Mac attack in the works?

Dan Gillmor points to reports of a Horrible Apple OS Security Hole. In fact, he says, Mac users should be “extremely careful in surfing until Apple fixes this.”

[Update: The link above is dead. Now that Dan has left the Merc and has his own site, all old links redirect to his new site at Bayosphere.com. To read about the “Extremely Critical” vulnerabilities identified in this alert, see advisory 11622 and advisory 11689. Both have since been patched by Apple, but a Mac user who doesn’t install these patches is highly vulnerable. As Secunia explains: “[These] vulnerabilities … in Mac OS X [allow] malicious web sites to compromise a vulnerable system. … The rating has been upgraded to “Extremely Critical” because the issues are very easy to exploit and a large number of working exploits are available.”]

Well. I promise not to say I told you so, or anything, even though this is at least the third report I’ve seen in recent weeks of serious security issues with the Mac OS.

The reality is, any operating system that includes networking components will be attacked if it becomes sufficiently popular. Both Linux and the Mac OS have a partial advantage over Windows in that they don’t allow every user to run as Administrator, with full access to the machine’s innards.

But anyone who smugly thinks that using a Mac makes them immune from security exploits is headed for disaster. In fact, a really well-written Mac worm could probably spread very quickly, because the Mac community isn’t as attuned to the need for patches and ongoing security as us long-suffering Windows users.