SAN FRANCISCO – Perhaps Microsoft isn’t alone in issuing some security patches on the down-low. A new report from security software maker Sophos claims that Apple this week silently updated anti-malware protection in its Mac OS X operating system. In fact, the patch was so hush-hush that Apple failed to mention it in either the release notes or security bulletin that came with its Mac OS X 10.6.4 upgrade, which included the mysterious security fix.

Sophos senior technology consultant Graham Cluley, in a Friday blog post, asserts that Apple quietly patched the Mac’s malware protection to thwart a backdoor Trojan horse that could allow hackers to control an iMac or MacBook remotely.

Apple’s OS X 10.6.4 upgrade secretly patched XProtect.plist, a file that contains “elementary signatures of a handful of Mac threats – to detect what they call HellRTS,” Cluley writes. Malicious hackers have been disguising HellRTS as iPhoto, the Mac’s photo-editing program.

A Mac infected by this particular breed of malware would be open to a variety of attacks. For instance, hackers could capture screenshots of user activity, access files and clipboard data, and send spam from the computer. Sophos security programs have detected HellRTS as OSX/Pinhead-B since April, according to Cluley.
Apple did not respond to PCWorld’s request for comment.

Saving Face

If Sophos’ claims are correct, Apple wouldn’t be the first OS maker to keep some security fixes secret. Microsoft officials in May admitted that they don’t report all the security shortcomings in their software. Redmond’s non-disclosure of patches was revealed by Core Security Technologies, which discovered three undocumented fixes in recent Microsoft software upgrades.

Does an operating system vendor have a responsibility to reveal all of its security patches to its users? The question is particularly pertinent to Apple, which has long trumpeted the Mac as the safer alternative to Windows PCs.

Cluley believes that Apple’s marketing strategy has contributed to a false sense of security among Mac users:

“Unfortunately, many Mac users seem oblivious to security threats which can run on their computers. And that isn’t helped when Apple issues an anti-malware security update like this by stealth, rather than informing the public what it has done. You have to wonder whether their keeping quiet about an anti-malware security update like this was for marketing reasons. ‘Shh! Don’t tell folks that we have to protect against malware on Mac OS X!’ ”

Apple employees are often “the worst offenders when it comes to giving users security advice,” says Cluley, who adds that a former colleague of his, while visiting an Apple Store recently, overheard a staffer tell a customer that it was “impossible” for Macs to get viruses, and that Mac users shouldn’t “even worry about it.”

Security patches are a fact of life for OS makers. For a vendor like Apple, fixes of this nature can be particularly embarrassing. What do you think? Should Cupertino spill the beans on every anti-malware upgrade it issues?

SAN FRANCISCO – What did the Mac do to deserve this? Lately it seems as if Apple management is giving its Macintosh platform short shrift, instead favoring its younger, sexier mobile devices, also known as the iPhone, iPad, and iPod touch.

The latest affront occurred Monday during Steve Jobs’ Worldwide Developer Conference (WWDC) keynote. Apple’s CEO used most of his two-hour stage time to talk up the new iPhone 4–no surprise there. But he failed to mention that Apple was also launching Safari 5, the latest version of the company’s Web browser that comes with every Mac.

Jobs spent the first 30 minutes of his keynote talking up trendier developments that impact fewer users than an updated Safari, including new Netflix and Farmville apps for the iPhone. (True, the WWDC is a developers’ conference, and Jobs was working the room. But, as his iPhone 4 presentation shows, he was also speaking to the tech world at large.)

What, not even a mention of Safari 5, the gateway to the Internet for millions of Mac devotees? Call me paranoid, but I fear that Apple is giving the Mac the bum’s rush.

Other recent examples of a maligned Mac:

Jobs at last week’s Wall Street Journal D conference: Steve tells the Journal’s Walt Mossberg that the personal computer is on the wane, and that mobile devices are the future. Interestingly, Jobs includes the Mac in his death-of-the-PC prediction.

No more Mac category at design awards: Cupertino has dropped the Mac software category from its annual Apple Design Awards. At the 2010 WWDC, the awards will go to the top iPhone and iPad apps only. Feel the burn, Mac developers.

Apple is a ‘mobile devices company.’ Jobs’ team has made it perfectly clear in shareholder and analyst meetings, as well as during recent product launches, that Apple is focusing on mobile gadgets. While that strategy may include the MacBook laptop, the Mac desktop is definitely the odd device out.

What do you think? Does the Mac have a future?

SAN FRANCISCO – Google’s move to ban Windows for internal use was ostensibly for security reasons. But that looks more like a convenient excuse than anything else, because there are plenty of reasons the ban doesn’t make sense.

Google’s ban of Windows implies that the China attack was a garden-variety Trojan or piece of malware that infected individual PCs. In fact, nothing could be further from the truth. The attack on Google was extremely sophisticated and highly targeted. Dmitri Alperovitch, vice president of threat research for McAfee, told Wired Magazine, “We have never ever, outside of the defense industry, seen commercial industrial companies come under that level of sophisticated attack. It’s totally changing the threat model.”

Almost a dozen pieces of malware and multiple levels of encryption were used in the attack. Many people believe the Chinese government was involved, which means a substantial amount of time and work went into it.

What does this mean? Even if Windows wasn’t being used, Google still would have been targeted. Given the resources behind the attack, there’s a reasonable chance it would have succeeded. So banning Windows won’t keep Google safe.

Also, Macs are vulnerable as well. Mac fans will tell you time and time again Macs are not vulnerable to security risks. It simply isn’t true. Just yesterday, for example, security firm Intego reported that it uncovered spyware on freely distributed Mac applications. There are more Windows attacks because there are more Windows machines. Google switching users from Windows to Macs won’t keep them safe from targeted attacks like the Chinese one.

Plenty of analysts have said the ban won’t make Google any safer. John Pescatore, an analyst at Gartner who specializes in security issues told Computerworld “If [hackers] know that Google uses Macs, then they’ll just target the company with Mac malware. And Mac malware exists.” Michael Gartenberg, an analyst with the Altimeter Group, added, “The idea that security is behind this is a little bogus. Windows seems pretty good for Fortune 500 companies.”

So why did Google ban Windows? One potential reason is to promote the use of its upcoming Chrome OS. And certainly, Google doesn’t want to miss a chance to criticize Windows in the hopes of moving people away from Microsoft Office and onto Google Docs.

It’s not clear, though, that Google is any safer after banning Windows than before.

SAN FRANCISCO – Who’s got the safest operating system? Apple, Google, Microsoft? According to one security expert, what really matters is who’s using the OS.

“Microsoft doesn’t have a monopoly on all the technical vulnerabilities that are out there,” Zulfikar Ramzan, technical director of Symantec Security Response, said Tuesday in a phone interview with PCWorld.

Today’s online criminals are far more likely to target user behavior rather than a technical flaw in the OS. “It’s a lot easier to do that,” said Zulfikar. “You don’t need as many technical skills to find one person who might be willing, in a moment of weakness, to open up an attachment that contains malicious content.”

This trend has been rising rapidly over the past two years. Currently, only about 3 percent of the malicious software that Symantec encounters exploits a technical vulnerability. The other 97 percent of malware is either “piggybacking on that 3 percent,” or more likely trying to trick a user through some type of “social engineering” scheme, according to Zulfikar.

Tricking the User

In other words, most attackers now target human, not technical, vulnerabilities. The key is to trick someone, usually via psychological manipulation, into compromising their own security by installing malware, for instance.

One such attack is when an organization’s chief financial officer (CFO) receives an email claiming to be from the IRS. “It says you haven’t paid your taxes, and if don’t open up this attachment and fill out this form, we’re going to fine you,” Zulfiker said.

A similar scheme involves a bogus inquiry from the “Better Business Bureau.” The attacker(s), claiming to be the BBB, email a company’s CEO and say they’ve opened a complaint file against the firm. The email then instructs the CEO to open the attachment to find out more about the complaint.

Of course, in each case, the attachment propagates malicious software onto the recipient’s system.

So what’s a business to do? First, treat any inbound inquiry with a healthy degree of skepticism. “That should apply through all forms of communication–not just email, but even phone calls and things of that nature,” said Zulfiker. And make sure that all of your employees are aware of these risks. “It’s important to educate people, even on the front lines, to be careful what you divulge to the outside world about the company,” he added.

Microsoft: Still the Biggest Target

No computer or operating system is 100-percent secure, of course, and different types of systems are vulnerable to different exploits.

“Microsoft, being the biggest company in the software space, has attracted the most attention,” Zulfiker said. “People have tried to attack Microsoft’s products because of the (huge) market share. If I’m an attacker, and I want to make the most profit from my attacks, I’m better off going for the company with the most machines out there. That tends to be Microsoft.”

And if Google’s upcoming Chrome OS takes off in the business and consumer market, it’ll have a big target on its back too.