People who have watched the issue of Mac malware for a long time have some special reasons to be skeptical of Flashback hype. I absolutely agree that some of the expressed skepticism is at odds with reality, but it is understandable.

First, it is important to understand that AV vendors have been episodically firing up their best FUD generators for a decade to convince Mac users that they should all go out and buy AV software for every Mac

now

because the Mac Malware Apocalypse has started. That premise has never been true before last week. Second, Flashback is a cowardly species of malware that runs away from geeks’ Macs. It makes no attempt to infect if it finds any of a number of common apps including Xcode (Apple’s free IDE), multiple AV programs including ClamXav (a GUI wrapper of the free clamav package), network monitoring tools, and even MS Office (presumably due to gross incompatibilities that would reveal the malware.) Having Xcode installed is pretty common, since it has been the normal means of getting tools installed for use in cross-platform open source software and so is usually installed by anyone who has used environments like Fink, MacPorts, or Homebrew to get access to that realm of software. Most of the other things that scare off Flashback are also somewhat more likely to be installed on systems used by people who are attentive to the risk of malware on their Macs. Finally, those of us who have been using Macs long enough remember that there used to be a real MacOS malware problem in the System 6 and 7 era, and the dominant folklore (which includes seeds of truth…) is that we essentially solved that ourselves despite the commercial AV racket and Apple, rather than in cooperation with them.

The result is that with a penetration on the order of 1%, Flashback has infected a very large number of Macs but it largely has avoided the Macs of people who are attentive to the risk of malware or who otherwise care about what’s “under the hood” of their Macs. That population sees no Flashback in their world unless they happen to also work with other sorts of people’s Macs. They also are likely to understand that the AV industry has been crying wolf for a long time to sell products to them that are de facto worthless and frequently destabilizing. The Mac “Power User” community has been conditioned to distrust AV vendors and to trust in their own behavioral discipline to keep their machines clean.

Unfortunately, that conditioning has made some of us who ought to know better reflexively scoff at the Flashback stories. It takes a little discipline (or maybe just the right amount of ADD…) to see the mass media coverage and react by hunting down the original sources to judge their credibility instead of just firing off a scoffing response because that’s been an appropriate thing for the last 5 similar stories.

Flashback IS DIFFERENT. Those of us who are uninfected despite our lack of maximally paranoid AV in service cannot credit our morally superior self-discipline or magical invulnerability of MacOS X for our pristine state, we can only be grateful for a first seriously dangerous malware species that avoids exposure-prone systems and for our luck of it being discovered in the wild when infection was still around 1%. The next exploitable gap might not have the visibility of a major Java flaw and Flashback has provided a useful lesson in how to attack MacOS for script kiddies who may not have previously bothered to look at how the dynamic runtime linker works.