What's This? A Mac Virus? No, Actually It's a Weakness in Java.
When a computer incident happens on Apple's Mac OS X, it's a headline-making event. When it happens on Windows, it's just another day. — That remains the reality, even after a bunch of media reports on how a vulnerability …
Context & Ripple Effects
The Flashback trojan that slipped onto Macs without a password prompt has now infected roughly 600,000 machines worldwide, and Apple shipped a Java 1.6.0_31 update closing the exploited flaws only after the damage was done. AllThingsD's framing matters: this is not a Mac-native virus but a weakness in Java — a cross-platform runtime — being exploited on OS X.
That distinction lands against a long-running argument. Coverage going back to a 2006 InfoWorld piece asking whether Windows was inherently more vulnerable, and 2007 comparisons of Mac and Windows vulnerability counts, built the popular belief that the Mac was structurally immune. A six-figure infection count forces that belief to be tested against how the malware actually arrived.
First-order effects
- Hundreds of thousands of Mac owners who never entered a password are carrying a trojan until they apply Apple's Java update or run removal steps, making the patch rollout the urgent operational task.
- Apple, which controlled Java updates on OS X at this point, owns the exposure window — its later-than-Windows patching of the same Java flaws is what left the door open.
Second-order effects
- Security vendors get a fresh selling moment for Mac antivirus products, since a 600,000-machine infection gives them their first mass-market proof point on OS X.
- Apple faces pressure to rethink how quickly it relays upstream runtime fixes like Oracle's, because the 'it's just another day' cadence Windows users tolerate now applies to its own platform whenever a cross-platform component is the vector.
Third-order effects
- If Mac market share keeps growing, malware economics follow the user base rather than the OS brand, eroding the immunity perception that itself deterred attackers.
- Platform security becomes judged by the weakest bundled dependency, pushing operating-system vendors toward tighter control or faster syndication of third-party runtimes — a structural shift from 'which OS is safer' to 'how fast does any vendor ship fixes'.
The trend: As the Mac installed base grows, cross-platform runtimes like Java become the vector that converts OS X's low-malware reputation from a structural advantage into a patch-cadence problem like everyone else's.