Meet the biggest threat to your Mac’s security: Microsoft Windows

While reading some reviews of a Macintosh anti-virus progam, I was surprised to see a comment that Mac users should use the software to keep PC users safe. The argument was that while the Mac couldn’t be affected by a Windows virus, it could certainly pass it along from one PC to another. At first, I was astonished by this proposition; why on Earth should I care to help out PC users. After all, what have PC users ever done for me except gloat about market share and processor speeds!

But the guy had a point.

While viruses mess up computers and removing them wastes time and money, they also contribute to most of the biggest dangers on the web, things like identity theft and credit card fraud.

The problem with writing a virus is that it doesn’t actually provide the writer with an income. To be fair, one or two virus writers have tried to use them to extort money. Once installed on a PC, one such virus, Archiveus, searches for the My Documents folder, and then concatenates all the files found there into a single large archives. A new text file appears in the My Documents folder, informing the user that the files can be easily recovered simply by visiting an online pharmacy and buying some of its products. Upon receipt of an e-mail containing a sales code, the virus writer will then supply the victim with the password needed to recover the lost files.

However, adding an overt threat for cash to a virus is actually relatively rare. For one thing, any viable channel for allowing victims to pass fund to the virus writer opens up a route for law enforcers to track them down. There are simply much safer ways to make money using your virus-writing skills. The most popular is to install software on the victim’s computer that turns it into a computer that spews out spam (known as a “zombie”). This spam generates traffic for one or more web sites, and it is these that make the money, but in a way that doesn’t obviously link the malicious software writer with the actual web site benefiting from the spam. Estimates of exactly how much spam come from these hijacked computers isn’t known, but it’s certainly around the 70% mark.

And this is where the Mac user comes in. A lot of spam e-mails are used for various identity theft crimes or simple credit-card crimes by tricking people into buying products from non-existent online stores. While the zombie computers will almost certainly be running some form of Windows, the victims of identity theft and credit card fraud could be running Windows, Mac OS X, Linux, or any other operating system because the weak link isn’t the computer but the person reading the e-mail.

Part of the reason Windows is targeted by virus writers is the fundamental insecurity of Windows itself. It is just so much easier to write a virus or malicious computer program for Windows than it is for the Mac or Linux.

The second factor is the generally poor understanding that the majority of Windows users have of their computers and how they work. A lot of Windows users freely download and install all sorts of funky system add-ons and mini-programs, some of which turn out to be adware and spyware. Linux users, almost by definition, are geeks because their machines are so darned complicated to use, but Mac users aren’t any more gifted computer engineers than Windows users. If by some miracle the Mac OS market share jumped to 25%, there’d likely be a lot of those new users who would OK the installation of malware and type in their administrator password just as easily as any naive Windows user.

One difference though is that while Mac users tend to be individuals or people in small businesses, much of the Windows marketplace is corporate, and Microsoft has tended to listen to them rather more than may have been wise. Most notoriously, Windows XP was shipped with it’s built-in firewall switched off by default because IT managers wanted it that way. So what’s fine in big offices can end up being lethal in the home.

In the short term at least, Microsoft is pinning its hopes on OneCare, a $50 package for the home and small office market released last month. OneCare rolls anti-virus, anti-spyware, and firewall software all into a single annual subscription. Compared with the anti-virus tools from companies like Symantec the price is remarkably competitive, but historically that hasn’t guaranteed universal, or even widespread, take-up of such software in the Windows marketplace. Many spyware and virus removal tools, such as Ad-Aware Personal and ClamWin, are free, yet Microsoft estimate that as many as two-thirds of their consumers either have no security software or simply don’t update it, rendering it effectively useless. If they don’t bother with the free stuff, do you think they’ll pay $50 a year?

Mac users find themselves in a funny position. While certainly a good deal less at risk from from viruses than PC users, the average Mac user still needs to wade through tonnes of spam e-mail every day, and the real dangers, identity theft and credit card frauds, are just as real for us as for them. So while most Mac users can get by fine without anti-virus software, perhaps the best way to protect yourself is to make sure that every PC user they know keeps their anti-virus software up to date.