Low End Mac
Search LEM 
Donate · Amazon.com · iResQ · Advertise
Other Cobweb sites: Low End Living · Reformed.net
The Rumor Mill

Macintosh Love Bug

Just a week ago the Windows world was infected by the LoveLetter worm - and that, labelled the first Open Source virus on Slashdot, spawned four variants within the first day. The media was hysterical, often forgetting that every operating systems besides Windows was immune to the "Love Bug."

Anne Onymus has done some leg work and managed to interview one of the Mac communities leading code crunchers.

5/11/2K: Macintosh über-hacker Jeeves Stob (yes, it's a pseudonym - and, we think, a clever almost-palindrome) gets frustrated every time there's a major virus.

Like a lot of Mac users, Stob never received a copy of the LoveLetter virus that was launched one week ago - at least not from an unwitting Windows user. He figures it must be because all his friends are too smart to run unknown enclosures or they use Macs.

Most likely, it's both.

Stob had fun perusing the Visual Basic code used to create the Love Bug after a hacker acquaintance forwarded him a copy. He said the code was not at all difficult to follow, explaining why it was so easy for others to modify the source code and create their own variants of the LoveLetter worm. Of course, the whole thing depends on the tight integration of Microsoft Windows, Outlook, and Visual Basic.

In Stob's words, "It's hard to say whether that integration is a good thing or a bad thing. It lets you do some very powerful things, but it also makes you a ready target for malicious hackers. In fact, it seems that Microsoft's email clients (and only on Windows) are the only ones capable of carrying such a payload and distributing it so widely. The ubiquity of Windows and Outlook among the masses create a tempting target for the kind of people who created Melissa and LoveLetter."

As for the Mac, Stob says that's a whole 'nother story. Mac users run many different versions of the OS and don't boot from a hard drive called "C:" - this presents a lot more variables for the potential Mac worm or virus maker. Mac users may or may not have Java. They may have disabled AppleScript. A hacker cannot depend on those kind of resources when creating a virus.

Maybe that's why there are only about five-dozen Mac viruses, compared with over 20,000 in the Windows/DOS world.

Mac viruses tend to be easily contained. People using Disinfectant (240K), a freeware antivirus program discontinued nearly three years ago, can easily clean up all viruses created before the AutoStart Worm and Word Macro viruses. The AutoStart Worm can be disabled simply by turning off Enable CD-ROM Auto Play in the QuickTime Settings control panel - and several free programs can detect and eradicate it, should your Mac become infected.

As for Word macro viruses, there have long been patches and settings to take care of them, too. Avoiding Word would also do the job, but with an estimated 94% of computer users across platforms using Word, that may not be a practical solution.

The Mac just isn't an attractive platform for the virus maker.

I asked Stob to speculate on how one might create something like LoveLetter for the Macintosh. He replied that it wouldn't be terribly difficult to create the worm itself using AppleScript or even the popular VISE software installer. As is obvious from LoveLetter, it wouldn't be hard to get the average user to run the program - just devise a cover letter and create a fitting file name and icon for the worm itself.

The program itself could cause no end of problems: renaming files, moving resources to other folders, overwriting files, etc. This would be no trouble at all for a good programmer.

The biggest problem is viral reproduction. Just how could the program send itself to everyone in the user's address book when Mac users choose from such a broad variety of email clients: Eudora, Outlook Express, Claris Emailer, Pegasus, Netscape, QuickMail, MailSmith, Green, SafeMail, SnapMail, and PowerMail among them - not to mention Web-based email.

The simple fact is, to successfully launch a program like LoveLetter on the Mac, the hacker would have to address at least the three or four most popular mail clients. Even then, with Mac users representing perhaps 10% of the worldwide installed base, the worm would have a tough time delivering itself to enough people who had Macs, would actually run the program, and would be using one of the targeted email clients.

No matter how good a Mac worm, because the Macintosh is a minority platform, it could never cause the kind of widespread damage and hysteria of Melissa or LoveLetter. There might be a few isolated cases, but the media would never even take notice of it.

Stob notes that hackers want notoriety, which means they have to target Windows, the dominant operating system, and its most common applications. This explains Word and Excel macro viruses, as well as email-borne viruses that are dependent on Microsoft email clients.

They won't get their fifteen minutes of fame any other way.

Has Stob himself ever created a virus? Grinning, he explains he has a collection of viruses for almost every operating system - safely stored on CD-ROM. He's learned a lot of tricks and written his own code for any number of operating systems (he's given up on Windows, because there's no challenge there), but has never released a virus into the wild. "They're a great learning tool," he notes.

Stob's personal favorite isn't really malicious, but something akin to the Belgian "pie in Gates' face" scenario. Years ago, when it looked like the NeXT Computer might actually compete with the Mac, Stob created a program that would completely overhaul the visual interface and play a sound at startup.

With Stob's little NeXT virus, Steve Jobs' little black box acted just like a Macintosh.

 - Anne Onymus

Further Reading

  • Viruses on the Mac, Stephen Beale, MacWeek, 5/7/00. "The first Mac viruses, nVir and MacMag, appeared in 1987...."

<back to the original version of this article>

Recent Rumor Mills

Links for the Day

  • Mac of the Day: 'Yikes!' Power Mac G4, Aug. 1999 - The only Power Mac G4 with PCI graphics was built on a modified G3 motherboard.
  • Group of the Day: Tiger List is for anyone using Mac OS X 10.4.
  • July 4 in LEM history: 00: When Randy met Mac - 08: Wouldn't life be great with an iSlate? - Mac Pro overclocking, Windependence with Darwine, Blu-ray for Macs, and more
  • Support Low End Mac

Recent Content on Low End Mac

Recent Deals

  • Best Mac Pro Deals, 07.02. Used 3 GHz 4-core, $2,000; 3.2 8-core, $2,900; refurb 2.8 8-core, $2,399; new 2.66 4-core, $2,290 a/r; 2.26 8-core, $3,070 a/r; 2.66, $4,499; more.
  • Best Mac OS X 10.4 'Tiger' Deals, 07.02. Full version DVD, $140; 5 user family pack, $370; 10-user Server, $299.
  • Best 17" PowerBook G4 Deals, 07.02. Used 17" 1 GHz PowerBook, $689; 1.67 GHz, $749; hi-res, $1,029.
  • Best Xserve Deals, 07.02. Used 2 GHz single G5, $800; dual, $1,000; refurb 2.8 GHz 4-core Xeon, $2,100; new 2.26 4-core Nehalem, $2,888; 8-core, $3,449; 2.66, $4,799; 2.93, $5,999.
  • Best iPod touch Deals, 07.01. Refurb 2G/8 GB, $179; 16 GB, $259; iG/32 GB, $279; new 2G/8 GB, $215; 1G 16 GB, $210; 2G, $275; 2G/32 GB, $369. Prices include shipping.
  • Best 13" MacBook & MacBook Pro Deals, 07.01. Used 1.83 GHz, $595; 2.0, $629; new 2.0, $889; 2.13, $925 after rebate; refurb 2.0 Unibody, $949; 2.4, $1,099; new 2.26 MBP, $1,119 a/r; more.
  • Best 12" PowerBook G4 Deals, 07.01. Used 867 MHz Combo, $400; 1.33 GHz, $448; 1.5 GHz, $599; 1 GHz SuperDrive, $509; 1.33 GHz, $599; 1.5 GHz SD, $679.
  • Best Apple TV Deals, 07.01. Refurb 40 GB Apple TV, $199; new, $220; refurb 160 GB, $279; new, $320. Prices include ground shipping.
  • Best G4 iBook Deals, 06.29. Used 12" 800 MHz Combo, $290; 1 GHz CD, $299; Combo, $370; 1.33 GHz, $428; 14" 1 GHz Combo, $399; 1.2, $465; 1.42 GHz, $500.
  • Best Power Mac G3 and PCI Video Card Deals, 06.29. Used beige 300 MHz, $25; G4/366, $39; blue & white 350, $80; 400, $90; 450, $105; PCI video cards from $15; shipping additional.
  • Best Mac OS X 10.0-10.3 Deals, 06.29. Mac OS X 10.0, $30; 10.1, $20; 10.2, $60; 10.3, $50; 10.3 Server, unlimited users, $130.
  • Best Time Capsule and AirPort Deals, 06.29. Close-out 500 GB Time Capsule, $199; 1 TB, $350; AirPort Extreme Base Station, $130; refurb AirPort Express, $85.
  • More deals in our archive.

Low End Mac Reader Specials

Memory To Go Special: MacPro 8 Core 8GB kit $232 / 4GB kit $116 / 2GB kit $72. New Macbook 2GB DDR3-$65. HARD DRIVES available -- Free shipping / LIfetime warranty.

Download Typestyler, still the Ultimate Styling Tool for Internet, Print and Video Graphics. Works great in Classic with a Native OS X Version on the way. Free Tryout: www.typestyler.com

LA Computer Company: Specials on AppleCare, iMac's, MacBook Pros and more. Optical Drives for Apple iBooks, Powerbooks, MacBooks, MacBook Pros in Stock. Call 1-800-941-7654 Click Here.

OWC: Premium Memory for Mac without the Premium Price. DDR2 4GB from $47.99, DDR3 4GB for Unibody $79.99, Mac Pro 4GB $97.99. Expert Support, Free Installation Videos & Guides. www.MacSales.com

Poker Mac Don't install Parallels to play poker online! Poker Mac will show you how to download and install a native Mac poker application such as Full Tilt Poker Mac.

Laptop Hardware Provided by TechRestore - Overnight Mac & iPod Repairs.

Compare products like desktop computers, apple laptops, apple macs, and LCD Monitors side by side! All the information and reviews to make the best purchasing decision for new mobile phones, sat nav systems, or MP3 players. The Ciao online shopping community makes searching products easy for you.

The Rumor Mill is part of Low End Mac. This site has no affiliation, actual or implied, with Apple Computer, Inc. The site exists to provide an alternative to real rumor sites. Any logos, slogans, names, or representations used or made are done so in the above context. All information on The Rumor Mill (and the rest of Low End Mac) is copyright ©1999-2007 by Cobweb Publishing, Inc., unless otherwise noted, and may not be reproduced in any form without prior consent. All Rights Reserved.

LINK POLICY: This site allows and encourages links to any public page, so long as the linked page does not appear within a frame that prevents bookmarking the linked page.

Low End Mac is an independent publication and has not been authorized, sponsored, or otherwise approved by Apple Computer, Inc. Apple and the Apple Logo are trademarks of Apple Computer, Inc. All other trademarks are the property of their respective holders. If you still think this is serious business, read About The Rumor Mill.