Apple Explains Why iOS Don't Need No Steenkin' Anti-Virus

http://www.forbes.com/sites/timworstall/2012/06/04/apple-explains-why-ios-dont-need-no-steenkin-anti-virus/?partner=yahootix

by larrys • 14 years ago

12 40 14 years ago

forbes.com

arkitaip2• 14 years ago

Apple's arrogance and their security theater puts their customers in danger because it creates a false sense of security. It's just a matter of time before hacktivists make an all assault on Mac OS and iOS just to make Apple consumers more conscious about security.

randomdata2• 14 years ago

I've never understood why this hasn't happened. It seems like being the first to create a widespread Mac (or Linux, etc.) virus would be much more appealing to write than just yet another Windows virus. Everyone and their brother have already done that.

nl2• 14 years ago

There are plenty of *nix viruses around, except they are usually known as worms.

The first author[1] of a successful worm[2] did become quite famous from it, later did a startup[3] and even later went on to be one of the co-founders of this thing called YCombinator[4].

[1] http://en.wikipedia.org/wiki/Robert_Tappan_Morris

[2] http://en.wikipedia.org/wiki/Morris_worm

[3] http://en.wikipedia.org/wiki/Viaweb

[4] Seriously?

esbwhat• 14 years ago

There are OS X viruses out there. Linux would be harder because of an increased fragmentation and systems being more up-to-date generally (especially since linux is commonly used on servers, and thus held up to a different standard of security in first place)

On windows or mac, getting a virus to run is generally just a matter of packaging it with some downloadable software. In linux, pretty much everything is available through package managers. You can't just throw a virus into a torrent for photoshop or whatever.

That being said, I'm by no means an expert.

thomasnext• 14 years ago

What "security theater?" They have an iron fist when it comes to the app store, but they aren't telling you to input your SSN or taking blood samples.

excuse-me3• 14 years ago

"security theater?" = there's no need to worry about security because the app store guarrantees that.

What if there is a hack/mistake/bug in the appstore ?

There's no need to worry about security because the app store guarrantees that.

voidr• 14 years ago

Actually iOS has more security than you could ever get on a Windows platform with an anti virus.

The only way to run executable code on iOS is to install it via the AppStore, to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware. Even if your malware gets trough you are still stuck in your apps sandbox and once Apple realizes what you have done, they can remotely pull all instances of your app and the police will be waiting for you outside.

So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware.

arkitaip2• 14 years ago

"to get to the App Store you need to pass the review process, you have to be really clever to be able to hide your malware.

Let's hope no one sets up The International Obfuscated Objective-C Code Contest; or that the code reviewers at Apple are competent and experience enough to work with advanced software security threats.

"Even if your malware gets trough you are still stuck in your apps sandbox"

Sandboxes can and are exploited. Recently [1]

"So virtually it's impossible to spread virus on iOS, an anti virus would be just crapware."

Sure on HN we all know that security is more than (anti) viruses.

[1] http://www.techspot.com/news/47731-google-rushes-out-chrome-...

jpxxx2• 14 years ago

iOS is not immune - it just has a far less surface area to attack when unmodified.

One can still do a driveby attack where a malicious webpage kicks Safari's teeth in and finds a way through the sandbox.

(Or replace Safari with 'any app that consumes network content')

bradleyland2• 14 years ago

Here's the thing, A/V software is just one more thing to work around. There's no inherent aspect of an operating system that should require A/V, and there's nothing about A/V that suddenly makes a system invulnerable to exploit.

Yes, security should be managed in layers, but the management of those layers should be trusted to the "right" person. A/V companies believe that they are the right person. Apple believes that they are the right person.

If you're going to levy the "security theather" attack at Apple, we could just as easily fire that shot in the direction of A/V companies. When "malware" came on the scene, A/V companies were completely unprepared. Their response was that "malware isn't a virus". From a technical perspective, they're correct, but from the user's perspective, it was a huge failing. Virtually everyone I know who has been affected by malware said the same thing: "But I pay for Kaspersky/McAfee/Avast/Whatever anti-virus, how did I get infected!?" I'm supposed to believe that these are the "right" people with whom to entrust the security of my computer?

tjoff• 14 years ago

There's no inherent aspect of an operating system that should require A/V...

Most operating systems allow you to install software. If the user installs software from untrustworthy sources an A/V is the only thing that can protect him/her. No it isn't perfect but few claim it to be.

cantankerous6• 14 years ago

You do know that anti-virus software is most definitely security theater at its finest, right? It gives users around the world a false sense of security.

"I'm safe because I'm running McAfee/Kaspersky/Norton/what-have-you." I'd say pretty much every infected machine I've dealt with has had anti-virus software on it.

myspy• 14 years ago

The security via obscurity argument is floating around this discussion for years. And I don't buy it that OS X is not tested by malware experts.

I don't know who has read that reddit AMA of a malware writer but he stated that 90% of all bad guys can't write code.

And apart from that he stated that his malware can bypass anti virus software.

To get programs on your Mac that cause real trouble it's necessary to type in your password during installation. The last big trojan used a Java hole.

Therefore I state that Mac is secure enough for the average user as long as he gives no privilegs to obscure programs and does not use Java (and Flash?) in the browser.

I don't know how else you can get malicious code onto an iOS device apart from jailbreaking it, getting something through the App Store checks or someone getting it in his hands.

For the real bad stuff a virus scan won't help you, these bad guys know how to work around. It's all about the user and his knowledge about what precautions he should apply (not giving th device in other hands, not jailbreaking).

Are there ways to hack a phone via browser, let's say with a JavaScript hack?

cube13• 14 years ago

There were a few remote execution holes in iOS' Webkit implementation that were mostly used to jailbreak phones. I'm not sure how quickly those were detected and patched, though.

gurkendoktor5• 14 years ago

> To get programs on your Mac that cause real trouble

I think this is the big fallacy of the UNIX security model. Every program you download can delete your home folder without warning, it only can't mess up the OS (and other users, but those are increasingly rare). That's terrible because restoring /System is the easiest thing in the world, restoring user data isn't. I think you can't delete Time Machine backups without admin rights, but malware could easily purge TM with an artificial mammoth file too.

I am super paranoid about downloading software to my work Mac even from the App Store. And even for iOS I only try random free apps on my iPad where I don't have my address book synced.

Turing_Machine2• 14 years ago

iOS apps don't have access to a home folder, and the new Sandbox model for OS X is that way, too. Each app has its own folder, with no access to the folders of other apps. There are APIs to access data from other apps that share it (for example photos and the address book, so you're right to be wary there), but no direct access to arbitrary folders. This is both good and bad, of course. It forces you to jump through hoops if you legitimately need access, and makes certain types of programs difficult/impossible to write.

stevoski• 14 years ago

For everyone wanting to comment, "but Mac OS X is like this or that"...do note that this article is specifically about iOS, not about OS X.

falcolas• 14 years ago

The author mentions getting malware from a jailbroken device, without realizing that the jailbreak itself is a great example of "malware" (from apple's point of view) that is constantly getting around their presented security.

As long as jailbreaks work, Apple's security stack isn't worth much.

gurkendoktor5• 14 years ago

I figured it depends on the type of jailbreak. The drive-by web browser jailbreak was scary - the hole could easily have been used to install malware in the background.

But how dangerous is the average jailbreak that requires a USB connection?

TwiztidK• 14 years ago

I agree that the same exploits used to jailbreak iOS devices could be used to install actual malware, but what could third party anti-virus software do that Apple can't? If the OS can be exploited, the anti-virus software can surely be exploited as well.

jack-r-abbit2• 14 years ago

IMO, the more Apple shakes their stick, yelling "You're not getting into my house" the more likely the right person is going to take on that challenge and succeed. You can only yell "Come at me bro" so many times before someone actually does come at you.

gurkendoktor5• 14 years ago

This is a note most of us wouldn't have read without it being posted to HN via Forbes. Apple ran TV ads claiming that Macs had no viruses years ago - those were much more provocative and not much happened. Or maybe the Flashback worm just took a long time to develop :)

jack-r-abbit2• 14 years ago

Times change. Maybe there wasn't quite the incentive/appeal years ago. And this is Hacker News. I understand "hacker" in this case is not exactly the same thing as a malware writer. But if I were to bet on a TV ad years ago vs. an article posted here today (along with others on the topic in the recent past) my money would not be on the TV ad.

Apple Explains Why iOS Don't Need No Steenkin' Anti-Virus

Related Stories