Macs Spread Malware To PCs

Call it Steve Jobs’ revenge. Security vendor Sophos has discovered that one in five Mac computers surveyed carry malware that could infect Windows PCs. In a bit of delicious irony, only one in 36 Apple computers were found to be infected with Mac OS X malware. The results bring an odd sense of urgency to worries about Mac security.

Macs As “Patient Zero”

While Windows malware can’t damage a Mac, UK-based Sophos encourages Mac users to be “a responsible member of society” by ensuring their systems don’t infect other computers. In a tacky comparison, the security company compared an infected Mac to a person who has Chlamydia, a sexually transmitted disease that carriers often don’t know they have until they get tested.

Like many Chlamydia victims, Mac owners “are doing a pretty poor job” in keeping their systems clean, writes Graham Cluley, senior technology consultant at Sophos, in the company’s blog. Some of the malware discovered on Macs dated back to 2007 and would have easily been detected if the users had run anti-virus software.

Much as on a Windows PC, malware can infect Macs via USB drives, email attachments or even just by visiting a compromised website. Sophos has even seen malicious Web sites that secretly install malware on Macs with un-patched software.

Mac users take bigger cyber-risks not because their machines are invulnerable to attack (some experts claim they’re actually more vulnerable than Windows PCs) but because cybercriminals have ignored Apple systems for decades. Only in the last few years has the number of Macs on the Internet reached a level that it draws the interest of serious malware creators. “Sadly, cybercriminals view Macs as a soft target, because their owners are less likely to be running anti-virus,” Cluley notes.

Is the Free Ride Over?

That’s certainly true, but the reality is that Mac users have pretty much gotten away with lax security, so there was little incentive. And unless Mac users are feeling altruistic (not likely given Apple’s long-running ad campaigns ridiculing PC users)- or running Windows and Windows programs on their machines – there still isn’t much incentive. At least for now.

If that ever changes, it could be due to the deeper pockets of the average Mac user. If Apple customers can afford to pay a premium for the company’s computers, then cybercriminals may believe there’s greater profit in stealing passwords to an online banking site visited with a Mac. “They might believe the potential for return is much higher,” according to Cluley says.

In the meantime, though, Mac malware is pretty much the same as Windows malware. Slightly more than three in four of the Mac malware Sophos discovered targeted a vulnerability in the Java platform that Apple patched this month, nearly two months after a fix was available for Windows PCs. The password-stealing malware, called Flashback, had infected more than 600,000 Macs, roughly 1% of all in use, before Apple started working with Internet service providers to take offline servers suspected of spreading the malware.

After Flashback, the second most popular malware were pop up screens on Web sites that pretend to find viruses on visitors’ computers and then try to scare them into buying malware disguised as removal tools.

[RWW]