Apple fans may want to watch Firefox very closely in the coming months. It may give you some insight into what might happen if OS X and Macs in general become quite a bit more popular.
Up to now, one of the major selling points of OS X has been the near-complete lack of viruses and spyware targeting the platform. To my knowledge, you can count the number of OS X viruses on your fingers; compare this to the hundreds of thousands of Windows viruses out there today. Many make the argument, however, that the only reason there aren’t more viruses on OS X is that Apple’s market penetration in the PC market is only a couple of percentage points; in other words, it’s mostly security through obscurity, rather than any inherent security features in OS X, protecting Mac users. Thus there’s a lot of discussion of what might happen if, say, the Mac mini becomes a smash hit like the iPod. Will virus coders and malware developers begin targeting OS X, and how successful will their efforts be?
That’s why Firefox is such an interesting test case. When v1.0 launched last year, Firefox was the OS X of the browser universe: the widely-accepted alternative with a small but significant share of the market. Internet Explorer was just like Windows: bloated, sadly behind the times, and shot full of security holes that made it vulnerable to a number of attacks. Firefox has also been advertised as the spyware and virus-free alternative to IE, and just like OS X, the same questions come up: is Firefox inherently safer and more secure than Internet Explorer, or is it just because no one bothers to write code specifically attacking Firefox because its userbase is so small?
But on the heels of a successful million-downloads campaign and a full-page ad in the New York Times, Firefox is riding a media wave that has seen its usage numbers increase dramatically. Accurate browser usage figures are notoriously hard to come by, but the general consensus is that Firefox is close to breaking double digits percentage-wise, if it’s not already there. There is a dark side to Firefox’s surge in popularity, however: some now predict that spyware targeting Firefox installations will appear sometime this year.
Already word is spreading of an exploit from Casale Media that sets some registry keys and sets your Firefox pop-up blocker whitelist to accept all popups from .info domains. And Safari’s pop-up blocker has been defeated as well. To be honest, I’m surprised it took this long; since I started using Mozilla 0.9 four years ago, I’ve seen so few pop-ups that it’s a shock when I have to use Internet Explorer on a friend’s computer. Firefox’s and Safari’s blockers are still mostly effective, despite the latest threat, but it does appear that malware developers are just outside the gates.
How Firefox and its team of open-source developers react to the next wave of attacks will be of interest not only to the 25 million people who have downloaded the browser in the 100 days since its release, but also to the legions of OS X users who may one day wake up to find their own castle beseiged.
Update: Yet more pop-up goodness you should know about:
The popup that has a gray background and says “Warning! Your computer may be infected…” is a known trick of casalemedia, but others also use it.
This popup requests a tiny “bootstrap loader” file from a CGI server, and holds it in memory. Now the tricky part: They have to get YOU to run the loader. How? The entire popup window is a link! Clicking anywhere on that window will close the window, but also constitutes your ok to install Spyware Stormer – which then downloads and silently installs!
Spyware Stormer is a known bad guy. It claims to be an anti-spyware tool, but is actually an ad loading trojan. As far as I know, it only runs in Windows, but it’s a real pain to clean out.
Since this ad is now popping up in all browsers regardless of blocking tools, you need to know. If it happens, don’t click it. Use Ctrl-Alt-Del to bring up the Task Manager and kill it there. That should avoid triggering the OK link.
Apparently all that’s needed is to get this ad through. Once it’s on screen, the rest doesn’t give a shit what browser is running. Warned.

