Malware Isn’t About Total Control
2007.02.27 prev next
BILL Gates has taken a lot of flak lately for claiming in his Newsweek interview that total-control exploits of Mac OS X are being discovered
routinely:
Nowadays, security guys break the Mac every single day. Every single day, they come out with a total exploit, your machine can be taken over totally.
Most of the criticism centers around whether his claim is factually true. Here, let me offer a different angle: Even if Gates’s claim is
completely correct, it’s still a distraction from the really important point about the malware problem in Windows.
Suppose I’m a malware author and I want to write a program that spreads itself from computer to computer, all over the internet, perhaps for the purpose of
building a “zombie” network that will eventually, on my command, send a flood of spam, or launch a denial-of-service attack.
First, I need a way to get into your computer. That’s where these “total control” exploits come in. So let’s say I find
one. Then I write a program that scans the internet for exploitable computers, and it finds yours. And it injects itself into your computer and takes
“total control.”
Then what happens? You immediately notice that something’s very wrong with your computer, because you can’t do anything. The OS
isn’t responding to your clicks and key-presses. Your apps aren’t responding either. My malware has total control of your computer,
so nothing else is running. After less than a minute, you hit the hard-reset button on your computer and bam — my malware is stopped.
Now let’s suppose my nefarious process is clever enough to retake control again as soon as the OS boots back up. Once again, you can’t use
anything because nothing is responding, so this time you turn the computer off (terminating my malware’s search for new computers to infect) and take it
somewhere to be cleaned or reformatted (thus erasing my malware). So my plan to make a zombie network is completely foiled at square one.
Successful malware doesn’t take “total control” of the computer — instead, it frequently gives up control to allow the OS and user
apps to do their thing, with no absolute guarantee that it will get control back. Successful malware must coexist with your OS and user apps for long
periods of time (months or years), while delicately searching for new computers to infect — and all the while awaiting my command to launch a
coordinated attack.
And, successful malware must survive with you at the helm of your computer, potentially noticing that something has infected your system, and potentially
attempting to remove it. This is where the real difference between OS X and Windows comes in: As discussed in John Gruber’s article Broken Windows, Microsoft’s OS permits processes to hide themselves within a horribly convoluted
system, so that even if you suspect you’re infected, you’ll have a horrendous time trying to locate, terminate, and remove the malicious
process(es). Conversely OS X, by design, makes it horrendously hard to protect processes from being located, stopped, and removed by the mildly savvy
user. This is the real malware vulnerability from which Windows suffers and from which OS X does not. This is why malware is virtually
non-existent for the typical Mac user. If I can infect a few Macs somewhere, but cannot create a self-regenerating, zombie army of compromised Macs, then as a
malware author I’ve wasted my time. I should have been writing for Windows! >smacking self on forehead<
It remains to be seen whether Windows Vista will really cure any of this. Just remember, when reading reports of newly discovered and newly patched
exploits in Vista — it’s not about getting into the machine, it’s about staying there. If Vista’s underlying technologies have
been sufficiently reengineered to prevent the creation of protected, buried, stubborn, rogue processes, then maybe the Windows malware nightmare is finally
ending. If not, it’s just getting started.
Update 2009.03.28 — Charlie Miller says:
Any security expert knows that Mac OS X is less secure than Windows. The question is which is SAFER. Because Mac OS X is still relatively rare, it is actually a little safer. But it has nothing to do with it being more secure, but rather, that bad guys are entirely focused on Windows at the moment due to the overwhelming market share Windows has. At this time, I still don’t recommend anti-virus for Mac OS X users, because there simply isn’t much malware for that platform. However, if Mac OS X market share ever goes up, there will be a landslide of exploits and malware.
Let’s all remember this quote, shall we, so we can laugh at it ten years from now.
Apple is selling millions of Macs per quarter, yet the Mac malware problem is virtually nonexistent (not “relatively rare” or “a little safer” as Miller tries to water it down). Meanwhile, just one Windows worm called Conficker is causing massive headaches for those who want to stop it — and threatens to do who-knows-what on April 1, just a few days from now — despite the fact that Microsoft and teams of security experts know all about it and have studied the crap out of it. (Microsoft’s own efforts to stop it have degenerated to offering a cash bounty for the apprehension of Conficker’s author. I’m not kidding.)
Charlie: Read my above article, and then you’ll understand why hacking into a couple computers at a hacker’s contest does not a malware threat make. If you still disagree, then here’s the real hacker challenge for you: Cook up a Conficker for the Mac, if you can. And don’t worry about Apple putting a bounty on your head. They won’t need to.
Update 2009.04.19 — OK, just heard that a Mac botnet has been discovered. That’s a point in Miller’s favor. But — the same report said that these Macs became infected when their owners downloaded pirated software from BitTorrent and other such sites, and that the illicit software was infected with a trojan horse. No word that this malware can’t be easily avoided simply by not acquiring software that way.
See also:
Malware Isn’t About Total Control
&
Security Through Normalcy
&
Security Through Obscurity Redux — The Best of Both Worlds
&
Basic Reproduction Number
prev next
Hear, hear
prev next
Best recent articles
Make Your Own FBI Backdoor, Right Now
Polygon Triangulation With Hole
The Legacy of Windows Phone
Palm Fan
Vivek Wadhwa, Scamster Bitcoin Doomsayer
Fanboy Features (regularly updated)
When Starting A Game of Chicken With Apple, Expect To Lose — hilarious history of people who thought they could bluff Apple into doing whatever they wanted.
A Memory of Gateway — news chronology of Apple’s ascendancy to the top of the technology mountain.
iPhone Party-Poopers Redux and Silly iPad Spoilsports — amusing litanies of industry pundits desperately hoping iPhone and iPad will go away and die.
Embittered Anti-Apple Belligerents — general anger at Apple’s gi-normous success.
RSS FEED
My books
Now available on Apple Books!
Links
Daring Fireball
The Loop
RoughlyDrafted
Macalope
Red Meat
Despair, Inc.
Real Solution #9 (Mambo Mania Mix) over stock nuke tests. (OK, somebody made them rip out the music — try this instead.)
Ernie & Bert In Casino
Great Explanation of Star Wars
Best commercials (IMO) from Super Bowl 41, 43, 45, 46, 47, 53 and 55
Kirk & Spock get Closer
American football explained.
TV: Severance; Succession; The Unlikely Murderer; Survivor; The Jinx; Breaking Bad; Inside Amy Schumer
God’s kitchen
Celebrity Death Beeper — news you can use.
Making things for the web.
RedQueenCoder.
My vote for best commercial ever. (But this one’s a close second, and I love this one too.)
Recent commercials I admire: KFC, Audi, Volvo
Best reggae song I’ve discovered in quite a while: Virgin Islands Nice
d120 dice: You too (like me) can be the ultimate dice nerd.
WiFi problems? I didn’t know just how bad my WiFi was until I got eero.
Favorite local pad thai: Pho Asian Noodle on Lane Ave. Yes, that place; blame Taco Bell for the amenities. Use the lime, chopsticks, and sriracha. Yummm.
Um, could there something wrong with me if I like this? Or this?
This entire site as a zip file — last updated 2024.08.16
Previous articles
Fitness Startup Is Hard
Sweeney Translation
Collatz, Revisited
Downtown Isn’t Coming Back
Stig
Gaston
Nuclear War
Wolfspeare
Engström’s Motive
Google’s Decision
Warrening
The Two Envelopes Problem, Solved
The Practical Smartphone Buyer
Would Apple Actually Exit the EU Or UK?
See You Looked
Blackjack Strategy Card (Printable)
Swan Device 1956 — Probable Shape
Pu
RGB-To-Hue Conversion
Polygon Triangulation With Hole
One-Point Implosion: “Palm Fan”
Implosion: Were Those Two-Speed Lenses Really Necessary?
Apple Wants User/Developer Choice; Its Enemies Want Apple Ruin
Tim Sweeney Plays Dumb
The Jury of One
The Lesson of January 6
Amnesia Is Not A Good Plot
I Was Eating for 300 lbs, Not 220
Action Arcade Sounds and Reality
The Flea Market and the Retail Store
Squaring the Impossible
Yes, Crocodiles Are Dinosaurs — Duh
Broccoli and Apples Are Not the Antidote To Donuts and Potato Chips
Cydia and “Competition”
The Gift of Nukes
Prager University and the Anti-Socialists’ Big Blind Spot
In Defense of Apple’s 30% Markup, Part 2
In Defense of Apple’s 30% Markup
Make Your Own FBI Backdoor, Right Now
Storm
The Legacy of Windows Phone
Mindless Monsters
To the Bitter End
“Future Shock” Shock
Little Plutonium Boy
The iPhone Backdoor Already Exists
The Impulse To Be Lazy
HBO’s “Meth Storm” BS
Judos vs. Pin Place
Vizio M-Series 65" LCD (“LED”) TV — Best Settings (IMHO)
Tasting Vegemite (Bucket List)
The IHOP Coast
The Surprise Quiz Paradox, Solved
Apple, Amazon, Products, and Services — Not Even Close
Nader’s Open Blather
Health — All Or Nothing?
Vivek Wadhwa, Scamster Bitcoin Doomsayer
Backwards Eye Wiring — the Optical Focus Hypothesis
Apple’s Cash Is Not the Key
Nothing More Angry Than A Cornered Anti-Apple
Let ’Em Glow
The Ultimate, Simple, Fair Tax
Compassion and Vision
When Starting A Game of Chicken With Apple, Expect To Lose
The Caveat
Superb Owl
NavStar
Basic Reproduction Number
iBook Price-Fixing Lawsuit Redux — Apple Won
Delusion Made By Google
Religion Is A Wall
It’s Not A Criticism, It’s A Fact
Michigan Wolverines 2014 Football Season In Review
Sprinkler Shopping
Why There’s No MagSafe On the New MacBook
Sundar Pichai Says Devices Will Fade Away
The Question Every Apple Naysayer Must Answer
Apple’s Move To TSMC Is Fine For Apple, Bad For Samsung
Method of Implementing A Secure Backdoor In Mobile Devices
How I Clip My Cat’s Nails
Die Trying
Merger Hindsight
Human Life Decades
Fire and the Wheel — Not Good Examples of A Broken Patent System
Nobody Wants Public Transportation
Seasons By Temperature, Not Solstice
Ode To Coffee
Starting Over
FaceBook Messenger — Why I Don’t Use It
Happy Birthday, Anton Leeuwenhoek
Standard Deviation Defined
Not Hypocrisy
Simple Guide To Progress Bar Correctness
A Secure Backdoor Is Feasible
Don’t Blink
Predictive Value
Answering the Toughest Question About Disruption Theory
SSD TRIM Command In A Nutshell
The Enderle Grope
Aha! A New Way To Screw Apple
Champagne, By Any Other Maker
iOS Jailbreaking — A Perhaps-Biased Assessment
Embittered Anti-Apple Belligerents
Before 2001, After 2001
What A Difference Six Years Doesn’t Make
Stupefying New Year’s Stupidity
The Innovator’s Victory
The Cult of Free
Fitness — The Ultimate Transparency
Millions of Strange Devotees and Fanatics
Remember the iPod Killers?
Theory As Simulation
Four Analysts
What Was Christensen Thinking?
The Grass Is Always Greener — Viewing Angle
Is Using Your Own Patent Still Allowed?
The Upside-Down Tech Future
Motive of the Anti-Apple Pundit
Cheating Like A Human
Disremembering Microsoft
Security-Through-Obscurity Redux — The Best of Both Worlds
iPhone 2013 Score Card
Dominant and Recessive Traits, Demystified
Yes, You Do Have To Be the Best
The United States of Texas
Vertical Disintegration
He’s No Jobs — Fire Him
A Players
McEnroe, Not Borg, Had Class
Conflict Fades Away
Four-Color Theorem Analysis — Rules To Limit the Problem
The Unusual Monopolist
Reasonable Projection
Five Times What They Paid For It
Bypassable Security Certificates Are Useless
I’d Give My Right Arm To Go To Mars
Free Advice About Apple’s iOS App Store Guidelines
Inciting Violence
One Platform
Understanding IDC’s Tablet Market Share Graph
I Vote Socialist Because...
That Person
Product Naming — Google Is the Other Microsoft
Antecessor Hypotheticum
Apple Paves the Way For Apple
Why — A Poem
App Anger — the Supersized-Mastodon-In-the-Room That Marco Arment Doesn’t See
Apple’s Graphic Failure
Why Microsoft Copies Apple (and Google)
Coders Code, Bosses Boss
Droidfood For Thought
Investment Is Not A Sure Thing
Exercise is Two Thirds of Everything
Dan “Real Enderle” Lyons
Fairness
Ignoring the iPod touch
Manual Intervention Should Never Make A Computer Faster
Predictions ’13
Paperless
Zeroth — Why the Century Number Is One More Than the Year Number
Longer Than It Seems
Partners: Believe In Apple
Gun Control: Best Arguments
John C. Dvorak — Translation To English
Destructive Youth
Wiens’s Whine
Free Will — The Grand Equivocation
What Windows-vs.-Mac Actually Proved
A Tale of Two Logos
Microsoft’s Three Paths
Amazon Won’t Be A Big Winner In the DOJ’s Price-Fixing Suit
Infinite Sets, Infinite Authority
Strategy Analytics and Long Term Accountability
The Third Stage of Computing
Why 1 Isn’t Prime, 2 Is Prime, and 2 Is the Only Even Prime
Readability BS
Lie Detection and Psychos
Liking
Steps
Microsoft’s Dim Prospects
Humanity — Just Barely
Hanke-Henry Calendar Won’t Be Adopted
Collatz Conjecture Analysis (But No Proof; Sorry)
Rock-Solid iOS App Stability
Microsoft’s Uncreative Character
Microsoft’s Alternate Reality Bubble
Microsoft’s Three Ruts
Society’s Fascination With Mass Murder
PlaysForSure and Wikipedia — Revisionism At Its Finest
Procrastination
Patent Reform?
How Many Licks
Microsoft’s Incredible Run
Voting Socialist
Darwin Saves
The Size of Things In the Universe
The Self-Fulfilling Prophecy That Wasn’t
Fun
Nobody Was In Love With Windows
Apples To Apples — How Anti-Apple Pundits Shoot Themselves In the Foot
No Holds Barred
Betting Against Humanity
Apple’s Premium Features Are Free
Why So Many Computer Guys Hate Apple
3D TV With No Glasses and No Parallax/Focus Issues
Waves With Particle-Like Properties
Gridlock Is Just Fine
Sex Is A Fantasy
Major Player
Why the iPad Wannabes Will Definitely Flop
Predators and Parasites
Prison Is For Lotto Losers
The False Dichotomy
Wait and See — Windows-vs-Mac Will Repeat Itself
Dishonesty For the Greater Good
Barr Part 2
Enough Information
Zune Is For Apple Haters
Good Open, Bad Open
Beach Bodies — Who’s Really Shallow?
Upgrade? Maybe Not
Eliminating the Impossible
Selfish Desires
Farewell, Pirate Cachet
The Two Risk-Takers
Number of Companies — the Idiocy That Never Dies
Holding On To the Solution
Apple Religion
Long-Term Planning
What You Have To Give Up
The End of Elitism
Good and Evil
Life
How Religion Distorts Science
Laziness and Creativity
Sideloading and the Supersized-Mastodon-In-the-Room That Snell Doesn’t See
Long-Term Self-Delusion
App Store Success Won’t Translate To Books, Movies, and Shows
Silly iPad Spoilsports
I Disagree
Five Rational Counterarguments
Majority Report
Simply Unjust
Zooman Science
Reaganomics — Like A Diet — Works
Free R&D?
Apple’s On the Right Track
Mountains of Evidence
What We Do
Hope Conquers All
Humans Are Special — Just Not That Special
Life = Survival of the Fittest
Excuse Me, We’re Going To Build On Your Property
No Trademark iWorries
Knowing
Twisted Excuses
The Fall of Google
Real Painters
The Meaning of Kicking Ass
How To Really Stop Casual Movie Disc Ripping
The Solitary Path of the High-Talent Programmer
Fixing, Not Preaching
Why Blackmail Is Still Illegal
Designers Cannot Do Anything Imaginable
Wise Dr. Drew
Rats In A Too-Small Cage
Coming To Reason
Everything Isn’t Moving To the Web
Pragmatics, Not Rights
Grey Zone
Methodologically Dogmatic
The Purpose of Language
The Punishment Defines the Crime
Two Many Cooks
Pragmatism
One Last Splurge
Making Money
What Heaven and Hell Are Really About
America — The Last Suburb
Hoarding
What the Cloud Isn’t For
Diminishing Returns
What You’re Seeing
What My Life Needs To Be
Taking An Early Retirement
Office Buildings
A, B, C, D, Pointless Relativity
Stephen Meyer and Michael Medved — Where Is ID Going?
If You Didn’t Vote — Complain Away
iPhone Party-Poopers Redux
What Free Will Is Really About
Spectacularly Well
Pointless Wrappers
PTED — The P Is Silent
Out of Sync
Stupid Stickers
Security Through Normalcy
The Case For Corporate Bonuses
Movie Copyrights Are Forever
Permitted By Whom?
Quantum Cognition and Other Hogwash
The Problem With Message Theory
Bell’s Boring Inequality and the Insanity of the Gaps
Paying the Rent At the 6 Park Avenue Apartments
Primary + Reviewer — An Alternative IT Plan For Corporations
Yes Yes Yes
Feelings
Hey Hey Whine Whine
Microsoft About Microsoft Visual Microsoft Studio Microsoft
Hidden Purple Tiger
Forest Fair Mall and the Second Lamborghini
Intelligent Design — The Straight Dope
Maxwell’s Demon — Three Real-World Examples
Zealots
Entitlement BS
Agenderle
Mutations
Einstein’s Error — The Confusion of Laws With Their Effects
The Museum Is the Art
Polly Sooth the Air Rage
The Truth
The Darkness
Morality = STDs?
Fulfilling the Moral Duty To Disdain
MustWinForSure
Choice
Real Design
The Two Rules of Great Programming
Cynicism
The End of the Nerds
Poverty — Humanity’s Damage Control
Berners-Lee’s Rating System = Google
The Secret Anti-MP3 Trick In “Independent Women” and “You Sang To Me”
ID and the Large Hadron Collider Scare
Not A Bluff
The Fall of Microsoft
Life Sucks When You’re Not Winning
Aware
The Old-Fashioned Way
The Old People Who Pop Into Existence
Theodicy — A Big Stack of Papers
The Designed, Cause-and-Effect Brain
Mosaics
IC Counterarguments
The Capitalist’s Imaginary Line
Education Isn’t Everything
I Don’t Know
Funny iPhone Party-Poopers
Avoiding Conflict At All Costs
Behavior and Free Will, Unconfused
“Reduced To” Absurdum
Suzie and Bubba Redneck — the Carriers of Intelligence
Everything You Need To Know About Haldane’s Dilemma
Darwin + Hitler = Baloney
Meta-ware
Designed For Combat
Speed Racer R Us
Bold — Uh-huh
Conscious of Consciousness
Future Perfect
Where Real and Yahoo Went Wrong
The Purpose of Surface
Eradicating Religion Won’t Eradicate War
Documentation Overkill
A Tale of Two Movies
The Changing Face of Sam Adams
Dinesh D’Souza On ID
Why Quintic (and Higher) Polynomials Have No Algebraic Solution
Translation of Paul Graham’s Footnote To Plain English
What Happened To Moore’s Law?
Goldston On ID
The End of Martial Law
The Two Faces of Evolution
A Fine Recommendation
Free Will and Population Statistics
Dennett/D’Souza Debate — D’Souza
Dennett/D’Souza Debate — Dennett
The Non-Euclidean Geometry That Wasn’t There
Defective Attitude Towards Suburbia
The Twin Deficit Phantoms
Sleep Sync and Vertical Hold
More FUD In Your Eye
The Myth of Rubbernecking
Keeping Intelligent Design Honest
Failure of the Amiga — Not Just Mismanagement
Maxwell’s Silver Hammer = Be My Honey Do?
End Unsecured Debt
The Digits of Pi Cannot Be Sequentially Generated By A Computer Program
Faster Is Better
Goals Can’t Be Avoided
Propped-Up Products
Ignoring ID Won’t Work
The Crabs and the Bucket
Communism As A Side Effect of the Transition To Capitalism
Google and Wikipedia, Revisited
National Geographic’s Obesity BS
Cavemen
Theodicy Is For Losers
Seattle Redux
Quitting
Living Well
A Memory of Gateway
Is Apple’s Font Rendering Really Non-Pixel-Aware?
Humans Are Complexity, Not Choice
A Subtle Shift
Moralism — The Emperor’s New Success
Code Is Our Friend
The Edge of Religion
The Dark Side of Pixel-Aware Font Rendering
The Futility of DVD Encryption
ID Isn’t About Size or Speed
Blood-Curdling Screams
ID Venn Diagram
Rich and Good-Looking? Why Libertarianism Goes Nowhere
FUV — Fear, Uncertainty, and Vista
Malware Isn’t About Total Control
Howard = Second Coming?
Doomsday? Or Just Another Sunday
The Real Function of Wikipedia In A Google World
Objective-C Philosophy
Clarity From Cisco
2007 Macworld Keynote Prediction
FUZ — Fear, Uncertainty, and Zune
No Fear — The Most Important Thing About Intelligent Design
How About A Rational Theodicy
Napster and the Subscription Model
Intelligent Design — Introduction
The One Feature I Want To See In Apple’s Safari.