The Future of Mac Security

Over the last few weeks we've fielded a ton a ques­tion, from clients and friends alike,  about the "Flash­back Virus". Now, this makes me a lit­tle nuts, espe­cially when the TV talking-heads dis­cus it like it's going to be Apple's down fall. But all the nit-picking and seman­tic argu­ments aside  -what is the real­ity of the threat and is Apple tak­ing it seriously. I think the short answer is, yes. The Threat is real, and grow­ing. As for Apple tak­ing it seri­ously, at first glance, the answer looks like no. But lets back up a bit first.

Right now, as it stands, the "Viruses" out their for the Mac are all of the Tro­jan Horse vari­ety. Which means, that at some point along the way, you allowed the dan­ger through your gates. In short, you did some­thing unwise. You down­loaded a plug-in from some ran­dom web page, or you did some­thing really dumb and installed a boot­leg copy of some soft­ware you got of a "shar­ing" site. Which brings us to the sad truth. No mat­ter how good your Ati-Virus Soft­ware may be, it can't keep you from doing dumb stuff.

So where does that leave us. Well, I think the thing you need most (right now), is dili­gence. Be con­science of what your pulling off the inter­net. If your a busi­ness and you deal with lot of doc­u­ment from ran­dom places, yes, get some Anti-Vitrus. Espe­cially if you deal with lots of Word Documents. But what about the rest of us, what do we do. Well, this is where Apple's appar­ent inac­tiv­ity is not what it appraise.

Not sure how many of you down­loaded and installed the pub­lic pre­view of Moun­tain Lion, but Apple has a new secu­rity fea­ture in 10.8 called Gate­keeper. This is a very cool addi­tion to the already superb Adap­tive Fire­wall. What is this Gate­keeper thing and how does it work?

Well, this is one of those times where hav­ing one guy (or Com­pany) in charge of the whole she­bang is a good thing. I'll explain.

Lots of peo­ple com­plain about Apple and their heavy-hand approach to iOS apps and the App Store. They want to be able to add any app they see fit to use (which is the cur­rent state of the Mac OS). This sound like a good thing (it's my phone and can use it any way I want), but lets take a deeper look at that strat­egy. Apple is makes some big promises with iOS devises. They say thing like "it just works". Well, the rea­son they can say that, is all apps must go through the Apple Devel­oper Pro­gram and all that comes with it. Like test­ing the app to make sure it wont crash the phone. To insurer the app is as adver­tised. Insur­ing that "it just works", and that you have a con­stant user expe­ri­ence across all apps and devices. Also, it has the added ben­e­fit of keep­ing out Viruses. Any cases of infected iPhones yet? And why not? Because Apple knows you are how you say you are when you build an iOS app.

Gate­keeper is an exten­sion of the same idea. You can trust all the apps you get from the Mac App Store pre­cisely because Apple uses it's iron fist to keep the bad guys beyond the gates. With Gate­keeper, Apple can extend the reach gates far beyond the Mac Apps Store. And this new expand­able gate comes in the form of a Apple issued Devel­oper ID. App makes can then use this ID to sign their app, and then Gate­keeper ver­i­fies that ID against Apple data­base. Just like an SSL Cer­tifi­cate is used when you login to your back, Gate­keeper is kind of third party ver­i­fi­ca­tion that will keep your Mac Virus and Tro­jan free.

And get this, it's a radio button.

So, as you can see, Apple is give you three options. You want to be a tyrant, OK, Mac App Store only. Or, you can rely on your own savvy inter­net dan­ger detect skills, it's up to you. So remem­ber this next time you want that cool jail­break only app, or that "free" copy of Pho­to­shop online, you have no idea what might be lurk­ing inside the pack­ages you are going to install. Flash is a legit­i­mate appli­ca­tion cre­ated by a trusted Devel­oper. But some­one altered it. Whit the advent of Gate­keeper and the Devel­oper ID, if some tam­pers with the app or the installer, it wont install. The ID acts like a disk image check­sum, and if there is a dif­fer­ence in what you have and what was reg­is­tered. Well, the big soul­less cor­po­ra­tion and their iron fist just saved you bacon.