A report this week from security firm F-Secure says that OS X’s share of malware is gaining, probably due to its increasing market share.
Apple Mac’s market share is now significant enough for the Zlob parasites to target, as malware gangs don’t make an effort to develop something without the promise of a profitable return.It’s a song-and-dance we’ve heard-and-seen many times before. Is it true? The answer is a qualified “maybe.” The focus in F-Secure’s report is mainly on the Trojan DNSChanger, which we discussed back in October.
The Financial Times took this report and ran with it. Here’s the money quote:
Over the past few months, however, the number of malicious programmes has increased, according to a report published this week by F-Secure, an internet security company.Okay, here’s where it gets a little slippery. From what Runald says and the F-Secure report, it sounds like that 100-150 are variants of the Trojan DNSChanger. Now, the increase in number of variants could suggest that targeting OS X is becoming more prevalent (it certainly casts a wider net), but Runald goes on to note that most of the malware is from the Zlob group, supporting the idea that we’re talking about a single exploit, created by one group and tweaked in minor ways.“Over the past two years, we had found one or two pieces of malware targeting Macs,” said Patrik Runald, an F-Secure security researcher. “Since October, we’ve found 100-150 variants.”
Is the DNSChanger something to worry about? I certainly wouldn’t lose sleep over it, but yeah, you ought to be aware of it and think twice whenever a website wants you to install something (as a Trojan, the DNSChanger exploit relies more on exploiting you, the user, than your computer). But the dam’s not about to give way just yet, so don’t run for the hills screaming that the OS X is riddled with malware. We shall wait and see what 2008 brings.
This once again reaffirms the idea that if you don't agree to install something you don't know, you won't get infected. I'll still sleep easy knowing that it takes something on MY end to cause problems for my precious MacBook.
Technically, it's not an exploit, Dan. It doesn't excersice a vulnerability, it relies on users being stupid enough to download a "QuickTime plugin" from a dodgy source. Simple social engineering. It's like saying Office is an exploit.