One not-too-suprising reaction to the recent spate of worms and viruses has been a re-examination of the insecurities of Windows. A good number of articles, such as this one from SunSpot.net, and this one from Mercury News have focused on the relative immunity of Mac users:
As the latest Microsoft Windows infection spread across the Internet last week, knocking out thousands of PCs in homes and businesses, Macintosh users did what they usually do during a computer virus outbreak — they continued working.
Is it really true that the Mac is more secure? Or is it simply not targeted by virus and worm authors?
Historically there were very few Macintosh viruses—the best estimate is around 50—in part because of the difficulty of writing a hidden virus that would work and spread in the older versions of the Mac OS. The majority of those ‘viruses’ were actually trojan horses of one sort or another, and generally relied on human intervention to spread.
One of the main things that insulates Mac users from viruses and worms is that they simply are not binary compatible. They just won’t run on the Mac. Of course, the Mac can still spread Office based viruses, which is another reason I’m not fond of Word, Excel and Outlook.
It’s not completely true that Mac users are not affected by worms like the most recent ones. Klez, SoBig and their compatriots are still a major pain because of the massive increase in junk mail, and the way in which the e-mail addresses of Mac users, held in the address books of infected Windows machines, can be used as the apparent sender of this junk.
And, of course, worms still knock on the door if running if you’re running servers like Apache under OS X. Their are, however, two major benefits from the Unix basis of OS X. Unix has been around for a long while, and has been hammered by crackers for a long time. Most security holes have already been closed, and there exists a community of interest to rapidly patch holes as discovered, something Apple has proven itself very very responsive to. The other advantage is that security was built into Unix from the ground up. Partitioning of memory and run-time space is right there in the kernel, it’s a fundamental rule of the universe. Unless a process runs in some sort of super-user mode, it can really only hurt itself. (Ok, that’s not completely true, there are all sorts of brute-force things you can do to clobber the system as a user, but they usually result in a sysadmin responding with similar brute-force clobbering.)
No less a journal than the Washington Post has emphasised what a lot of security folk have said for a long time: Windows is insecure by design, at a fundamental level.
Even if that changed, Windows would still be an easier target. In its default setup, Windows XP on the Internet amounts to a car parked in a bad part of town, with the doors unlocked, the key in the ignition and a Post-It note on the dashboard saying, “Please don’t steal this.”
Among other things, that article points out the important difference between the Unix and Windows universes—the former, by default, does not grant access to system administration functions and calls to the user run-time domain, but Windows does.
The Unix philosophy, for most security issues is: the door is closed, unless you specifically open it. For example OS X has a firewall built in, out of the box. By default, it’s shipped with all ports firmly locked down.
Windows doesn’t have security built in from the ground up. All Windows security features are bolted on the outside. The philosophy has always been: the door is open, unless you specifically close it.
While Windows also has a built-in firewall, by default it has been turned off. In the wake of the Blaster worm, Microsoft said last week that new versions of Windows XP will ship with the firewall active by default.
While vituperative and over the top, Dvorak phrases it well:
The experts—in the industry overall and at Microsoft, specifically—are addressing none of this. Outlook sucks at protecting users, and Microsoft has done nothing. The company has also chosen to give users the wrong defaults, so file extensions are hidden unless you track down the settings to make them visible. Why? So Windows systems can appear more like Macs? Or what? I can do a whole column on dumb defaults.