Microsoft Security Ahead Of Apple, Says Security Firm Chief

Look out, Apple. Eugene Kaspersky is calling you out.

The founder and CEO of Kaspersky Labs spoke with Computer Business Review (CBR) about Apple's slow progress in security at this week's Infosecurity 2012 event in London.

"I think they are ten years behind Microsoft in terms of security," Kaspersky told CBR. "For many years I've been saying that from a security point of view there is no big difference between Mac and Windows. It's always been possible to develop Mac malware, but this one was a bit different. For example it was asking questions about being installed on the system and, using vulnerabilities, it was able to get to the user mode without any alarms."

The malware about which Kaspersky speaks, the Flashback trojan, struck more than 600,000 Mac devices early this month and prompted Apple to release three separate Java updates to patch vulnerabilities in the software and prevent more security problems.

Unfortunately, Apple's security updates may have come too little, too late. While just last week, Kaspersky Labs researchers had pegged the number of machines still plagued with the Flashback trojan at just 30,000, a recent report by Russian IT-security vendor Dr. Web shows the number of infected devices may be as high as 550,000, reports The Next Web. (Dr. Web researchers first discovered how widely the Flashback trojan had spread.)

While Apple has been slow to respond to new security concerns, CNET reports that Apple is making moves to boost the security on its devices. For example, XProtect, a built-in malware scanner, came with the last two major versions of Mac OS X. And security technology called Gatekeeper will be built into OS X Moutain Lion and will let the user to install only software designed by registered developers.

But with malware like the Flashback and Sabpab trojans still making their rounds, and wth recent studies showing just how vulnerable Apple devices are, Mac users might do well to heed Kaspersky's words of warning. As he told CBR, more Macs (last quarter saw 4 million sold, a 7% increase from last year) will only mean more problems.

"Cyber criminals have now recognized that Mac is an interesting area," Kaspersky said. "Now we have more, it's not just Flashback or Flashfake. Welcome to Microsoft's world, Mac. It's full of malware."

What do you think of what Kaspersky had to say? Do you agree or disagree? Let us know in the comments!

Related on HuffPost:

From our partners

Comments

[PenguinLinux]

11:48 AM on 04/30/2012

1) Security through obscurity is a logical fallacy. Just because something holds less market share does not mean it is more secure or likely to be attacked. apache has more market share as a http daemon than IIS does, yet IIS is hacked more not because of design.

2) No OS is 100% secure and you can take the most securable OS out there and put an uneducated end-user in front of the keyboard and you'll get tons of Layer 8 issues every time. You can patch the OS, but you can't patch the end-user. The EU is all-too-often the cause of security breaches because of their lack of education and adherence to security policies.

[Desolati0n]

07:56 AM on 04/30/2012

The fact apple originally never even had a malware scanner on their operating systems before this is just arrogance. They thought they were untouchable and they realize now they aren't. Technology is always expanding and people are always becoming more curious, you should always be ready for anything life throws at you even if it seems impossible, and I think now apple realizes this.

[thegriffinite]

03:26 AM on 04/30/2012

This guy works for Microsoft why would he say anything good about apple.

[Sam1234567]

08:44 AM on 04/30/2012

Uh, no he doesn't. He owns one of the largest security software companies in the world and has no affiliation with Microsoft other than developing software that will run on their OS (which he does the same for Apple). He is in Russia too, not even a US based company.

[Highball]

09:40 PM on 04/29/2012

It's full of malware. Really?

And honestly, anyone who doesn't upgrade their software is asking for trouble no matter the platform. I mean, jeez: You can just do it automatically. It's not like you have to actually know anything about it.

Also, who would d/l this stuff in the first place? I mean, some random MSWord document, and one that will infect your machine only if you have some version of software that's years old?

Come the heck on.

[JackTheSkipper]

01:19 PM on 04/29/2012

Why would anyone hack into grandma's MacOS computer that she only uses for her quilt club newsletters and to send and receive emails with her grandchildren?

[Ramy Khuffash]

07:33 AM on 04/30/2012

People don't care about the user. If their computer connects to the internet it's useful for hackers. It can be used for DOS attacks, a cloak for strange things they want to do online and all sorts.

[Desolati0n]

07:51 AM on 04/30/2012

Well technically if it was a botnet it would be a DDOS not a DOS.

[Desolati0n]

07:51 AM on 04/30/2012

It would be used for a DDOS, not a DOS**

[mfstout]

11:32 AM on 04/29/2012

How in the world does Kaspersky and his gang know how many computers are actually infected? Sounds like a sales pitch to me.

[catbeller]

05:49 PM on 05/01/2012

Kaspersky has no way of knowing that. They are using "statistics", ie they are making it up.

[inreasonsimage]

05:28 PM on 04/28/2012

Now that Apple's market share is getting larger I'd go after Macs, if I was writing malware. Most Apple users are clueless about security and don't even run anti-malware software on their macs. Apple users also obviously have a lot of cash to spend on technology.

[Reality always bites]

05:22 PM on 04/28/2012

Excuse my ignorance- but this article and all the comments are just asking for a new 'Smug virus' that will infect all Mac and PC users.

[JosephTX]

05:02 PM on 04/28/2012

"What do you think of what Kaspersky had to say? Do you agree or disagree?"

LOL! yes, let's let everyone argue with the world's leading cybersecurity experts. Surely the average person on the internet knows more than them.

Assumptions that Kaspersky's just saying this to sell more software (while probably PARTIALLY true) can be dropped when you consider that most cybersecurity experts agree with him. And can anyone really be surprised? Apple's enjoyed the "luxury" of having a single-digit OS market share for 10 years, so when their business model revolves around advertising more than utility, it shouldn't be a surprise that their security is... 10 years behind a Microsoft's.

And for the 1000th time guys, the reason "[you] haven't had any malware on [your] Mac" is because hackers are obviously going to focus on the OS with over 90% of the market share. And YOU KNOW THIS. So stop saying that.

[DavidEvan]

11:40 AM on 04/28/2012

That statement will sell more Kaparasky Anti-Virus for Mac packages.

[StinkyPete0279]

08:39 PM on 04/28/2012

Which has no bearing on the fact that it is true.

[catbeller]

05:54 PM on 05/01/2012

How? Because you want it to be?
I've been googling this subject for hours, yet have had to find, other than one or two companies' assertions, any evidence of this "infection" from any investigator. I'm not being contrary. There are no reports of isolation or identification of this gigantic scourge other than one company's original assertion followed by millions of gleeful me-two posters and reporters trying to be "fair"... where is this package? Why can't anyone produce it? Something stinks here.Everyone knows it's true because everyone knows it's true. This is beginning to look like hysteria.

[Tsvi1]

10:25 AM on 04/29/2012

"There will be floods in New Orleans, you should get flood insurance", says the insurance salesman
"Youre just trying to sell me products! Greedy capitalist how stupid do you think I am????" retorts the soon-to-be-homeless private citizen.

[jo smith456]

10:28 AM on 04/28/2012

Now that Mac OS is gaining market share, hackers and security researchers are now beginning to focus their attention on Mac OS. This means more malware attacks for Mac OS. No surprise here. Mac OS design has barely nothing to do with it.

[cabrobst]

07:45 AM on 04/28/2012

And yet I have no malware problems on my iMac.

[Angelus2007]

10:18 AM on 04/28/2012

For Mac or PC users, it usually has more to do with browsing habits than the OS. If you are responsible while browsing, you will probably be safe regardless of OS.

[DRaymond]

03:52 PM on 04/28/2012

How do you know?  Because nothing behaves badly?  Keyloggers and botnets specifically try not to show any symptoms so that you won't know what your computer is doing behind your back.

Attitudes like this are the reason why Mac is 10 years behind Windows.  Nothing seems to be wrong therefore nothing is wrong was security thinking a decade ago when most malware was pranksters and adware.  Now it is about stealing your identity and using your computer without your knowing.

[HamburgerTime]

05:30 AM on 04/28/2012

Anyone who knows anything has known this for ages. It's only the Apple zombies that keep buying into the idea that their new trendy gizmo is perfectly safe. It's Apple's obscurity in the market that kept it relatively safe for many years. Why develop malware for 10% when you can use those resources to develop for 90%.

[JohnTheMac]

07:29 AM on 04/28/2012

There's an element of truth to the "security through obscurity" concept.
And I say "so what?"
It's a valid tactic, to help be secure, by being obscure.
This was always a put-down by Windows users, to ridicule the small market share by calling a platform obscure. What they didn't realize was the heavy price they pay for their popularity in the attraction of malware. All the time they laughed, we enjoyed security through obscurity, and still do, because of the reasoning in your last line.
People use "security through obscurity" all the time in the rest of their lives, such as having an unlisted phone number.

[umwaitwhat]

09:08 AM on 04/28/2012

You are losing the obscurity though.

[DRaymond]

03:55 PM on 04/28/2012

The security through obscurity only works if all systems are equally vulnerable.  If the 90 percent are hardened and the 10 percent are soft targets you begin to get more success by targeting the ten percent.

[jo smith456]

10:29 AM on 04/28/2012

right on the bull's eye!!!

[Ash G]

03:32 AM on 04/28/2012

Many Apple fans blame Java or Flash or any other third-party software. Isn't it the OS maker's responsibility to protect their OS? Like, if Java allows the exploit to go through, shouldn't the OS plug its own holes first? MSFT do just that. Apple recommend not to use Java instead.

Their iTunes for Windows meanwhile is one of the buggiest cludgiest pieces of software I've known. I guess I will be following their own advice and stop using it. Except that despite its outstanding list of bugs and potential security holes (remember, Apple was awarded as the most unsecure software producer) Windows does just fine.

[DRaymond]

03:56 PM on 04/28/2012

You are correct.  Java is supposed to run in a sandbox.  If the OS allows for a leaky sandbox then it is the problem of the OS.

[redmaple]

10:51 PM on 04/29/2012

Apple and their cult followers have always blame others when there is an issue. Yet they always blame Windows when there is an issue on Windows.

[redhillsrd]

01:26 AM on 04/28/2012

at apple takes ownership and send out fixes!

and over the last 3 years of using Macbooks, this is the first time ever. I used to spend 1 day each month fixing malware on Win laptops in my home...

for years, microsoft left the anti-virus fixes to the 3rd party vendors! never sent out any OS updates - just more bloated software that slowed down my machine. My Mac still works at the same fast speed as the first day I got it.

[DRaymond]

03:57 PM on 04/28/2012

Thank you for your complaints about how Microsoft was in the 1990's.  They help combat nostalgia but are otherwise absolutely irrelevant.

[Michael Johnson 1]

04:34 PM on 04/28/2012

I say you are wrong. I dont use any of that 3rd party trash. Generally if you just UPDATE WINDOWS LIKE YOU ARE SUPPOSED TO you can avoid 90 percent of any virus problems.

[PenFighter]

12:30 AM on 04/30/2012

In my experience, 90% protection is worthless.