password to perform an install right?
Sounds like the USER is the security flaw. Oh and I do not use virus scanners on my mac.
As long as people can be suckered into clicking on links designed to do harm to their computer, this will continue.
"Make something 'idiot-proof', and they'll just build a better idiot."
A professor in school used to say this. It's so true.
I develop medical software for hospitals, and no matter how "idiot proof" we make our software, invariably the help desk gets calls with issues that only a truly dumb person could have.
Nope, the security hole is the user, as Johnny Mozzarella said.
Yes and no. I mean the user is the one who initiates the installation, but Apple will be able to patch this so even if the user tells it to install, a secondary wall of protection will keep it from doing so.
A professor in school used to say this. It's so true.
I develop medical software for hospitals, and no matter how "idiot proof" we make our software, invariably the help desk gets calls with issues that only a truly dumb person could have.
Ugh. This kind of remark never fails to creep me out. Maybe you're not doing as good a job developing the software as you think you are. Ever consider that?
Yes and no. I mean the user is the one who initiates the installation, but Apple will be able to patch this so even if the user tells it to install, a secondary wall of protection will keep it from doing so.
Sure, OS X could be patched to protect users from their own stupidity in this instance, but the only way for the OS to protect users from all Trojans including ones that don't exist yet, is to go the iOS route of code signing and app vetting.
It is not getting rid of Java, check your sources.
Really?
Quote:
As of the release of Java for Mac OS X 10.6 Update 3, the Java runtime ported by Apple and that ships with Mac OS X is deprecated. Developers should not rely on the Apple-supplied Java runtime being present in future versions of Mac OS X.
One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).
Time and again coworkers (we use Windows ) will try to show me a problem they are having with their computer, and when I look over their shoulder they will click OK on anything that pops up in front of them. When I make them first stop and actually read the warning, much of the time that tells them what the problem is...if only they had stopped to read it the first time!
The problem is that those same Windows users carry over that same bad habit when they switch to Macs.
Well I tend to do that only with the programs that I know and trust. Anything else that I didn't install or don't remembering installing I will simply deny it.
You sound like an idiot...removing java from the OS X install has NOTHING to do with the security of Java. If there is a security hole here, it's the fault of the OS, not the plug-in.
Maybe. How many other OSes are affected by this exploit?
Comments
"Make something 'idiot-proof', and they'll just build a better idiot."
If there is a security hole here, it's the fault of the OS, not the plug-in.
Nope, the security hole is the user, as Johnny Mozzarella said.
Why not, if they didn't understand the concept of a digital signature? It's all well and good that OSX warns you that something might be up, but by using poorly understood terminology, they increase the risk that a user will blow through the warning signs.
Excellent point.
exactly how does this "installer" then "modify the system" without specific admin/password permission like all other installs? or maybe it can't.
SecureMac and other security software firms keep flogging these "threats" that never materialize in fact. obviously to sell their stuff to suckers. and AI and other hit-hungry blogs play right along with this.
Good point. How can a program that does malicious things that you _deliberately_ install be considered a trojan? Sounds like this is a misclassification by these "security firms".
It looks like in the near future I may have to purchase antivirus, no?
No.
Adobe Flash and Acrobat have also been the source of Mac trojans. There will always be vulnerabilities in 3rd party software.
Good point. How can a program that does malicious things that you _deliberately_ install be considered a trojan? Sounds like this is a misclassification by these "security firms".
Do people not read threads before posting in them? You seem not to understand what a Trojan is, but if you'd read the thread you may be enlightened.
To expand on what's been said already, think about the name: Trojan. Where does that name come from? Answer: the Trojan Horse. The whole point of a Trojan is that it makes the user think they want it, so the user installs it and runs it, but then it does unpleasant things. But you gave it your password, you gave it permission to run, it's your fault that it just pilfered all your contacts or deleted all your files etc etc. Trojans do not exploit OS or 3rd party software vulnerabilities, they exploit user vulnerabilities.
No.
I see now, you have to manually install it too allow for it to affect your system. Not much of a Trojan is it?
I see now, you have to manually install it too allow for it to affect your system. Not much of a Trojan is it?
Oh jeez
Sounds like the USER is the security flaw. Oh and I do not use virus scanners on my mac.
Oh jeez
This is me not reading the article because I'm using my iPhone.
And this is (one reason) why Apple is getting rid of Java and Flash on Macs, kids.
It is not getting rid of Java, check your sources.
As long as people can be suckered into clicking on links designed to do harm to their computer, this will continue.
"Make something 'idiot-proof', and they'll just build a better idiot."
A professor in school used to say this. It's so true.
I develop medical software for hospitals, and no matter how "idiot proof" we make our software, invariably the help desk gets calls with issues that only a truly dumb person could have.
Nope, the security hole is the user, as Johnny Mozzarella said.
Yes and no. I mean the user is the one who initiates the installation, but Apple will be able to patch this so even if the user tells it to install, a secondary wall of protection will keep it from doing so.
A professor in school used to say this. It's so true.
I develop medical software for hospitals, and no matter how "idiot proof" we make our software, invariably the help desk gets calls with issues that only a truly dumb person could have.
Ugh. This kind of remark never fails to creep me out. Maybe you're not doing as good a job developing the software as you think you are. Ever consider that?
Yes and no. I mean the user is the one who initiates the installation, but Apple will be able to patch this so even if the user tells it to install, a secondary wall of protection will keep it from doing so.
Sure, OS X could be patched to protect users from their own stupidity in this instance, but the only way for the OS to protect users from all Trojans including ones that don't exist yet, is to go the iOS route of code signing and app vetting.
It is not getting rid of Java, check your sources.
Really?
As of the release of Java for Mac OS X 10.6 Update 3, the Java runtime ported by Apple and that ships with Mac OS X is deprecated. Developers should not rely on the Apple-supplied Java runtime being present in future versions of Mac OS X.
Apple is my source.
It looks like in the near future I may have to purchase antivirus, no?
You just reminded me that I have to do my weekly Full System Scan for my Windows PC
One of the big differences between Mac users and Windows users that I've noticed is that Windows users are far more likely to click "Allow" or "Ok" or whatever button in a dialog box just to get rid of it without actually reading it. They are so used to so many of these things popping up in Windows they are conditioned to click through as quickly as possible so they can get back to work. I've even seen users enter their login and password in a dialog box that pops up even though they don't know which of their applications is asking for authentication (usually it's Outlook or IM, but it's hard to tell in the window that pops up).
Time and again coworkers (we use Windows
The problem is that those same Windows users carry over that same bad habit when they switch to Macs.
Well I tend to do that only with the programs that I know and trust. Anything else that I didn't install or don't remembering installing I will simply deny it.
You sound like an idiot...removing java from the OS X install has NOTHING to do with the security of Java. If there is a security hole here, it's the fault of the OS, not the plug-in.
Maybe. How many other OSes are affected by this exploit?