“One ought never to turn one’s back on a threatened danger and try to run away from it. If you do that, you will double the danger. But if you meet it promptly and without flinching, you will reduce the danger by half. Never run away from anything. Never!” — Winston Churchill |
When dial-up gave way to always-on broadband, and our computers came to be exposed to the Internet 24x7, a perpetual conflict sprang to life: the direct interests of Apple to tout care-free “appliance computing” versus the reality of technology, evil hackers, and the limits of a modern OS. The Flashback Trojan renews the question: how’s Apple doing? Can the security war be won?
_________________
There is no question that Apple desires to sell computer products, Macs and iDevices, based on the idea that they are safe and easy to use. There is also no question that there is a tension between that desire and the technical realities of Internet life and the limits of OS technology. How we respond to that tension is really more of a litmus test of our own personality and experience rather than a clear cut technical decision.
For years, Apple has taken steady measures to improve the security of its products, exposed as they are to the Internet 24x7. In the early years of Mac OS X, there was the concept of Darwin’s open source nature and security auditing. In the middle of the last decade, it took the form of security architecture and OS design. Lately, it’s taken the form of sandboxing and Apple-signed digital certificates.
This steady escalation of improved security, protection against Black Hats out to make money by compromising our Macs, is not only good in itself, but is also a recognition that the Black Hats also have access to both advanced tools and deep understanding of the target OSes plus a pretty good understanding of human psychology.
Against that backdrop, there is the Apple culture, born of Steve Jobs’s vision, that the Mac must operate as an appliance. He once said, if I remember right, there’s no need for a Maytag user’s group. Washing machines and dryers just work. They’re appliances. (But wait until they get Ethernet addresses.)
On that appliance theme, one of our TMO readers, John Francini, wrote me as follows:
Ordinary computer users shouldn’t have to worry about viruses, trojans and the like in order to use, what is in essence a tool. You don’t have to worry about whether the hammer you pick up to drive a nail, or the microwave that you use to heat leftovers, or even the car you drive every day can be infected by malware.
A computer system is also a tool. Nothing more, nothing less.
The fact that an entire multi-billion dollar industry exists to fight malware shows that the dominant OS vendor has completely failed in its obligation to put out an un-infectable product. The malware industry only exists because of this.
Only tech people—who conveniently forget that the vast majority of the populace is not tech savvy, nor does it ever care to be — think that everyone should be “manning the barricades” of anti-virus products and procedures… Not gonna happen. Deal with it.”
I like the spirit and the dream proposed in that response, but I disagree on practical grounds. It would be like saying that driving your kids to school should be happy and risk free. No need to exercise vigilance and caution on the highway or in the School Zone.
Examining the Dream
Okay, how are we doing? Can we really achieve that dream? The answer to that seems to depend on many factors, most of which are outside Apple’s control.
For example, I suspect it’s almost a mathematical theorem that any sufficiently advanced technology, based on any OS, can in turn compromise that OS. In other words, given the design of any modern OS, it’s impossible to get a permanent upper hand on Black Hats. There will always be vulnerabilities in any OS that’s friendly enough for a home user. (There are variants of secured Linux that are so secure, they’re almost impossible to use.)
As evidence for the theorem, Apple, Microsoft and others have waged this never-ending battle since the dawn of the public Internet, not quite 20 years ago, and have still not obtained a clear-cut victory. For every door that is slammed shut (like port scans) another door is pried open (Java vulnerabilities). There will always be new ones, based on technology as well as human psychological weaknesses.
Given that Apple isn’t going to change its marketing approach, it falls on Apple customers to shake themselves out of their comfortable bliss.
Social Computing
One of the mysteries of modern computing life is that Internet users are very interested in sharing information in social networks — Facebook, Google+, Twitter and so on, but they’re reluctant to be social animals when it comes to computer security.
For example, Symantec, Intego and I presume Kaspersky and McAfee maintain data centers where they monitor the Internet and various emergent threats. Once these threats are understood, they can be added to the growing database of signatures. All one needs to do to tap into this huge institutional knowledge base is to buy an inexpensive security app from one of those companies, and it will access it. Every packet that comes into your computer will be inspected and diagnosed. That’s about as social as you can get.
And yet. And yet, the culture of the average Mac user remains that these companies are trying to scare us into buying their modestly priced product because they’ve bought into Apple’s dream. If you think those products are expensive, think again. For example, small business routers that inspect packets at the gateway can cost thousands of dollars with hefty annual licences for intrusion, virus and phishing detection.
On the other hand, the price of admission to the security social network is under a hundred bucks, and many turn their backs on it. I’ll argue that the technology war between Apple and the Black Hats can never be permanently won by Apple, and so social networking, tapping into the security information needed to inspect our traffic is the only way to stay safe. It takes a Borg mind to defeat the Borg, as Captain Picard showed us. You can’t do it alone.
Apple’s Take
If you listen to just Apple, you’ll be told that they’ll take care of you. And yet, recently, it was reported that over 600,000 Macs were infected with the Flashback Trojan because Apple was slow to react. So not only can Apple not permanently get a leg up on the Black Hats, but corporate issues, over and above OS technology, can occasionally leave us vulnerable.
The recognition that Apple has a business to run and products to sell means that Apple will never take the stand that customers need to worry about their products. The Holy Grail that Apple can achieve technological superiority combined with the culture of Apple and its customers that Macs truly are simple, safe, secure appliances means that some careless or indifferent customers will always be compromised. And Apple will always take a black eye for it. It’s still happening in 2012, and it will be never ending.
Summary
A wealth of tools are available to the aggressively conscientiousness Apple customer. Some are easy and social, like the subscription to popular security apps. Some are more geeky, like the expensive proposition of a home router with intrusion detection, packet inspection and e-mail alerts. The fact of the matter, however, is that Apple will never be able to achieve a kind of cold war technological superiority that will allow us to live in comfortable, toaster appliance bliss.
The measures the customer takes, those that are suitable and fathomable, will always be necessary to supplement Apple’s dream. You can have a cell phone and be trained in martial arts, but you wouldn’t chose to walk down a dark alley and be oblivious to your surroundings.
There’s a saying amongst U.S. Navy submariners. “There are only two kinds of ships: submarines and targets.” You will always be a target, but having your own attack submarine as a partner will improve your chances. It’s part of emerging from the shell of Apple-induced bliss. In other words, yes, it’s regrettable, you do have to worry. Until you’re not a target anymore.
___________
Image Credit: Clouds and battleship (Shutterstock), head in sand: iStockPhoto. Teaser image created with help from Shutterstock. Thanks to Bryan Chaffin.
