Mac users have often extolled the virtues of security relating to their numbers, or rather lack thereof… surely such a niche market can’t be as vulenerable to attack as, say, Windows users, because writing malicious code for such a small segment wouldn’t be worth it. Can it?
Well, Mac users have a very false sense of securty. And the Witty worm is living historical proof.
Unlike the major virii that make headlines today and could potentially infect millions of unprotected computers, the targeted audience for Witty was a mere 12,000 workstations – those running BlackICE technology, found in certain niche firewall programs. And it managed to infect every one of them in less than 45 minutes. And not only did it infect with prodigious speed, but it destroyed with equal prowess too: Witty’s destructive payload would select a random 65K segment of a computer’s hard drive, and delete it, slowly rendering the host machine unusable.
To quote bynkii.com:
On March 8th, 2004, eEye Digital Security discovered a vulnerability in ISS’s BlackICE/RealSecure products. On March 9th, ISS released a patch for the vulnerability.
On March 18th, eEye published a high-level description of the vulnerability. 36 hours later, Witty was released into the wild.
Witty was only 637 bytes long.
Moral of this story? There is no such thing as a lack of interest through lack of numbers.