I’m still not sure what I did to set it off. All I know is that I was blithely surfing the Web using Apple’s Safari browser on my MacBook Air last week, and a page identifying itself as “Apple security center” popped up. It declared that my Mac had 75 viruses, then launched the installation routine for something called Mac Protector.
Whoa. Whoa. Whoa. I’m pretty smart for my age — and read my tech blogs — so I knew it was a Trojan horse, pretending to find malware on my computer so it could pretend to sell me anti-malware software. If I bit, it would attempt to steal my credit-card information.
I closed the “security center,” then canceled out of the installer and dragged it into the Trash. The intrusion was over, and my Mac and my data were never really at risk.
Still, it was an unnerving experience. For years, attacks against Apple’s OS X operating system have had a whiff of urban legend about them. Security researchers have repeatedly proved that Macs aren’t impervious, but the troublemakers have mostly steered clear. They’ve been too busy inflicting pain on a far bigger, juicer target: Windows.
Mac Protector is real, and it’s cropping up in variants with names such as Mac Defender and MacGuard. They’re landing on enough Macs that Apple released an OS X update this week designed to foil them. Whereupon a version of the Trojan that bypassed the new security measures immediately appeared.
The attacks on Macs and Apple’s response to them have stirred up new controversy in an ancient debate. Is OS X uniquely well-protected from cybercrooks? As its market share increases, will it become a more enticing target? Are Mac users who don’t use security software asking for trouble?
These questions sound simple enough, but the discussion has always been fueled as much by emotion and politics as by rational analysis. Some Mac fans have behaved as if it was their birthright to live in a peaceable kingdom. They shouldn’t. Some Windows users, itching to learn what schadenfreude feels like, keep predicting that the sky is about to crash down on Macheads. It hasn’t. Software companies that sell Mac anti-malware utilities like to chime in regularly. Guess what stance they tend to take?
The first thing to understand about Mac Defender/Protector/Guard is that it’s just one attack, and not a particularly devious one. Even in its most pernicious form to date, it can only do its dirty work if its intended victim decides to install an unfamiliar piece of software that appears from nowhere — which nobody should do under any circumstances. It’s also a cakewalk to remove, unlike many Windows-based fake antivirus Trojans.
Moreover, the scariest pieces of malware aren’t Trojans — they’re more sophisticated threats such as botnets, which can silently enlist your PC into a zombie army of hundreds of thousands of machines dedicated to tasks like advertising fraud and spam distribution. Almost all of them target Windows, not OS X.
But the fact that the recent spate of Mac attacks could be worse doesn’t mean that Apple types don’t need to think about their computing safety. It’s not just the possibility of more OS X malware. Instead of putting a particular operating system in the crosshairs, nogoodniks are turning their attention to social networks such as Facebook and Twitter, where they spam users, steal identities, and generally do their best to wreak havoc. They don’t care whether you use Windows or a Mac, as long as your guard is down.
So is it time for Mac aficionados to admit defeat and install security software? I asked a bunch of the brainiest ones I know: my pals on Twitter. Some told me that they’re already running utilities from companies such as Symantec and Sophos. The vast majority, however, including professional Mac savants such as Macworld editors, said that they still don’t.
That’s a defensible stance. Security software isn’t without its own downsides. Even the best packages require a certain amount of babysitting; the worst ones get in your face, bog down your system, and teeter on the brink of being more of a hassle than the dangers they’re meant to protect you against.
When I think of computer security, I’m reminded of the garage at the San Francisco apartment where I used to live. For a while, it got broken into nearly every weekend. After the bad guys made off with my bike, I secured everything else I cared about. Even though my stuff was reasonably safe, worrying about additional intrusions on an ongoing basis was no fun.
Windows PCs have sometimes felt under permanent siege, like that garage. Macs never have. But these new attacks aren’t a nightmare scenario, just evidence that there’s no such thing as risk-free computing. Smart Mac users knew that all along — they keep their cool, but they also keep their wits about them. And they’re a lot less likely to be endangered by new or future attacks than anyone whose mantra has been it can’t happen here.
McCracken blogs about personal technology at Technologizer, which he founded in 2008 after nearly two decades as a tech journalist; on Twitter, he’s @harrymccracken. His column, also called Technologizer, appears every Thursday on TIME.com.
See “PC vs. Mac: Which Is Right for You?”
See TIME’s Pictures of the Week.
