Month: October 2012

I sent a link for free virus software to a person I knew had just purchased a bright shiny new Macbook.

This person is transitioning from a run of PCs that they had nothing but trouble with.

I think I now know why they had difficulties with their PC.

Here’s the reply I got after sending the link.

Thanks!
I have been told that Macs don’t need antivirus software. Is that not true?

Sent from my iPhone

 Ok I’m thinking “The Antivirus software is FREE, I’ve been using it for years as a licensed user. I PAID for it… I explained this all when I sent you the link. Why is this even a question?“

I suppose that I was a little annoyed about it too.

Which led me to write the following…

I’m sure that some of my friends in the computer industry will take exception to portions of what I’ve written here  Guys, comment away! You know me, I’ll post your comments and I’ll correct any misrepresentations in the technical aspects of what follows. I’d ask you to bear in mind that I’m trying… and failing to keep my response as non-technical as I can.

All computers are susceptible to viruses.

Computer viruses do not spontaneously occur they are created specifically to cause mischief or damage.

A computer virus is no different than any other program running on any computing device.

Even the computer in your smart phone is susceptible.

The question is…

Has the computing system that you are using presented a viable target?

The PC operating systems, because of their completely OPEN nature (Early on there were no checks on any program the system executed) and the fact that they were cheap made PCs, easy targets.

Since the PCs were also fairly ubiquitous it made a lot more sense for the nefarious elements in our society to concentrate on them. After all if you’re seeking attention you want to make a big splash.

What bigger splash can you have than 50 million PC owners freaking out about a piece of software you wrote, getting into their computers and saying “Doomsday is here” all over their computer screens. Or if you’re trying to fleece money from people PCs still represent the biggest return on your investment of time.

It’s just a matter of numbers.

Back in the day, a Mac used a completely different CPU than most PCs on the market. That difference provided a measure of security because the PowerPc CPU used a different instruction set than an Intel CPU

Now the very same Intel CPU runs Apple Computers and any Windows computer.

That translates to a potential vulnerability.

Thankfully, this vulnerability isn’t one that the average 14 to 20 year old hacker can easily exploit. There are very few people in that age range that have the requisite knowledge of machine code to create a program where they could command the CPU directly to do something untoward. It’s possible, but unlikely. (It’s likely that the Virus used to cripple Irans uranium refineries was a virus built in low level machine code. By the way, the virus in Iran attacked the controllers for machines running the centrifuges but did little damage to the PCs in the labs.)

You don’t need to be a government or have a cadre of high-level programmers writing machine code…

There are far easier ways to compromise the average computer. There are even “Tool-Kits” that can be downloaded from the internet for free that will assist a budding hacker in the creation of a virus.

This is possible because most modern devices include by default, or have provisions for running high level language interpreters

Java is the most ubiquitous. This language runs on PCs, Macs, smart phones, tablets, and I’ve even heard of some navigation systems using it.

This means that a Java application written by a bad person, could run on a Mac or PC, could have direct access to the data stored on either machine, and could at the option of the applications creator, transmit any information of interest to a remote computer or simply erase selected files with little trouble.

I’d bet that Barnes & Nobles card readers used Java or some other high-level language. Their card readers were infected and independently collected then forwarded customer names, card numbers and PIN numbers to an outside party. All made possible because someone realized that the software running in the card reader was independent of the computer the card reader was attached to.

As an aside, this is the kind of stuff that kept people like me up at night… that is before everything got off shored and businesses decided it was reasonable and appropriate to throw older computer workers in the dust bin… Now I think it’s just desserts, I’m waiting for the first lawsuits over this kind of data compromise. After all, there is the reasonable expectation that swiping your credit card INSIDE a store at a point of sale terminal is going to be secure…

Microsoft also includes in it’s applications a scripting language.

This means that any computer running Microsoft Office (Mac or PC) is potentially vulnerable to attack. That attack starts as simply as the user opening an infected Word Document.

To Microsofts credit, they have taken great strides toward preventing this kind of attack. However, the convenience features that the scripting language provides are balanced against the risk.

It’s possible to trick someone into executing a script that would simply erase their hard disk. It’s also surprisingly easy!

The reason that viruses proliferate is that a large percentage of the people in the world are always vulnerable to infection. Either because they’re going to websites that are compromised or they have no virus protection software.

This translates at minimum into some 14 year old getting national or world wide media attention because the virus they created freaked a bunch of people out.

OR

The darker side of the coin is this. Viruses are big business.

You know all that spam email you get? Often the address lists for those spam emails are generated from a PC that’s been infected with a virus.

Your address book is nothing more than a data file. It’s not terribly different from a Word or Excel document. The virus looks for the address book file, then opens a link to a server or website and transmits your address book to that remote site. It happens in 30 seconds or less and you never notice. The very same thing could happen to your Quicken files or your Money files or anything else of interest.

In the case of your address book  the remote sever packages up an email loaded with links to other bad websites and sends it to all your friends making it appear that you sent them this neat, funny joke or recommended a service. It’s profitable because if less than 1% of the people open that email, then they get infected, and their address books get sent to the bad guys.

If less than .025% of the people receiving that spam email actually provide financial information like a credit card # to purchase a bogus service then the bad guys are making a ton of money. (See Barnes & Noble…)

Even if no-one ever gives out their credit card #, the Bad guys still make money SELLING a list of current, valid email addresses to other bad guys or sometimes to legitimate companies seeking to market their products.

Which is how you end up on email marketing lists for stores that you’ve never shopped at in your life.

Bottom line.

1) All computers are vulnerable to virus infections.

2) The myth that Macs are invulnerable to Viruses is exactly that… a Myth. (At one time… it was probably 90% true because Apple wasn’t that big a target, those days are past.)

3) Even if your computer isn’t capable of executing the virus, it can still propagate the virus via sharing of documents.

I could bring social responsibility into the discussion… But I won’t.

Virus protection is always a good idea. Free Virus protection is even better.

I’ve always thought of antivirus software like having a condom,

Better to be safe than sorry…