I did not imply such in that context, that's just your unique interpretation.
Here's what you said:
It requires several user inputs thus not passive.
You're confusing my comments with the wrong context. This reply was in regards to your comment that I faulted Mac users because they plugged their computers in, turned it on and surfed the internet. I made no such implications, that was your unique assumption.
The comment "it requires several inputs..." is in regards to how it's not a true drive-by,
passive attack. Flashback does present itself as an applet (exploiting a weakness in Java code for Macs) which needs the user to click either "Ok" or "Update" in order to run the code.
You keep saying, "the user did something, therefore it's not a passive attack".
Your definition of a "passive attack" must therefore mean "Worm".
If not, what is a "passive attack"?
A true passive "drive by" attack would
only require the user to visit a booby trapped website. In other words just loading up that particular web page is all that's needed. In many pwn2own hacking contests, the contestants would show up with a script that was prepared days, weeks, months ahead of the contest and attempt to run existing code that's on the system (for example Calculator). What this demonstrates is that a rogue executable could be anywhere within the computer and the web page provides the catalyst in order to run it. This demonstrates how browsers are a common attack vector for exploitation. Plug ins, addons and extensions are weaknesses if written poorly (i.e. Flash, Java).
A worm by definition is a standalone, self-replicating code that (unlike a true virus) need not be part of another application/program. Must it be a worm? No. Worms are one of the most easily detectable types of malware and the component that allows itself to self replicate is not necessary if the delivery method was through a rogue website. It would be easier for a malware coder to deliver a seemingly innocent code which contained dormant, malicious code and have the trigger provided through a website.
You have constantly blamed the Mac users for getting infected ("it's their own fault").
OTOH, I am not blaming the Mac users for getting hit by a Drive-by attack.
Especially since they were told that their systems are immune to malware.
There were no blame put upon anyone, that was your assumption again, I'm not sure why you insist that there's any kind of blame since I did not mention it. When I said you think in such binary terms, that means you think in absolutes or "it must be this or that". Situations present itself in many ways whether its faulted to you or not, what matters is your level of preparation and your ability to deal with it. If you didn't get my Forrest Gump comment, all it means is "____ happens".
Problems don't occur without a cause (Cause and Effect).
The cause in the case of malware
might be:
- Bad design
- Sloppy coding
- User foolishness/ignorance
A perfect OS (or other software package) would have no exploits and therefore no security updates.
As such, the only way to hijack such a system would be to trick users into installing malware.
The only thing users can really do (assuming they actually want to use their computers) is make sure they have:
- All the latest security patches for their OS and other software.
- Their firewall turned on.
If they run Firefox, they should install NoScript.
Again you're taking context and skewing it completely off the mark, not sure why you need to discuss "cause and effect" here since it wasn't mentioned. It's your insistance that I'm placing fault upon the user, I made no such claim, stated it and yet you keep clinging onto it.
Malware's effectiveness lies in a multitude of possibilites. It starts with the knowledge the coder has with its projected target systems. Then in combination it uses existing vulnerabilities which may or may not be known (such as zero days) and unresolved (unpatched applications). It often relies on steering users to an area in which the code awaits delivery (booby trapped website, IRC, torrents, emails, etc.) and as such exploits the user's level of awareness (in varying degrees) in order to complete the delivery and execution of the rogue code.
There's no such thing as a perfect OS, not sure why you felt it needed to be mentioned. OSX has one major advantage in the area regarding malware over Windows and it's due to how malware is most often profit-driven and it goes hand in hand with just how large the actual Windows marketshare is (in comparison to OSX in all flavors). If the Windows to OSX marketshare ratio were, for example 1:1 I believe you'd see a much larger explosion of malware occurrence with OSX.
If you walked outside your home and a rogue lightning bolt hit you, you think there has to be some fault involved?
You obviously do.
It requires several user inputs thus not passive.
I don't. A common user has a need to use the internet and you can't realistically expect to block something the user must use as in providing a patch to disable the internet. You need to understand that with all things, risks are involved. If you can eliminate all risks then I think your solution of simply not using the computer may be one of the most effective but it's my belief that it's an excessive, overreaction. Since no OS is perfect and the internet practically endless, there's always some sort of risk using it.
People could easily implement controls like running antivirus/antimalware software to reduce some of the risks. You could also check on websites which help educate you on what's considered risky and how to deal with them in order to further reduce your risk. The goal is to minimize the risk level to the lowest point. Risks are assessed and dealt with the combination of its severity and likelihood of it happening.
