Cybercrooks Focus on iOS

I don't quote authority to prove I'm right, but just to show that my thinking is in the mainstream.

Security expert Bruce Schneier credits the Mac's small market share: "If you're looking for the masses of naive users, Windows is where to go," he says.  Adam O'Donnell, director of emerging technologies at Cloudmark, agrees. He's applied game theory to the question and concluded that producing Mac malware won't be economically viable until the Mac's market share hits 16 percent (it's now under 9 percent). O'Donnell says, "There is no economic benefit to investing the time in compromising a Mac when you can compromise 10 to 20 times more systems for the same level of effort by going after PCs."

MacWorld

That's from a few years ago, but it's really the history I'm talking about.  Times have changed.

Mitch, the vulnerability of Windows is - or has been - self-perpetuating.  Most hackers do not devise their own exploits: they copy what others have done.  What others have done is hack Windows.

This is not to say Mac OS isn't more secure than Windows.

@robjvargas - Yes, and in that case Apple was, in fact, the security hole that got the whole mess started. 

I'm not arguing that Apple is more secure. But MacOS is. 

I think it was just a matter of time before hackers turned their attention to something else. Something 'shinier', like Apple's iOS. A couple of months ago, around April (if my memory serves me right), the Flashback Trojan affected over 600,000 Macs. It was obvious that Apple was unprepared for an attack of such magnitude. With all that attention on Apple and their OS, it was only logical that hackers would look towards the iOS next.

Mitch, I agree that it's not as simple as market share.  On the other hand, I think it's still a major factor.

You should read Mat Honan's description of what happened to him.  He actually was contacted by a hacker who was involved in the deletion of his Google account, and the wiping of all three of his Apple devices, an iPhone, iPad, and Macbook, all tied together through his iCloud account.  As he says:

[T]heir ultimate goal was always to take over my Twitter account and wreak havoc. Lulz.

So thinking of hackerdom in economic terms isn't adequate. What economic benefit did they gain from wiping his devices?  In fact, as Mat Honan says:

By wiping my MacBook and deleting my Google account, they now not only had the ability to control my account, but were able to prevent me from regaining access. And crazily, in ways that I don't and never will understand, those deletions were just collateral damage. My MacBook data — including those irreplaceable pictures of my family, of my child's first year and relatives who have now passed from this life — weren't the target. Nor were the eight years of messages in my Gmail account. The target was always Twitter. My MacBook data was torched simply to prevent me from getting back in.

Collateral damage.  They didn't gain a direct economic benefit.  They simply wanted a popular Twitter feed.

We've got tons of postings and comments around here about "The Cloud" and Cloud-based services.  It's entirely possible that "iOS vs Windows vs ChromeOS" is not even the question we should be asking.  Maybe iOS *has* been more secure all these years.  Maybe it was lucky from a security perspective simply because of its small footprint.

Or maybe the REAL question is: is the digital infrastructure really ready for a cloud-connected and cloud-dependent market?

While there is a grave moral difference between hacking and legitimate applicaiton writing, the economics are the same. 

Hackers don't care where the loot comes from. Neither do legitimate developers. They go where the money is. 

And most legitimate app developers aren't writing their own binary code; they're using off-the-shelf development tools. Which are more far more commonplace on Windows than on the Mac. 

If the rarity of attacks on Macs were a simple matter of market share, then we should see a similar scarcity of Mac apps. Which we do not. Somethin else is causing the disproportionate representation. 

Another way of looking at it, Mitch: as a writer, I care somewhat who I write for. If I was a bank robber, I wouldn't care which bank I stole from. There's a conceptual asymmetry there.

You're right, Rob.  The Honan hack might not be relevant to iOS security, but it does reveal a sadly haphazard approach to security in general.

There's a difference between specializing in writing apps for a OS and specializing in stealing from a certain OS.  Hackers don't care where the loot comes from.  What's more, most cybercrooks aren't devising their own exploits; they're grabbing or buying tools already available.  This has tended to perpetuate the vulnerability of Windows.

The recent Epic Hack of Wired correspondent Mat Honan should point out just how weak Apple's security posture really is.  I mean, last four of the credit card number to reset passwords that permit wiping devices?  For real?

That number is on virtually every receipt, virtual as well as physical, where the card has ever been used, and many of those same receipts have your name on them as well.

Apple thought this was secure?  Let's not ignore, either, that Apple has so far (as I have seen) refused to even acknowledge the security failure, even though it cancelled over-the-phone password resets.

Now isn't the time to say that Apple's security is dismal.  But it's facing a challenge, and there is very real reason to doubt that they are ready for it.