According to statistics posted recently on McAfee's Avert Labs
blog by Marius van Oers, the security and anti-virus company is
aware of some 236,000 "malicious malware items" such as computer
viruses and spyware.
Of those nearly quarter million nasty bits and pieces, about 700
are aimed at computers running various Unix and Linux operating
systems. Mac OS X is the target of seven.
Nearly all of the rest are aimed at Microsoft Windows users.
The question Windows users tend to ask, however, is a good one.
Are there fewer viruses and spyware aimed at the Mac and Linux
because these platforms are inherently more secure than Windows, or
are these computing platforms simply less tempting targets for
malware because of their minority status?
Often, when a question seems to have more than one answer, both
explanations account for part of the answer.
Infectious diseases are more likely to spread when people are
packed tightly together in cities than when a population is thinly
spread. The same is true for computer viruses; the large number of
Windows users makes it easy for infections to spread from one
computer to another and offer malware creators more return on their
effort.
Over the years, Microsoft made a number of design decisions for
Windows and other software products that traded security for ease
of customization and use. For instance, the macro language bundled
with Microsoft Office (Visual Basic for Applications) made it
possible for power users to automate complex tasks. That same power
made it equally possible to use VBA to infect Word and Excel
documents.
Windows 2000 and XP users typically run (whether they know it or
not) as administrative users with full power to install and remove
software, make changes to the system setup and more. But when
you're logged on in that way, spyware and viruses can also install
themselves and make system changes without needing authorization.
They can even do this invisibly in the background.
Running the computer as a limited user would be safer, but most
users don't do that; those that try it tend to give it up - too
many everyday tasks, such as installing Microsoft's own updates,
fail to work.
It's not the same for Linux and Mac OS X users. No matter how
they're logged on to their computer, they get asked to type their
password for any software installation that's going to change the
computer setup.
Unlike on a typical Windows system, any virus or spyware trying
to install itself would have to ask for explicit approval. The
result: It's much harder to infect a Linux or Mac system, so users
spend less time on security and more on getting their work
done.
Microsoft's new Windows Vista tries to copy that: What Microsoft
calls User Account Control is turned on by default. As on a Mac,
UAC requires user approval before system changes can be made.
Microsoft, however, made the list of actions needing approval much
larger - even renaming an icon on the desktop may require multiple
OKs. It's more secure, but also more annoying.
There is an irony, however. As mentioned in last week's
column, a big selling point for the latest generations of Macs
is their newfound ability to run Windows and Windows software.
Whether running on a Mac or any other PC, Windows remains just
as vulnerable to those 236,000 malicious malware items. 
This article was first published in Business in Vancouver, High Tech Office
column, April 10-16, 2007.
