A worm in the Apple

By G.F. | SEATTLE

A COMMON dig at Apple-desktop users is that they are delusional about its operating system's resistance to viruses, worms and other malware. Your correspondent has been a Mac owner since 1985, and has lived through the original waves of viruses and worms, which targeted the Mac long before Windows. He and many other IT wonks have been anticipating a major exploit for some time. That day arrived at last in the form of a malicious bit of software which affected one in 100 Macintoshes running the vulnerable software, according to Dr Web and several other security firms. That is equivalent to more than 600,000 users. (By April 11th the number had dropped below 300,000.)

The Flashback malware, which in its present form can extract passwords and other information from the Safari browser, first appeared in 2011 in the form of a Trojan horse, or a piece of software that alleges to be benign, but masks malice. Flashback got its name because it mimicked an Adobe Flash installer, even though the malware had nothing to do with Flash. In its early form, users had to download, and then run the installer software and enter a password in order to proceed. Precise numbers of those hoodwinked this way are unknown.

Flashback's developers subsequently created a nastier mutation, capable of so-called "drive-by" attacks. Now a user merely needed to visit a malicious web page—no one seems sure which ones—and the malware was installed automatically. The new version used webpage scripts to exploit a flaw in Apple's version of Java that allowed the malware to install itself in the system.

Apple has eschewed Java in its mobile devices. Its current Mac operating system release 10.7, dubbed Lion, also is none too keen on it. Lion comes with neither Java (nor Adobe Flash) preinstalled. The first time a user needs Java, the system offers to download and activate the software. Thus, the virus was only able to penetrate users of the previous release, 10.6 (Snow Leopard), or any Lion users with Java purposely installed.

The particular flaw in Java that the malware exploited was known to Oracle, which acquired Java together with its orginal developer, Sun Microsystems, in 2009. Oracle patched the bug two months ago on every platform that it supports, either mobile or desktop, including Windows. But this did not extend to Apple, which used to build its own version of Java. In late 2010 Apple agreed to let Oracle do most of the work. But it still needs to tweak whatever Oracle provides in order to ensure it works in Mac OS X.

In this case, Apple did not release the update with critical bug fixes from Oracle until April 3rd. At that point it was too late, as the Flashback virus had already used Java to insinuate itself into hundreds of thousands of Macs. It was not until April 14th that Apple created and distributed a Flashback removal tool.

Java itself is not the source of the problem. Apple's OS X is a mass of in-house, licensed, open-source and free software knitted together. The company is not bad at fixing flaws in code before they have been exploited or publicly exposed. But it has a spotty record for hopping on those that need to be fixed instantly—and, that have already been repaired on other platforms. In 2008, for instance, one flaw (which threatened the internet's domain-naming system) was repaired on the day it came to light by every major software-maker except Apple.

That Apple has managed to dodge the malware bullet for so long is in large part down to luck. Even in this case, Flashback was only mildly malicious and easily removed; mischief-makers did not have time to make it nastier. But Apple should not count on such good fortune lasting for ever. It has been warned.