Because, people, the suspense is killing me.
If you went back in time to 2002, at the time of the initial release of Mac OS X, and told everyone that over the next eight years not a single Mac OS X virus or worm would be found in the wild, everyone, including me, would have called you barking mad.
Ever since Apple began the transition to Mac OS X in 1999, computer security experts have every week of every month of every year confidently told us that Mac OS X is just as vulnerable on a technological level as Windows or any other operating system. By that they mean that it is just as technically easy for a malicious programmer to write a program to hijack the operating system of Mac as it is to write a program to hijack a Windows machine.
Several times a year, they demonstrate flaws in Mac OS X that they claim could be used to spread viruses. They complain about Apple’s insular, arrogant and cavalier attitude toward finding and patching these security flaws. They tell us that all these factors make Mac OS X a ticking bomb and that “any day now” Mac users will face a sudden tsunami of self-propagating viruses and worms just like Windows users do.
They tell us the exact same thing every week, month and year.
They told us that in 1999 with the release of Mac OS X server.
They told us that in 2000.
They told us that in 2001.
They really told us that in 2002 when Mac OS X shipped widely for desktops.
They told us that in 2002.
They told us that in 2003.
They told us that in 2004.
They told us that in 2005.
They told us that in 2006.
They told us that in 2007.
They told us that in 2008.
They told us that in 2009
And they continue to tell us that in 2010.
Yet, der Tag never comes and waiting for it is giving me ulcers.
So, I have to ask: How many more years have to elapse before we begin to suspect the security experts (and everyone else, myself included) have misunderstood something critical about how the Mac OS X security model works out in the real world?
For the past eight years, since I switched to Mac OS X, I have believed that Mac OS X was intrinsically as vulnerable as everyone says, and I have been sitting anxiously on the edge of my chair for all these years waiting for the predicted Mac OS X pandemic, but it has never arrived. Not only has the pandemic never arrived, but Mac OS X has never even caught so much as a sniffle. The stress of years of waiting for the inevitable wrecking of my Macs by viruses and worms has apparently pushed me over the edge, because I have begun to think dark, mad, heretical thoughts.
I have begun to think maybe, just maybe, the weekly, monthly and yearly cookie-cutter, rote warnings about Mac OS X security are wrong.
Insane, I know, but in any other context, eight-plus years of a predicted problem never materializing would cause us to seriously doubt that the “experts” making the prediction knew what they were talking about. Imagine that in 2002, a doctor told two people named, say, Mac and PC that they were both immune compromised and that each would have to fight off infection after infection for the foreseeable future. If Mac came back eight years later looking hale and hearty and never having had a sniffle while PC looked like a hacking leper in a Monty Python skit, most people would conclude that the doctor had misdiagnosed Mac.
Why don’t we apply the same standard to the claims about Mac OS X’s vulnerability to viruses and worms? How many times do we/they get to say, “this time for sure” and get a pass when we/they are wrong?
Well, we are told, there are non-technological reasons why not a single solitary Mac OS X virus or worm has ever appeared in the wild.
For example, we are told that the criminals and those seeking cracker infamy do a top-down market-share analysis just like a corporation does when deciding what platform to write software for. This market-share analysis (that all the blackhats learned in business school) teaches them not to bother writing software for the Mac because the market share is so small that there’s no profit in it.
I have begun to question this for several reasons:
(1) Back in the ’90s Mac OS Classic had an even smaller market share and even smaller profit potential and yet it was riddled with viruses and worms.
(2) The Mac’s market share has grown significantly since the Mac OS Classic days, but viruses have totally disappeared following the shift to the Mac OS X operating system.
(3) There are 30+ million Macs out in the world today. The real money for evil programmers is in Internet-connected computers, and there Macs account for somewhere between 5% and 10%. For those playing at home, that means that somewhere between every 1 in 20 and every 1 in 10 Internet-connected computers is running Mac OS X.
I would think that some small malware “company” would at least try to infect a small fraction of those 30 million Macs, you know, just as a public service to an under served market segment.
But I never went to business school, so what do I know?
On the other hand it occurs to me that maybe all the black hats didn’t go to business school either, and that instead of doing market-share analysis they instead approach the problem like, what’s the word?
Oh, yeah, criminals…
I know this will be a radical idea to most people, but just suppose in a wild supposition that malware programmers don’t give a rat’s hindquarters what percentage of the total world-wide installed base of computers they infect, but instead just care if they can infect enough machines in absolute numbers to pull off whatever scam they’re planning. What if they know that most botnets have under 10,000 machines? What if they look at a list of the top 10 largest botnets to date, and discover that three of the top 10 had only 300,000 machines or less? What if they think in terms of, “If I can infect and control just 300,000 machines I can make a killing!”
What if think, “The experts say that Mac OS X is just as easy to infect as Windows. They say Apple has a careless attitude toward to security. Mac users are naive. Fewer Macs are professionally administered. Almost no Macs run anti-malware software and there’s 30 million Internet-connected Macs!” What if they do a little number-crunching and think, “Wow, if I could infect just 1% of all the vulnerable Mac out there I could have a botnet in the top 10 of all time!”
What if they give up on their dreams of infecting every single Windows machine on the planet just for the glory, and instead settle for making big gobs of money infecting a small percentage of the Macs that all the security experts tell us are just sitting out there like a passed-out sorority girl with her bra stuffed with cash?
Wait, what have I done! Obviously, my genius has lead me to discover a cash cow that all the thousands of black hats over the last eight years have completely missed. Right now all over the world they’re smacking their foreheads and exclaiming, “Da! Of course! 30 million unprotected Macs! Why didn’t I think of that?”
Honestly, I try to use my superhuman intellect to do good but even I make mistakes. Now my brilliant economic insight will cause Mac OS X users to suffer a deluge of malware just like Windows users!
Either that or all the security experts are in fact largely wrong about Mac OS X security, and the blackhats don’t attack the Mac because they can’t. (Personally, I like the explanation that makes me a genius.)
And what about all the malware programmers in the world who don’t care about money? What if some do it out of challenge or out of political or personal motivation? In eight years has not one of them taken a successful run at Mac OS X? Not a one? A single one? Anyone? Bueller?
I keep coming back to large numbers. There are at a bare minimum tens of thousands of people world-wide with the programming skills necessary to exploit any one of the flaws in Mac OS X security. Eight years is a lifetime in the computer industry, and 30 million computers is a lot of computers no matter how many other computers are out there.
(Eight years) X (thousands of malevolent programmers) X (30+ million easily infected Macs) ! = ZERO viruses.
One of our variables is wrong.
All these numbers should have added up to not just one, but dozens or hundreds of successful self-propagating virus and worm variants attacking Macs. Mac OS X should at the very least be as plagued by viruses and worms as Mac OS Classic was. At the very, very least, Mac OS X should have a few dozen viruses and worms like Linux.
But zero, nada, zilch, bupkis?
When do we stop regurgitating the same explanations year after year and start thinking that maybe we’ve missed something? If not now, then do we wait another eight years to 2015? How about 2021? If by then Mac OS XX Quantum still doesn’t have a single virus can we conclude we’ve been wrong?
Nah. What kind of madness would that be? Why, if we start evaluating experts’ actual knowledge of an area by whether their predictions actually come true, that would lead to anarchy. I mean, do we really want to think like scientists?
No, the Mac OS X virus is out there lurking just like they’ve said all these years. I feel it in my bones.
Eight years ago, transitioning from the virus ridden Mac OS Classic to Mac OS X for me was like putting my foot up on the last stair step that wasn’t there. I didn’t know how to deal with the sudden lack of malware. Heck, fixing malware on Macs had helped pay my bills for many years. I thought the lack of viruses was the result of the OS being relatively new. Every day I expected to hear of the great Mac OS X viral outbreak…
… but it never came.
Now, eight years later, the ever predicted but never appearing Mac OS X viral gotterdammerung haunts me like the unseen monster of dread in a childhood nightmare. I’m always told by everyone that it’s right there, just out of sight in the shadows or knocking around inside the walls. For eight years, I have sat perched anxiously on the edge of my chair waiting for the boogie monster to jump out or at least the other shoe to drop. Now I’ve got vigilance fatigue, I need sleep and I’ve got splinters in my butt.
So, somebody out there, do me and the rest of all the Mac users a solid and please, please, please write a Mac OS X virus!
You don’t have to do anything evil with it, just release it and let spread. Really, it will make us all very happy. We can stop jumping at shadows and concentrate on real, solid threats for a change.
I’m begging here. Don’t make me suffer in suspense for another eight years.