May 11, 2011, 8:51 PM — Apple -- and many Mac users -- argue that Mac OS X has a special recipe for security that makes it less likely to be infected with malware. Many security researchers counter that the Mac's seeming immunity stems not from its security, but from its lack of market share.
The debate may finally be settled.
The emergence of a serious malware construction kit for the Mac OS X seems to mimic a 2008 prediction by a security researcher. The prediction comes from a paper written in IEEE Security & Privacy ( in .pdf), which used game theory to predict that Macs would become a focus for attackers as soon as Apple hit 16% market share.
Last week, security researchers pointed to a construction kit for creating Trojans for the Mac OS X as a major issue for Mac users. Currently, three countries -- Switzerland, Luxembourg and the United States -- have Mac market share around that level.
"The kit is being sold under the name Weyland-Yutani Bot and it is the first of its kind to hit the Mac OS platform," Peter Kruse, partner and security specialist at security firm CSIS, writes in a blog post. "CSIS finds this crimekit to be quite disturbing news since Mac OS previously to some degree has been spared from the increasing amount of malware which has haunted Windows-based systems for years."
Weyland-Yutani Bot, named for the corporation in the 1979 movie Alien, is currently being sold by its developers. While it is not the first attack on the Mac OS X, crimeware has enabled criminals in the past to scale up attacks quickly.
"What is happening is that people are testing the waters," says Adam O'Donnell, chief architect of the cloud technology group at SourceFire and the author of the 2008 paper. "It just becomes economically viable to do it, so you start seeing these attacks becoming more common."
The 2008 paper used game theory to calculate when attackers would start seeing a payoff in focusing on the Mac OS X over Windows. It simplified the problem by assuming that all PC users ran antivirus software and that no Mac users did. The assumptions helped reduce the problem down to two factors: the effectiveness of the defenses and the marketshare of the dominant platform.