Mac Defender: Pay attention but don't panic

25.05.2011

The bad guys are . They spend all day, every day, trying to figure out ways to get a few of you to install a piece of software, enter a credit card number, or buy a fake purse off Amazon. Probably every one of you out there has fallen for some sort of scam, big or small, physical or virtual, at some point in your life. We’re human, after all.

And the scams are getting better. For example, recently a company called Epsilon was . Epsilon is one of the largest commercial e-mail marketing firms, managing lists for companies like TiVo. The bad guys obtained the names and e-mails for everyone who had opted in of any of Epsilon’s lists. Imagine getting a perfectly normal looking e-mail from a company you do business with that is addressed to you by name, and includes some links for new features. Ask yourself: Are you really immune to this kind of phishing attack?

There also really aren’t safe online neighborhoods anymore. Many Mac Defender victims searched for innocuous items like images of children’s birthday cakes. “Trusted” Websites, including many with well-known brand names, are breached and used to attack visitors on a daily basis. Who needs to break into your online bank account when he can get you to click on a poisoned link on Google or Facebook?

It’s time for those of us in the Mac community to start paying more attention to security issues—not because Apple is issuing a patch, but because, even if our Macs aren’t the target, are. We’re going to see more attacks—some technical, some not—and we need to realize that we can all be fooled at least once. As Windows gets more secure, and Macs more popular, it only makes good business sense for criminals to start moving in our direction.

We are most likely transitioning to a state of constant, low-level crime and harassment that relies as much on fooling us as cracking our Macs—and probably some combination of the two. Bad guys will always go after the easiest, most cost-effective target. As operating system vendors continue to tighten the screws, the targets will likely shift to Web services, getting us to install the software ourselves, and traditional scams.